Fix fork-PR CI: Runic checkout and ALCF pipeline attribution - #620
Merged
Conversation
actions/checkout@v7 refuses to check out fork code from a pull_request_target workflow unless explicitly opted in, so the runic job failed before running anything. Opt in: the PR code is only parsed by Runic, never executed. Also pin the checkout to the event's head SHA instead of the branch name, and stop persisting credentials in the checkout.
The label-gated fork-PR push authenticates with a project access token,
so the resulting push pipeline is attributed to the project's bot user,
and ALCF's Jacamar runners refuse those ('bot account token used for
job, unsupported by runner'), failing the pipeline before any job runs.
Push with ci.skip so no bot-attributed pipeline is created, and create
the pipeline through a pipeline trigger token instead: trigger-token
pipelines run as the user who created the token, which Jacamar accepts.
Requires a new ALCF_GITLAB_TRIGGER_TOKEN repository secret, and
.gitlab-ci.yml now accepts the 'trigger' pipeline source.
Member
Author
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #620 +/- ##
==========================================
+ Coverage 79.01% 80.47% +1.46%
==========================================
Files 50 50
Lines 3488 3488
==========================================
+ Hits 2756 2807 +51
+ Misses 732 681 -51 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
actions/checkout@v7refuses fork checkouts inpull_request_targetworkflows without an explicit opt-in. Opt in (the PR code is only parsed, never executed), pin the head SHA, drop persisted credentials.ci.skipand create the pipeline via a pipeline trigger token (ALCF_GITLAB_TRIGGER_TOKENsecret, already set) so it runs as a real user.