Unverified Commit 2a8c7895 authored by Wolfgang Walther's avatar Wolfgang Walther Committed by GitHub
Browse files

workflows/check: run codeowners validator from trusted checkout (#457527)

parents 9e354b78 f66a380e

.github/workflows/README.md

+1 −1
Original line number Diff line number Diff line
@@ -64,7 +64,7 @@ This results in a key with the following semantics: 


## Required Status Checks



The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pr.yml` and `merge-group.yml`.

The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pull-request-target.yml` and `merge-group.yml`.



The PR workflow defines all checks that need to succeed to add a Pull Request to the Merge Queue.

If no Merge Queue is set up for a branch, the PR workflow defines the checks required to merge into the target branch.

.github/workflows/check.yml

+2 −1
Original line number Diff line number Diff line
@@ -80,6 +80,7 @@ jobs: 
        uses: ./.github/actions/checkout

        with:

          merged-as-untrusted-at: ${{ inputs.mergedSha }}

          target-as-trusted-at: ${{ inputs.targetSha }}



      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
@@ -92,7 +93,7 @@ jobs: 
          pushFilter: -source$



      - name: Build codeowners validator

        run: nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A codeownersValidator

        run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator



      - name: Validate codeowners

        env:

.github/workflows/reviewers.yml

+1 −1
Original line number Diff line number Diff line
@@ -102,7 +102,7 @@ jobs: 
            const run_id = (await github.rest.actions.listWorkflowRuns({

              owner: context.repo.owner,

              repo: context.repo.repo,

              workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pr.yml',

              workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pull-request-target.yml',

              event: context.eventName,

              head_sha: context.payload.pull_request.head.sha

            })).data.workflow_runs[0].id

.github/workflows/test.yml

+2 −2
Original line number Diff line number Diff line
@@ -63,7 +63,7 @@ jobs: 
              '.github/workflows/eval.yml',

              '.github/workflows/labels.yml',

              '.github/workflows/lint.yml',

              '.github/workflows/pr.yml',

              '.github/workflows/pull-request-target.yml',

              '.github/workflows/reviewers.yml',

              '.github/workflows/test.yml',

            ].includes(file))) core.setOutput('pr', true)
@@ -87,7 +87,7 @@ jobs: 
    if: needs.prepare.outputs.pr

    name: PR

    needs: [prepare]

    uses: ./.github/workflows/pr.yml

    uses: ./.github/workflows/pull-request-target.yml

    # Those are actually only used on the pull_request_target event, but will throw an error if not set.

    permissions:

      issues: write