fix(ci): call the estate reusables by their real ref — root and nested copies - #864
Merged
Merged
Conversation
…d copies `uses: ../….github/workflows/<x>-reusable.yml` is not a ref form GitHub Actions supports, so every workflow carrying it fails at parse time: conclusion=failure, 0 jobs, and a run name equal to its path rather than its declared `name:`. This repairs them throughout the tree, not only in the root `.github/workflows/`, because the root is where they are *live* but the nested copies are where they *propagate* — standards' format templates, k9-ecosystem's dispatch templates and deed-core's action scaffolds are what new repos are minted from, and each one carried an unparseable ref. Each ref becomes the pinned cross-repo form `hyperpolymath/standards/.github/workflows/<x>-reusable.yml@4e6ffe5…`, and each calling job is granted the permissions its callee declares — keyed off the callee named in the ref, since several callers point at the same reusable. Without that step the repair only moves the failure from parse time to run time. Refs #808.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (76)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (19)
🔇 Additional comments (76)
📝 SummarySummary by CodeRabbit
WalkthroughThe PR updates repository workflow wrappers to use pinned reusable workflows from ChangesWorkflow centralisation
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
uses: ../….github/workflows/<x>-reusable.ymlis not a ref form GitHub Actions supports — areusable-workflow
uses:may be./.github/…(same repo) or<owner>/<repo>/….yml@<ref>(crossrepo). A
../path is rejected at parse time, so every workflow carrying one is dead:conclusion=failure, 0 jobs, and a run name equal to its path rather than its declaredname:.Two changes per calling file:
hyperpolymath/standards/.github/workflows/<x>-reusable.yml@4e6ffe55…;hold more than its caller grants, so repairing only the ref would move the failure from parse time
to run time. Permissions are keyed off the callee named in the ref, not the caller's filename:
several callers point at the same reusable (
scorecard-enforcer.ymlalso callsscorecard-reusable.yml).This repairs the whole tree, not only the root
.github/workflows/. The root is where the refsare live; the nested copies are where they propagate — format templates, dispatch templates and
action scaffolds are what new repos are minted from, and each copy carried an unparseable ref, so
every repo created from one inherited a broken workflow.
Found by a whole-tree sweep of all 390 names in the account (blobless clones +
git grep, gitprotocol rather than the REST API). Across the estate, 6 repos carried such refs:
standards(76files),
k9-ecosystem(46),deed-core(42),repo-guardian(14),lol(7),deed-validate-action(7) — 192 files in total, all repaired in this campaign.Refs #808.