Repository navigation
Conversation
The main.jsonnet compile entry used a hard-coded output_path
(solution-backup/), so compiling multiple instances of this component
into one catalog would make every instance render into the same
directory, overwriting each other's manifests.
Use ${_instance} as output_path, like the newer component templates do,
and move the golden test dirs accordingly (instance name == test name).
Also update the espejote render test's manifest path.
Mirrors appuio/component-solution-base-monitoring#13.
BacLuc
added
bug
vshntea
left a comment
vshntea
left a comment
There was a problem hiding this comment.
LGTM, did you check why the release job fails?
The Autorelease workflow failed on projectsyn#6 (run 41829920010) with: HttpError: Resource not accessible by integration POST /repos/projectsyn/issues/6/comments -> 403 Root cause: the job runs on `pull_request`. That PR was opened from the bacluc-agent fork, and GitHub always hands such runs a read-only GITHUB_TOKEN with no secrets ("GITHUB_TOKEN Permissions ... Issues: read" and "Secret source: None" in the run log). The permissions key cannot lift that restriction for fork runs, so every API write done by projectsyn/pr-label-tag-action fails: the PR comment (issues), the release tag (contents) and the "Release" workflow dispatch (actions). PRs on branches inside the repository (for example the Renovate ones, or component-solution-backup#1 which released v0.1.0) are unaffected, which is why the same workflow file works in the other component repositories. Switch the trigger to `pull_request_target`, which runs the base branch's workflow with a write token even for public forks, and declare the three permissions the action needs so the job no longer depends on the repository's default workflow permissions. The job only reads the PR metadata from the event payload and never checks out or executes code from the PR, which is what makes pull_request_target safe here. Consequence: runs for PRs from contributors without write access now need a maintainer to approve them, as they carry a write token.
The Autorelease workflow failed on projectsyn#6 (run 41829920010) with: HttpError: Resource not accessible by integration POST /repos/projectsyn/issues/6/comments -> 403 Root cause: the job runs on `pull_request`. That PR was opened from the bacluc-agent fork, and GitHub always hands such runs a read-only GITHUB_TOKEN with no secrets ("GITHUB_TOKEN Permissions ... Issues: read" and "Secret source: None" in the run log). The permissions key cannot lift that restriction for fork runs, so every API write done by projectsyn/pr-label-tag-action fails: the PR comment (issues), the release tag (contents) and the "Release" workflow dispatch (actions). PRs on branches inside the repository (for example the Renovate ones, or component-solution-backup#1 which released v0.1.0) are unaffected, which is why the same workflow file works in the other component repositories. Switch the trigger to `pull_request_target`, which runs the base branch's workflow with a write token even for public forks, and declare the three permissions the action needs so the job no longer depends on the repository's default workflow permissions. The job only reads the PR metadata from the event payload and never checks out or executes code from the PR, which is what makes pull_request_target safe here. Consequence: runs for PRs from contributors without write access now need a maintainer to approve them, as they carry a write token.
|
The Autorelease failure here is not caused by the contents of this PR — it is the workflow's token. Why it fails: Fix, ready to review: branch Two consequences once it is merged into
|
|
Will use branch from own repo |
The main.jsonnet compile entry used a hard-coded output_path (solution-backup/), so compiling multiple instances of this component into one catalog would make every instance render into the same directory, overwriting each other's manifests.
Use ${_instance} as output_path, like the newer component templates do, and move the golden test dirs accordingly (instance name == test name). Also update the espejote render test's manifest path.
Mirrors appuio/component-solution-base-monitoring#13.
Checklist
changelog.
The PR has a meaningful description that sums up the change. It will be
linked in the changelog.
bug,enhancement,documentation,change,breaking,dependencyas they show up in the changelog.