pull_request_target is considered insecure as it is easy to misuse. We
do not checkout code from a PR here and we need it for the secret access
so we kinda of to use it if we want the automatic machine-os PRs.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The github app we use for locking already only has rights for this so
this is not really gaining us anything. However zizmore points this out
in case the app would have more permissions to only keep it to a
minimum. It also protects us in case someone gives the app more
permissions in the future as the workflow does not need more.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a workflow running actionlint on GHA workflows, which helps a lot
when debugging broken workflows, and also runs shellcheck on all
embedded shell scripts. A separate workflow so it still runs when
another yaml is broken.
The config file is needed solely to let actionlint know about our custom
runners (otherwise it complains).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The variable is $VERSION not $version, so the check never worked
(IOW needsUpdate=true was always set).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The big-tests matrix has no timeout key -- remove it.
This fixes actionlint warnings about
- the undefined property;
- the assignment of a string to a numeric input.
No change in behavior.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Fix the rest of shellcheck warnings in GHA workflows:
- $(...) instead of backticks;
- "read -a" instead of word-splitting;
- bash arrays instead of space-separated options;
- "grep -q" instead of testing grep output for being empty;
- single redirect for a group of echo commands;
- etc.
Suppress the linter where it does not make sense (single-quoted
backticks in printf are markdown).
Found by actionlint (which runs shellcheck on run: scripts).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Quote variable expansions in run: scripts, as recommended by
shellcheck (SC2086). No change in behavior is expected.
Found by actionlint (which runs shellcheck on run: scripts).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
When I de-duplicated the CONTRIBUTING.md file in commit
c4e80b8c2b ("link org wide CONTRIBUTING.md") we lost the DCO/Sign-off
section there since it is now listed once in the community repo so link
there now.
Also fix the same link in the AGENTS.md file.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Users have reported some issues with Podman built with the stable ver
of go (this is the version used in the release workflow): #29891.
The problem hasn't been reproduced in PR checks because because it uses
a different version of Go (from `go.mod`).
This commit updates `ci.yaml` to be consistent with
`release-build-artifacts.yml`.
It also set the version of Go to v1.26 to fix#29891.
Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>
The oracle runners sometimes fail with:
chown: cannot access '/dev/kvm': No such file or directory
Log the kernel logs to see if they say anything of value then to know
why this failed.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Farm tests were skipped during the Cirrus-to-GHA migration. Re-enable
them by adding a run_farm() function in runner.sh which starts the
rootless podman socket that the farm node connection talks to, and by
adding farm to the small-tests matrix so that it runs rootless on
fedora-current. A path filter makes it trigger on test/farm/ or shared
system test helper changes.
Also stop test/farm/setup_suite.bash from assuming that the rootless
user's home directory is /home/$ROOTLESS_USER, which does not hold on
the CI VMs.
Fixes: #28833
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Link the full CONTRIBUTING.md as part of the checklist and mention the
new two PR rule. Reorder the LLM policy step to the top as it is rather
important to us. And lastly update the links to the new github org.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Adapt the logformatter script to run again to produce nicely formatted
html logs. Because github cannot upload and show raw html files we can
only add it to the log archive which must be downloaded and viewed
locally.
To improve the online experience however github does have the
GITHUB_STEP_SUMMARY logic which allows us to produce markdown which will
be shown on the summary page for a given test run.
The problem is even though github markdown supports some html is does
not support CSS and out custom style of the logformatter, in addition
the output size is limited so I wrote another script parsing the html
output again and turning it into plain test for only the failed tests
and then show this as plain text inside codeblocks in the markdown.
With this we have a short failure summary which should display all
failures at once in the run page so maintainers can see if the failed
log was just some flake or an actual problem with the PR.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The two workflows that called these scripts are both gone. The rerun one
went in 130bb2161 and check_cirrus_cron.yml went in 3743b9f8, the same
commit that deleted .cirrus.yml. The scripts themselves were left behind.
Nothing references them any more, and there is no action.yml here so they
were never usable as a composite action from another repo either. They
talk to the Cirrus GraphQL API with SECRET_CIRRUS_API_KEY, which we no
longer have anything running against.
Signed-off-by: Tushar Verma <tusharmyself06@gmail.com>
renovate[bot]