[jwrosewell]

Closes #18.

Problem

The root workflows pass three secrets that do not exist, DEVICE_DETECTION_URL, CSV_URL and TEST_PYPI_TOKEN. On 13 November the repository had one secret, DEVICE_DETECTION_KEY, and none of the 53 organisation secrets it can use has any of those names, so GitHub passed each one as an empty string. ci/fetch-assets.ps1 and device-detection/ci/fetch-assets.ps1 took the two URLs, and the product CI readmes listed DEVICE_DETECTION_URL and TEST_PYPI_TOKEN. A reader could not tell which secrets the CI really needs.

The products also kept the workflow folders of the repositories they came from, pipeline/.github/workflows, device-detection/.github/workflows, ip-intelligence/.github/workflows and location/.github/workflows. GitHub's workflows page says "Workflows are defined in the .github/workflows directory in a repository" and "GitHub searches the .github/workflows directory in the root of your repository", so none of the 24 files in those folders ever ran, and each repeated the dead secrets.

What was checked

• common-ci declares CsvUrl, DeviceDetectionUrl and TestPypiToken among the secrets of nightly-pull-request.yml (lines 66, 68 and 86), nightly-publish.yml (79, 81 and 98) and release-pull-request.yml (58, 60 and 78), each with no required, so a caller may leave them out.
• Both routes into ci/fetch-assets.ps1 pass only the keys it declares, being steps/run-script.ps1 lines 17 and 18 and the prefetch action, .github/actions/prefetch_assets/action.yml lines 56 to 59. So neither passes a key the script no longer takes.
• steps/download-data-file.ps1 line 15 uses the distributor address with the licence key when Url is empty, and a [string] parameter that is not passed is an empty string, so the data files come from the same address as before.
• These are secret names and script parameters, not environment variables that a package, test, example or CI script of this repository reads. common-ci's list of environment variable names, at common-ci#320's head line 84, gives DEVICE_DETECTION_URL only as the Rust examples workflow's own variable, and has neither of the other two.
• Every workflow in the product folders has a root copy except two. device-detection/.github/workflows/example-assets-update.yml refreshes the web examples' shared stylesheet and script from the latest examples assets release. .NET, Java, Node.js, PHP and Rust each run it from their root (Java, Node.js, PHP and Rust at 03:00 on Mondays, .NET at 03:30), and steps/update-example-assets.ps1 lines 37 to 40 refreshes every tracked copy by name, which finds this repository's six examples-main.min.css copies from the root. pipeline/.github/workflows/examples.yml ran the cloud request engine examples' tests on demand on one Linux runner with Python 3.11, and pipeline/ci/run-integration-tests.ps1 line 33 already lists fiftyone_pipeline_cloudrequestengine/examples, so the pull request and nightly builds run those tests on every configuration. cloud-51did.yml is already at the root.

What changed

• nightly-pipeline.yml, publish.yml, pull-requests.yml and release-pull-request.yml no longer pass the three secrets.
• ci/fetch-assets.ps1 and device-detection/ci/fetch-assets.ps1 no longer take DeviceDetectionUrl or CsvUrl, and the Device Detection script no longer hands them to common-ci's steps/fetch-assets.ps1.
• device-detection/ci/README.md and ip-intelligence/ci/README.md no longer list DEVICE_DETECTION_URL or TEST_PYPI_TOKEN.
• .github/workflows/example-assets-update.yml is the Device Detection copy moved to the root, starting on Mondays at 03:45 UTC, apart from the other repositories' asset updates.
• The four product .github folders are removed, examples.yml with them.

No package code changes. The release plan counts the five files removed from location/.github/workflows as changes to fiftyone_location (the dry run below reports it "changed since 4.5.10 (5 files)"), but fiftyone_location depends on fiftyone_pipeline_core, fiftyone_pipeline_engines and fiftyone_pipeline_cloudrequestengine (ci/packages.json lines 120 to 130), which Monday releases anyway, so this draft adds no package to the release.

Checks

This draft changes only workflows, CI scripts and their readmes. James Rosewell decided at about 11:35 UTC on 12 November, for such a change, "rebuild and include, but the change doesn't impact the code so no need to run the full builds", so it has no full build of its own.

• Quick checks passed on this head, being run 43527381709 (environment variable names), run 43527382095 (only rc into main) and run 43527381761 (UTM link lint).
• Publish dry run, run 43528475739, dispatched from this draft's publish.yml on tmp/pyowner-sim4 at 72c3f126, which is rc at f084e85 with this head and the open drafts Let one thread at a time read a native results instance #80, Say in the Element Data documentation what is safe with threads #84, Make the already-updating guard real and keep one pending check per data file #87, Run the tests of the CI scripts on pull requests that change them #117, Hand the web request to the pipeline in the IP Intelligence web examples #119 and Share a key found in the request and the Evidence once, whatever its letters #120 merged in, with dryrun true, allow-early-release true and common-ci-ref def6ce6c, common-ci's rc. Every one of its 35 jobs passed but the skipped Report Compare Performance, being Configure, 15 Pre Build, Build, 15 Test jobs (five of each on macOS), ComparePerformance and Package. Configure ran device-detection/ci/fetch-assets.ps1 "with parameters: DeviceDetection", and the Build and Test jobs found every data file they need, so the secrets this draft removes were not missed.

What remains

Nothing in this draft. The last release into main was #114, merged at 06:22 UTC on 13 November.