Repository navigation
fix(ci): do not publish the beta from a fork PR - #127
Merged
Merged
Conversation
workflow_run's branches filter matches the triggering run's head branch name. CI also runs on pull_request, so a fork PR from a branch named main used to check out that SHA with contents: write and packages: write. Jobs now run only after a successful push to main in this repository. Write scopes sit on the jobs that create the release and push the images. Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Release Beta runs when CI completes. CI also runs on
pull_request, including from a fork.branches: [main]compares the triggering run's head branch name, so a fork PR opened from a branch namedmainmatches. The workflow then checks outgithub.event.workflow_run.head_sha— the fork's commit — and the token at the top of the file wascontents: writeandpackages: write. That is enough to delete prereleases, create a GitHub release, and pushghcr.io/avelino/mcp.Each job now runs only when all of these hold:
github.event.workflow_run.conclusion == 'success'github.event.workflow_run.event == 'push'github.event.workflow_run.head_repository.full_name == github.repositorygithub.event.workflow_run.head_branch == 'main'publishanddockeralso requireneeds.build.result == 'success'. A job-levelifreplaces the implicit success check, and a skipped build must not go on to delete releases.The workflow token is
contents: read.contents: writeis only onpublish(delete and create the prerelease, including the tag).packages: writeis only ondocker. Checkouts setpersist-credentials: false, so the token is not left in.git/confignext tocargo build. The head SHA is passed in the environment instead of being expanded insiderun:.Every action stays pinned to the same commit.
dtolnay/rust-toolchainpublishes a movingv1tag, which no longer points at the commit the workflows pin, so that comment no longer claims the tag.workflow_runstays. zizmor flags that trigger on its own; the ignore on that line is that finding, and the jobifis the control.Why a fork run is skipped
A fork PR whose branch is named
mainstill starts this workflow, because theon:filter cannot tell a push from a pull request. The job condition is then false: the triggering event ispull_request, andhead_repository.full_nameis the fork, not this repository.buildis skipped before checkout, so the fork SHA is never checked out.publishanddockerneedbuildand repeat the same check, so they are skipped too. No prerelease is deleted, no release is created, and nothing is pushed to GHCR.A pull request from this repository is skipped for the same reason: the event is not
push. The beta is published only after CI succeeds on a push tomainhere.How it was tested
actionlint 1.7.12 and zizmor 1.31.1:
The ignored finding is
dangerous-triggersonworkflow_run, which zizmor reports for the trigger itself. The twelve suppressed results are below the default persona.Not run here: the release. It runs after CI succeeds on a push to
main. The Windows build is unchanged; #122 covers that.