ci(github-actions): split replay tests into workflow_run to fix secrets access on external PRs#173
Merged
Conversation
99ab94d to
1420a1e
Compare
…ts access on external PRs External PRs (from forks) do not have access to repository secrets like ASSETS_KEY for security reasons. This causes replay tests to fail when attempting to extract game assets. We've split the CI pipeline so that ci.yml handles the build, and ci-replays.yml (triggered via workflow_run) handles the replay tests with secure access to secrets.
1420a1e to
78ddbb1
Compare
7e977b3 to
3af504c
Compare
…or internal PRs and workflow_run for external PRs
# Conflicts: # .github/workflows/ci-replays.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes the issue where external pull requests fail on the replay tests step due to missing
ASSETS_KEYsecret.Changes
ci.ymlci-replays.ymlwhich triggers onworkflow_runafterci.ymlcompletes. This runs in the base repository context and has access to secrets.replay-tests.ymlto accept an optionalrun-idto download artifacts from the triggering build instead of its own run.