Repository navigation
ci: unify workflow names, triggers and release permissions #patch - #52
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #52 +/- ##
==========================================
- Coverage 69.01% 68.37% -0.64%
==========================================
Files 136 136
Lines 7613 7466 -147
==========================================
- Hits 5254 5105 -149
- Misses 2359 2361 +2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to the shared-workflow adoption. Three gaps were left: file names and triggers
still differed per repo, and the release caller did not grant its own permissions.
Naming and triggers
Every repo now has the same three files with the same names, extensions and job names:
lint.yml/python-lint.yml/ci.ymllint.yamlpython-test.yml/python-tests.yml/ci.ymltest.yamlrelease.yaml/release.ymlrelease.yamlLint and test now both run on the same events everywhere -- every PR, plus every push to
mainso a merge is verified even if no PR check covered it:Previously lint was PR-only in three repos but push+PR in norfair-rs, and tests were
PR-only in disent but tags-plus-branch-filtered in mtg-dataset.
The release caller now grants its own permissions
mtg-vision's release run failed at startup when PR #1 merged:Cause: a reusable workflow cannot hold more permission than its caller. The shared
release.yamlpushes tags and creates releases, so it needscontents: write-- butmtg-vision's default workflow token is read-only, while mtg-dataset and disent default
to write. Same caller, three different outcomes:
Fixed on the caller rather than by changing a repo setting, so the workflow behaves the
same everywhere regardless of how a repo is configured: