From ae9a5e6fdff78cb8b9ab04c688d386eb716e4497 Mon Sep 17 00:00:00 2001 From: asklymenko Date: Mon, 27 Jul 2026 17:21:50 +0300 Subject: T9107: Fix integration workflow after recent GitHub security updates [vyos-1x] --- .github/workflows/package-smoketest-comment.yml | 48 ++++++++++++++++++++++++ .github/workflows/package-smoketest.yml | 49 ++++++++++++++----------- 2 files changed, 75 insertions(+), 22 deletions(-) create mode 100644 .github/workflows/package-smoketest-comment.yml diff --git a/.github/workflows/package-smoketest-comment.yml b/.github/workflows/package-smoketest-comment.yml new file mode 100644 index 000000000..80fa52566 --- /dev/null +++ b/.github/workflows/package-smoketest-comment.yml @@ -0,0 +1,48 @@ +name: VyOS ISO Integration Test - PR Comment + +# This workflow is the trusted counterpart to package-smoketest.yml. It runs +# with `pull-requests: write` and the base repository's GITHUB_TOKEN, so it +# must NEVER check out or execute any code from the pull request / fork. It +# only downloads the plain-text result artifact produced by the (untrusted, +# `pull_request`-triggered) package-smoketest.yml run and posts it as a PR +# comment. See https://gh.io/securely-using-pull_request_target for why this +# split exists. + +on: + workflow_run: + workflows: ["VyOS ISO Integration Test"] + types: + - completed + +permissions: + contents: read + pull-requests: write + actions: read + +jobs: + comment: + if: github.event.workflow_run.event == 'pull_request' + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Download PR report artifact + uses: actions/download-artifact@v8 + with: + name: pr-report + path: pr-report + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Read PR number + id: pr + run: | + echo "number=$(cat pr-report/pr_number.txt)" >> "$GITHUB_OUTPUT" + + - name: Add PR comment + uses: mshick/add-pr-comment@v2 + with: + issue: ${{ steps.pr.outputs.number }} + message-path: pr-report/message.md + message-id: "SMOKETEST_RESULTS" + allow-repeats: false + refresh-message-position: true diff --git a/.github/workflows/package-smoketest.yml b/.github/workflows/package-smoketest.yml index 66b62223e..43731ac6a 100644 --- a/.github/workflows/package-smoketest.yml +++ b/.github/workflows/package-smoketest.yml @@ -11,7 +11,7 @@ on: - '**' - '!.github/**' - '!**/*.md' - pull_request_target: + pull_request: branches: - rolling - circinus @@ -22,7 +22,6 @@ on: - '!**/*.md' permissions: - pull-requests: write contents: read env: @@ -56,7 +55,7 @@ jobs: - name: Set branch-specific configuration id: config run: | - if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then + if [[ "${{ github.event_name }}" == "pull_request" ]]; then BRANCH="${{ github.event.pull_request.base.ref }}" else BRANCH="${{ github.ref_name }}" @@ -91,7 +90,7 @@ jobs: BRANCH="${{ steps.config.outputs.branch }}" VYOS_BUILD_REPO="${{ steps.config.outputs.vyos_build_repo }}" - if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then + if [[ "${{ github.event_name }}" == "pull_request" ]]; then PR_HEAD_REF="${{ github.event.pull_request.head.ref }}" # VYOS_BUILD_REPO is in owner/repo format from config @@ -446,25 +445,31 @@ jobs: timeout-minutes: 5 if: always() steps: - - name: Add PR comment - if: always() && github.event_name == 'pull_request_target' - uses: mshick/add-pr-comment@v2 - with: - message: | - CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.outputs.exit_code != 'fail') && (needs.test_config_load_vpp.outputs.exit_code != 'fail') && (needs.test_encrypted_config_tpm.outputs.exit_code != 'fail')) && '👍 passed!' || '❌ failed!' }} + - name: Prepare PR report + if: always() && github.event_name == 'pull_request' + run: | + mkdir -p pr-report + echo "${{ github.event.pull_request.number }}" > pr-report/pr_number.txt + + cat > pr-report/message.md << 'EOF' + CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.outputs.exit_code != 'fail') && (needs.test_config_load_vpp.outputs.exit_code != 'fail') && (needs.test_encrypted_config_tpm.outputs.exit_code != 'fail')) && '👍 passed!' || '❌ failed!' }} - ### Details + ### Details - [CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) + [CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) - * CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} - * CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} - * Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} - * RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} - * CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }} - * Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_config_load_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }} - * TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }} + * CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} + * CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} + * Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} + * RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }} + * CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }} + * Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_config_load_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }} + * TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }} + EOF - message-id: "SMOKETEST_RESULTS" - allow-repeats: false - refresh-message-position: true + - uses: actions/upload-artifact@v7 + if: always() && github.event_name == 'pull_request' + with: + name: pr-report + path: pr-report + retention-days: 2 -- cgit v1.2.3