chore(IDX): use github.ref_protected where applicable #3936
Conversation
This means we don't have to keep track of the protected branches and means we can use unified logic for protected ref detection.
| protected_branches=("master" "rc--*" "hotfix-*" "master-private") | ||
|
|
||
| # if we are on a protected branch or targeting a rc branch we set ic_version to the commit_sha and upload to s3 | ||
| for pattern in "${protected_branches[@]}"; do | ||
| if [[ "$BRANCH_NAME" == $pattern ]]; then | ||
| IS_PROTECTED_BRANCH="true" | ||
| break | ||
| fi | ||
| done | ||
|
|
There was a problem hiding this comment.
Unfortunately and confusingly setting IS_PROTECTED_BRANCH=${{ github.ref_protected }} as an alternative to the above is not enough.
In ic-private the hotifx-* branch is not protected. This means that if folks follow the "How to handle fixes for IC security vulnerabilities?" procedure, which specifies to push the hotfix to a hotfix-* branch and then expects the artifacts to be uploaded (s3_upload="True"), their artifacts won't be uploaded.
There was a problem hiding this comment.
@basvandijk arguably this is an issue in ic-private where protected_branches is then not aptly named, and/or an issue with the hotfix procedure. I'll see what I can do about that.
There was a problem hiding this comment.
Note that we shouldn't protect hotfix-* in ic-private since that would prevent folks from creating hotfixes.
So I think it's indeed a naming issue. Maybe we should use a different wordt than "PROTECTED" above.
There was a problem hiding this comment.
Maybe:
protected_branches->release_branchesIS_PROTECTED_BRANCH->IS_RELEASE_BRANCH
| @@ -73,3 +73,4 @@ runs: | |||
| MERGE_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |||
| SSH_PRIVATE_KEY_BACKUP_POD: ${{ inputs.SSH_PRIVATE_KEY_BACKUP_POD }} | |||
| GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} | |||
| IS_PROTECTED_BRANCH: ${{ github.ref_protected }} | |||
This means we don't have to keep track of the protected branches and means we can use unified logic for protected ref detection.