movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-10 03:23:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

workflows/eval: run trusted code in process step

Browse source 
We don't really need to run the combine and comparison steps from the
untrusted merge commit. By switching to the trusted target commit, we
can avoid adding another worktree - and lay the foundation to later do
those steps in the tag job, which has access to secrets.
This commit is contained in:
Wolfgang Walther 2025-05-25 17:34:38 +02:00
parent b2579d36ff
commit 13f5aa304e
No known key found for this signature in database
GPG key ID: B39893FA5F65CAE1
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
.github/workflows/eval.yml vendored
View file

@ -98,11 +98,11 @@ jobs:
path: merged path: merged
merge-multiple: true merge-multiple: true
- name: Check out the PR at the test merge commit - name: Check out the PR at the target commit
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with: with:
ref: ${{ needs.prepare.outputs.mergedSha }} ref: ${{ needs.prepare.outputs.targetSha }}
path: untrusted path: trusted
- name: Install Nix - name: Install Nix
uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31 uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
@ -111,7 +111,7 @@ jobs:
- name: Combine all output paths and eval stats - name: Combine all output paths and eval stats
run: | run: |
nix-build untrusted/ci -A eval.combine \ nix-build trusted/ci -A eval.combine \
--arg evalDir ./merged \ --arg evalDir ./merged \
--out-link combined --out-link combined
@ -168,9 +168,8 @@ jobs:
env: env:
AUTHOR_ID: ${{ github.event.pull_request.user.id }} AUTHOR_ID: ${{ github.event.pull_request.user.id }}
run: | run: |
git -C untrusted fetch --depth 1 origin ${{ needs.prepare.outputs.targetSha }} git -C trusted fetch --depth 1 origin ${{ needs.prepare.outputs.mergedSha }}
git -C untrusted worktree add ../trusted ${{ needs.prepare.outputs.targetSha }} git -C trusted diff --name-only ${{ needs.prepare.outputs.mergedSha }} \
git -C untrusted diff --name-only ${{ needs.prepare.outputs.targetSha }} \
| jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
# Use the target branch to get accurate maintainer info # Use the target branch to get accurate maintainer info