thebadking/obscura
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #657 from h4ckf0r0day/ci/fix-pr-check-scope

Browse Source 
ci: run checks only for pull requests
This commit is contained in:
SGavrl
2026-08-14 10:54:45 +00:00
committed by GitHub
parent 9ac65da7d4 0caa646f04
commit 36b6de79ab
1 changed files with 6 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
.github/workflows/ci.yml vendored
View File

@@ -2,9 +2,6 @@ name: PR checks
on: on:
pull_request: pull_request:
merge_group:
push:
branches: [main]
# Pull requests execute contributor-controlled build scripts, proc macros, # Pull requests execute contributor-controlled build scripts, proc macros,
# tests, and binaries. They must never receive a write token or repository # tests, and binaries. They must never receive a write token or repository
@@ -42,7 +39,7 @@ jobs:
id: base id: base
shell: bash shell: bash
env: env:
EVENT_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }} EVENT_BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: | run: |
set -euo pipefail set -euo pipefail
base_sha="$EVENT_BASE_SHA" base_sha="$EVENT_BASE_SHA"
@@ -54,13 +51,8 @@ jobs:
policy_root="$RUNNER_TEMP/obscura-policy" policy_root="$RUNNER_TEMP/obscura-policy"
mkdir -p "$policy_root" mkdir -p "$policy_root"
if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
install -m 0644 scripts/ci/pr_policy.py "$policy_root/pr_policy.py"
install -m 0644 deny.toml "$policy_root/deny.toml"
else
git show "$base_sha:scripts/ci/pr_policy.py" > "$policy_root/pr_policy.py" git show "$base_sha:scripts/ci/pr_policy.py" > "$policy_root/pr_policy.py"
git show "$base_sha:deny.toml" > "$policy_root/deny.toml" git show "$base_sha:deny.toml" > "$policy_root/deny.toml"
fi
# Container actions can only read paths mounted below the workspace. # Container actions can only read paths mounted below the workspace.
# Replace any PR-supplied file before exposing the trusted config. # Replace any PR-supplied file before exposing the trusted config.
@@ -148,8 +140,8 @@ jobs:
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
with: with:
# PR caches are restored but never saved. A contributor therefore # PR caches are restored but never saved. A contributor therefore
# cannot poison a cache later consumed by main or a release. # cannot poison a cache later consumed by a release.
save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} save-if: false
- name: Build render release - name: Build render release
run: cargo build --release -p obscura-cli --bins --features render run: cargo build --release -p obscura-cli --bins --features render
@@ -158,7 +150,6 @@ jobs:
run: cargo nextest run --release --features render --no-fail-fast run: cargo nextest run --release --features render --no-fail-fast
- name: Stage candidate binary for comparison - name: Stage candidate binary for comparison
if: github.event_name != 'push'
run: install -D -m 0755 target/release/obscura "$RUNNER_TEMP/obscura-ci/obscura-pr" run: install -D -m 0755 target/release/obscura "$RUNNER_TEMP/obscura-ci/obscura-pr"
- name: Build render and stealth release - name: Build render and stealth release
@@ -195,7 +186,6 @@ jobs:
run: cargo build --release -p obscura-cli --bins --no-default-features --features stealth run: cargo build --release -p obscura-cli --bins --no-default-features --features stealth
- name: Upload candidate binary - name: Upload candidate binary
if: github.event_name != 'push'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with: with:
name: obscura-pr-${{ github.run_id }}-${{ github.run_attempt }} name: obscura-pr-${{ github.run_id }}-${{ github.run_attempt }}
@@ -205,7 +195,7 @@ jobs:
performance: performance:
name: PR / Performance name: PR / Performance
if: github.event_name != 'push' && needs.policy.outputs.runtime == 'true' if: needs.policy.outputs.runtime == 'true'
needs: [policy, core] needs: [policy, core]
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
timeout-minutes: 75 timeout-minutes: 75