From 48baebba5090892683f2bdd6095e907d674e7106 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 2 Jun 2025 20:32:44 +0200 Subject: [PATCH 1/3] workflows/codeowners: improve test-ability in forks This allows to at least run basic codeowner stuff in forks. --- .github/workflows/codeowners-v2.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml index 5c6b0b8da4c6..c4b2f65981ba 100644 --- a/.github/workflows/codeowners-v2.yml +++ b/.github/workflows/codeowners-v2.yml @@ -45,7 +45,6 @@ jobs: check: name: Check runs-on: ubuntu-24.04-arm - if: github.repository_owner == 'NixOS' steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: @@ -91,7 +90,6 @@ jobs: request: name: Request runs-on: ubuntu-24.04-arm - if: github.repository_owner == 'NixOS' steps: - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31 @@ -101,6 +99,9 @@ jobs: with: path: trusted + - name: Build review request package + run: nix-build trusted/ci -A requestReviews + - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 if: vars.OWNER_APP_ID id: app-token @@ -111,9 +112,6 @@ jobs: permission-members: read permission-pull-requests: write - - name: Build review request package - run: nix-build trusted/ci -A requestReviews - - name: Request reviews if: steps.app-token.outputs.token env: From 50f6d8d90946f9e6248de473795b768902240ab0 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 2 Jun 2025 20:33:47 +0200 Subject: [PATCH 2/3] workflows: condition steps with secrets on pull_request_target event In a pull_request event, vars are available, but secrets are not. Thus the steps will run, even though there is no secret to request those tokens - they will fail. The intent was, to skip them entirely in that case. --- .github/workflows/codeowners-v2.yml | 4 ++-- .github/workflows/reviewers.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml index c4b2f65981ba..b7f875cce01b 100644 --- a/.github/workflows/codeowners-v2.yml +++ b/.github/workflows/codeowners-v2.yml @@ -67,7 +67,7 @@ jobs: run: nix-build trusted/ci -A codeownersValidator - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 - if: vars.OWNER_RO_APP_ID + if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID id: app-token with: app-id: ${{ vars.OWNER_RO_APP_ID }} @@ -103,7 +103,7 @@ jobs: run: nix-build trusted/ci -A requestReviews - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 - if: vars.OWNER_APP_ID + if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID id: app-token with: app-id: ${{ vars.OWNER_APP_ID }} diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml index 884cd2b266a6..a859ac70acb1 100644 --- a/.github/workflows/reviewers.yml +++ b/.github/workflows/reviewers.yml @@ -44,7 +44,7 @@ jobs: # See ./codeowners-v2.yml, reuse the same App because we need the same permissions # Can't use the token received from permissions above, because it can't get enough permissions - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 - if: vars.OWNER_APP_ID + if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID id: app-token with: app-id: ${{ vars.OWNER_APP_ID }} From 58b557670474aa5d1eafeb4e83218fef0fd760a5 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 2 Jun 2025 20:46:55 +0200 Subject: [PATCH 3/3] workflows/eval: fix pull_request condition I changed the name of the workflow last minute before merge and forgot to adjust the path here. --- .github/workflows/eval.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index 40a60bbfe025..473f974a024b 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -4,7 +4,7 @@ on: pull_request: paths: - .github/workflows/eval.yml - - .github/workflows/reviews.yml # needs eval results from the same event type + - .github/workflows/reviewers.yml # needs eval results from the same event type pull_request_target: push: # Keep this synced with ci/request-reviews/dev-branches.txt