[WIP] chore(ci): add script to mirror community PRs for safe CI execution#2032
[WIP] chore(ci): add script to mirror community PRs for safe CI execution#2032bantonsson wants to merge 1 commit into
Conversation
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e6b9e0f103
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ "$PARENT_COUNT" -gt 2 ]; then | ||
| CHERRY_PICK_ARGS+=("-m" "1") | ||
| fi | ||
| if ! git cherry-pick "${CHERRY_PICK_ARGS[@]}" "$COMMIT"; then |
There was a problem hiding this comment.
When an external PR changes GitHub workflows, local actions, or scripts invoked by CI, this full cherry-pick puts those untrusted files onto a same-repository branch before opening the mirror PR. That defeats the stated safety property: this repo has pull_request workflows that check out the PR head and use secrets (for example .github/workflows/test.yml lines 3, 27, and 265), so a fork author could include a workflow/CI-script change that runs with the maintainer permissions/secrets the mirror is meant to enable. The mirror needs to reset/filter CI-sensitive paths back to the trusted base or run trusted workflows against the diff instead of cherry-picking them verbatim.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
That part needs to be verified by a human.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2032 +/- ##
==========================================
- Coverage 72.84% 72.79% -0.05%
==========================================
Files 458 458
Lines 75789 75789
==========================================
- Hits 55210 55173 -37
- Misses 20579 20616 +37
🚀 New features to boost your workflow:
|
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
3 participants
What does this PR do?
A brief description of the change being made with this pull request.
Motivation
What inspired you to submit this pull request?
Additional Notes
Anything else we should know when reviewing?
How to test the change?
Describe here in detail how the change can be validated.