Create manually triggered Github Action for running CI on behalf of forks #6399
Conversation
|
| - name: Check user for team affiliation | ||
| uses: tspascoal/get-user-teams-membership@v2 | ||
| id: teamAffiliation | ||
| with: | ||
| GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }} |
There was a problem hiding this comment.
Is it safe to pass this token to a third-party action?
There was a problem hiding this comment.
This is a good point. The source code is "obfuscated" in some sense because dist is built and committed to the repo, so there is a security issue there.
We might look instead at copy/pasting the source into our own source code and calling it directly.
There was a problem hiding this comment.
We could also create a read:org only token https://github.com/tspascoal/get-user-teams-membership/blob/master/README.md?plain=1#L23
There was a problem hiding this comment.
But forking that repo into our org might be the safest option
|
A wrangler prerelease is available for testing. You can install this latest build in your project with: npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-wrangler-6399You can reference the automatically updated head of this PR with: npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/prs/6399/npm-package-wrangler-6399Or you can use npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-wrangler-6399 dev path/to/script.jsAdditional artifacts:npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-create-cloudflare-6399 --no-auto-updatenpm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-cloudflare-kv-asset-handler-6399npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-miniflare-6399npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-cloudflare-pages-shared-6399npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-cloudflare-vitest-pool-workers-6399npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-cloudflare-workers-editor-shared-6399npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-cloudflare-workers-shared-6399npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11939308871/npm-package-cloudflare-workflows-shared-6399Note that these links will no longer work once the GitHub Actions artifact expires.
Please ensure constraints are pinned, and |
| GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }} | ||
| username: ${{ github.actor }} | ||
| team: wrangler | ||
| - name: Stop workflow if user is no member |
There was a problem hiding this comment.
| - name: Stop workflow if user is no member | |
| - name: Stop workflow if user is not a "wrangler" team member |
?
| run: gh pr checkout ${{ inputs.pr-number }} | ||
|
|
||
| - name: "Create Draft PR" | ||
| run: git checkout -b run-ci-on-hehalf-of-${{ inputs.pr-number }} |
There was a problem hiding this comment.
Should we run a branch -D on this branch first? Unlikely conflict, but possible.
There was a problem hiding this comment.
Yeah I was considering this needs to be repeatable. I was thinking a force push or something once I confirmed this all worked but branch -D would also work – do we need to delete the remote branch too? and close the existing PR?
There was a problem hiding this comment.
If that's possible then it seems like a good idea, to avoid needing any potential manual cleanup.
|
One more thing we might consider is to update this section of |
bb43eb0 to
122e8be
Compare
122e8be to
f00298a
Compare
|
Congratulations @RamIdeas, the maintainer of this repository has issued you a holobyte! Here it is: https://holopin.io/holobyte/cm3x9uw4p65030cmjswamsxbp This badge can only be claimed by you, so make sure that your GitHub account is linked to your Holopin account. You can manage those preferences here: https://holopin.io/account. |
This PR introduces a GIthub Action which can be triggered manually to clone a fork to a new branch and open a draft PR with the "e2e" label which will (hopefully) run the e2e jobs.
Inputs:
type: string(the PR to clone from)type: boolean(to confirm the user has reviewed the PR for usage/leakage of secrets)Also:
wranglerteam