Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI fails for pull requests from forks #374

Closed
2 tasks
agateau-gg opened this issue Oct 10, 2022 · 1 comment · Fixed by #485
Closed
2 tasks

CI fails for pull requests from forks #374

agateau-gg opened this issue Oct 10, 2022 · 1 comment · Fixed by #485
Labels
type:infra Issues with our CI setup, packaging, or process

Comments

@agateau-gg
Copy link
Collaborator

agateau-gg commented Oct 10, 2022 •
edited
Loading

Description

When a pull request is opened from a fork, the CI fails because it cannot access the GITGUARDIAN_API_KEY secret required to run functional tests. This is caused by a security feature on GitHub actions: pull requests across forks cannot access secrets, neither secrets from the source repository nor from the target repository.

Definition of done

  • Investigate the possible workarounds. A limited investigation shows that the pull_request_target event instead of the pull_request one would give access to the secrets because in this case the scripts run in the context of the target repository. Running untrusted code from this event is however a security issue, so pull_request_target cannot be used as a direct replacement for pull_request: the submitted code needs to be manually reviewed before triggering the run.
  • If a viable solution has been found, implement the changes. If not, disable functional tests for pull-requests coming from forks. Do not disable them based on whether GITGUARDIAN_API_KEY is set or not: we want the tests to fail for a CI run on pushes and on pull-requests from branches within the repository.
@agateau-gg agateau-gg added type:bug Something isn't working type:infra Issues with our CI setup, packaging, or process labels Oct 10, 2022
@agateau-gg
Copy link
Collaborator Author

Maybe the solution is to do something like this: https://github.com/marketplace/actions/test-reporter#recommended-setup-for-public-repositories

@agateau-gg agateau-gg added type:infra Issues with our CI setup, packaging, or process and removed type:infra Issues with our CI setup, packaging, or process type:bug Something isn't working labels Jan 18, 2023
@agateau-gg agateau-gg mentioned this issue Feb 20, 2023
Closed
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
42cb43f 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
@agateau-gg agateau-gg mentioned this issue Feb 22, 2023
Closed
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
5681291 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
3d2f72e 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
3309e7b 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
55b144f 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
0af41d3 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
7f93e4d 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: do not run functional tests on pull-requests forks
43dc5e3 
These tests fail because they need the GITGUARDIAN_API_KEY variable, but
it's not available for pull-requests coming from forks.

Fixes GitGuardian#374
agateau-gg added a commit to agateau-gg/ggshield that referenced this issue Feb 22, 2023
@agateau-gg
chore: fix fails on pull-requests from forks
0696aa0 
Do not run steps which require the GITGUARDIAN_API_KEY variable. These
steps always fail because the variable is not available for
pull-requests coming from forks.

Fixes GitGuardian#374
@agateau-gg agateau-gg mentioned this issue Feb 22, 2023
Merged
agateau-gg added a commit that referenced this issue Feb 22, 2023
@agateau-gg
chore: fix fails on pull-requests from forks
6ba04c5 
Do not run steps which require the GITGUARDIAN_API_KEY variable. These
steps always fail because the variable is not available for
pull-requests coming from forks.

Fixes #374
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type:infra Issues with our CI setup, packaging, or process
Projects
None yet
Milestone
No milestone
1 participant
@agateau-gg