Skip to content

Conversation

@jimklimov
Copy link
Member

@jimklimov jimklimov commented Nov 6, 2025

Closes: #1400

Likely helps move #1209 and #2829 forward eventually.

Probably should be merged to master so the workflow actually runs on GHA (due to safer pull_request_target usage, allegedly needed for edits of PR comments; with pull_request the code did run here for iterations when the YAML was not broken :) ).

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…st-docs` [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
@jimklimov jimklimov added this to the 2.8.5 milestone Nov 6, 2025
@jimklimov jimklimov added documentation CI Entries related to continuous integration infrastructure (here CI = tools + scripts + recipes) portability We want NUT to build and run everywhere possible labels Nov 6, 2025
@jimklimov jimklimov force-pushed the FTY-obs branch 5 times, most recently from c487b31 to c95ca3f Compare November 6, 2025 13:19
…order on GHA farm [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…maintain `dist` tarballs of recent iterations [networkupstools#1400, networkupstools#2829]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…-files`) in the CI job [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…comments [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… build page [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… fails [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… build page - v2 (message/comment in PRs) [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
@AppVeyorBot
Copy link

…e work [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…mmits (prNNNN/merge) alike [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…igits for sub-releases) [networkupstools#1209]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…ibgd-devel (cgi) are not ubiquitous [networkupstools#1209]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
@jimklimov jimklimov force-pushed the FTY-obs branch 4 times, most recently from b284187 to bf3fd2a Compare November 7, 2025 13:53
@jimklimov jimklimov changed the title CI: Generate downloadable tarballs as part of NUT CI farm builds CI: Generate downloadable tarballs as part of NUT CI farm builds; make default OBS recipes buildable Nov 7, 2025
…t distro versions [networkupstools#1209]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…orkupstools#1209]

Do not constrain the versions so it can build on Debian 9 and 10;
Note that for USB support we would need our fork anyway (until it
gets merged to upstream, which may take years at their pace).

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…orkupstools#1209]"

This reverts commit 2b1a596.
Dropped NUT CI OBS support for platforms it still refuses to build instead.

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…etworkupstools#1209]"

This reverts commit 313e13e.
Dropped NUT CI OBS support for platforms it still refuses to build instead.

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…nt [networkupstools#1209]"

This reverts commit 21e5d7a.
Dropped NUT CI OBS support for platforms it still refuses to build instead.

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…ct [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…e artifact [networkupstools#1400]"

This reverts commit 621e0e7.

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
@AppVeyorBot
Copy link

@AppVeyorBot
Copy link

… use context of the main repo for actions [networkupstools#1400]

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…ry title [networkupstools#1400]

We have hit some snags about changing the artifact history or
adding PR comments, at least before initially merging the first
PR that adds this workflow (so `pull_request_target` has something
to run from the master branch at all). Even if this turns out to
be the end of the road, at least this way we can let people know
where to find those generated tarballs :)

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
@jimklimov jimklimov merged commit 65c67d6 into networkupstools:master Nov 7, 2025
21 of 22 checks passed
@jimklimov jimklimov deleted the FTY-obs branch November 7, 2025 17:11
@jimklimov jimklimov restored the FTY-obs branch November 7, 2025 17:11
@jimklimov
Copy link
Member Author

After some battle with the machine, I found out in GHA debug logs that despite permissions peppered around the YAML, I get:


GITHUB_TOKEN Permissions
  Actions: read
  Contents: read
  Issues: read
  Metadata: read
  PullRequests: read
  RepositoryProjects: read
  SecurityEvents: read

because per https://stackoverflow.com/a/78444521/4715872

as it turned out from comments, when PRs come from a public fork, GITHUB_TOKEN defaults to read-only permissions; the workaround here is to use pull_request_target instead of pull_request. This can make you vulnerable to security issues, as you potentially merge unreviewed third-party code.

This makes sense, and my experiments to use a dedicated MAKE_DIST_TOKEN in the context of PRs from forks also failed, so the latest commits convert the workflow to use pull_request_target again (presumably this makes PRs use the workflow definition from the target branch, which was absent until this merge), and will see in later PRs how this goes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI Entries related to continuous integration infrastructure (here CI = tools + scripts + recipes) documentation packaging portability We want NUT to build and run everywhere possible

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI: Generate downloadable tarballs as part of NUT CI farm builds

2 participants