Skip to content

Commit 5515824

Browse files
lucasssvazlucasssvaz
committed
ci(tests): Avoid the use of pull_request_target where possible
1 parent cbf1e94 commit 5515824

File tree

7 files changed

+404
-265
lines changed

7 files changed

+404
-265
lines changed

‎.github/workflows/tests.yml‎

Lines changed: 62 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,17 @@ name: Runtime Tests
22

33
on:
44
workflow_dispatch:
5-
pull_request_target:
6-
types: [opened, reopened, closed, synchronize, labeled, unlabeled]
5+
pull_request:
6+
types: [opened, reopened, synchronize, labeled, unlabeled]
77
paths:
8+
- '.github/workflows/tests*'
9+
- '.github/scripts/*.sh'
10+
- '!.github/scripts/check-cmakelists.sh'
11+
- '!.github/scripts/find_*'
12+
- '!.github/scripts/on-*.sh'
13+
- '!.github/scripts/set_push_chunks.sh'
14+
- '!.github/scripts/update-version.sh'
15+
- '!.github/scripts/upload_py_tools.sh'
816
- 'tests/**'
917
- 'cores/**'
1018
- 'libraries/**'
@@ -19,14 +27,19 @@ concurrency:
1927
group: tests-${{ github.event.pull_request.number || github.ref }}
2028
cancel-in-progress: true
2129

22-
# To avoid giving elevated permissions to the entire workflow, specify default permissions at the top level
23-
# and then override them for specific jobs.
24-
permissions: { contents: read }
25-
2630
jobs:
31+
push-event-file:
32+
name: Push event file
33+
runs-on: ubuntu-latest
34+
steps:
35+
- name: Upload
36+
uses: actions/upload-artifact@v4
37+
with:
38+
name: event_file
39+
path: ${{ github.event_path }}
40+
2741
gen-matrix:
2842
name: Generate matrix
29-
if: github.event.action != 'closed'
3043
runs-on: ubuntu-latest
3144
outputs:
3245
build-types: ${{ steps.set-matrix.outputs.build-types }}
@@ -59,9 +72,8 @@ jobs:
5972
6073
call-build-tests:
6174
name: Build
62-
uses: espressif/arduino-esp32/.github/workflows/build_tests.yml@master
75+
uses: ./.github/workflows/tests_build.yml
6376
needs: gen-matrix
64-
if: github.event.action != 'closed'
6577
strategy:
6678
matrix:
6779
type: ${{ fromJson(needs.gen-matrix.outputs.build-types) }}
@@ -70,13 +82,15 @@ jobs:
7082
type: ${{ matrix.type }}
7183
chip: ${{ matrix.chip }}
7284

85+
# Wokwi tests are run after this workflow as it needs access to secrets
86+
7387
call-hardware-tests:
7488
name: Hardware
75-
uses: espressif/arduino-esp32/.github/workflows/hw.yml@master
89+
uses: ./.github/workflows/tests_hw.yml
7690
needs: [gen-matrix, call-build-tests]
7791
if: |
7892
github.repository == 'espressif/arduino-esp32' &&
79-
(github.event_name != 'pull_request_target' ||
93+
(github.event_name != 'pull_request' ||
8094
contains(github.event.pull_request.labels.*.name, 'hil_test'))
8195
strategy:
8296
fail-fast: false
@@ -87,26 +101,10 @@ jobs:
87101
type: ${{ matrix.type }}
88102
chip: ${{ matrix.chip }}
89103

90-
call-wokwi-tests:
91-
name: Wokwi
92-
uses: espressif/arduino-esp32/.github/workflows/wokwi.yml@master
93-
needs: [gen-matrix, call-build-tests]
94-
if: github.event.action != 'closed'
95-
strategy:
96-
fail-fast: false
97-
matrix:
98-
type: ${{ fromJson(needs.gen-matrix.outputs.wokwi-types) }}
99-
chip: ['esp32', 'esp32s2', 'esp32s3', 'esp32c3', 'esp32c6', 'esp32h2']
100-
secrets:
101-
WOKWI_CLI_TOKEN: ${{ secrets.WOKWI_CLI_TOKEN }}
102-
with:
103-
type: ${{ matrix.type }}
104-
chip: ${{ matrix.chip }}
105-
106104
# This job is disabled for now
107105
call-qemu-tests:
108106
name: QEMU
109-
uses: espressif/arduino-esp32/.github/workflows/qemu.yml@master
107+
uses: ./.github/workflows/tests_qemu.yml
110108
needs: [gen-matrix, call-build-tests]
111109
if: false
112110
strategy:
@@ -118,78 +116,39 @@ jobs:
118116
type: ${{ matrix.type }}
119117
chip: ${{ matrix.chip }}
120118

121-
unit-test-results:
122-
name: Unit Test Results
123-
needs: [call-hardware-tests, call-wokwi-tests, call-qemu-tests]
124-
if: always() && github.event_name == 'pull_request_target'
125-
runs-on: ubuntu-latest
126-
permissions:
127-
checks: write
128-
pull-requests: write
129-
steps:
130-
- name: Download and Extract HW Artifacts
131-
uses: actions/download-artifact@v4
132-
continue-on-error: true
133-
with:
134-
merge-multiple: true
135-
pattern: tests-results-hw-*
136-
path: ./results/hw
137-
138-
- name: Download and Extract Wokwi Artifacts
139-
uses: actions/download-artifact@v4
140-
continue-on-error: true
141-
with:
142-
merge-multiple: true
143-
pattern: tests-results-wokwi-*
144-
path: ./results/wokwi
145-
146-
- name: Download and Extract QEMU Artifacts
147-
uses: actions/download-artifact@v4
148-
continue-on-error: true
149-
with:
150-
merge-multiple: true
151-
pattern: tests-results-qemu-*
152-
path: ./results/qemu
153-
154-
- name: Publish Unit Test Results
155-
uses: EnricoMi/publish-unit-test-result-action@v2
156-
with:
157-
commit: ${{ github.event.pull_request.head.sha || github.sha }}
158-
files: ./results/**/*.xml
159-
clean:
160-
name: Clean objects
161-
needs: unit-test-results
162-
if: always()
163-
permissions:
164-
actions: write
165-
runs-on: ubuntu-latest
166-
steps:
167-
- name: Clean up caches
168-
uses: actions/github-script@v7
169-
with:
170-
script: |
171-
const ref = '${{ github.event.pull_request.number || github.ref }}';
172-
const key_prefix = 'tests-' + ref + '-';
173-
174-
if ('${{ github.event_name }}' == 'pull_request_target' && '${{ github.event.action }}' != 'closed') {
175-
console.log('Skipping cache cleanup for open PR');
176-
return;
177-
}
178-
179-
await github.paginate(github.rest.actions.getActionsCacheList, {
180-
owner: context.repo.owner,
181-
repo: context.repo.repo,
182-
per_page: 100,
183-
key: key_prefix
184-
}).then(caches => {
185-
if (caches) {
186-
for (const cache of caches) {
187-
console.log(`Deleting cache: ${cache.key}`);
188-
github.rest.actions.deleteActionsCacheById({
189-
owner: context.repo.owner,
190-
repo: context.repo.repo,
191-
cache_id: cache.id
192-
});
193-
}
194-
}
195-
});
119+
# clean:
120+
# name: Clean objects
121+
# if: always()
122+
# permissions:
123+
# actions: write
124+
# runs-on: ubuntu-latest
125+
# steps:
126+
# - name: Clean up caches
127+
# uses: actions/github-script@v7
128+
# with:
129+
# script: |
130+
# const ref = '${{ github.event.pull_request.number || github.ref }}';
131+
# const key_prefix = 'tests-' + ref + '-';
132+
133+
# if ('${{ github.event_name }}' == 'pull_request_target' && '${{ github.event.action }}' != 'closed') {
134+
# console.log('Skipping cache cleanup for open PR');
135+
# return;
136+
# }
137+
138+
# await github.paginate(github.rest.actions.getActionsCacheList, {
139+
# owner: context.repo.owner,
140+
# repo: context.repo.repo,
141+
# per_page: 100,
142+
# key: key_prefix
143+
# }).then(caches => {
144+
# if (caches) {
145+
# for (const cache of caches) {
146+
# console.log(`Deleting cache: ${cache.key}`);
147+
# github.rest.actions.deleteActionsCacheById({
148+
# owner: context.repo.owner,
149+
# repo: context.repo.repo,
150+
# cache_id: cache.id
151+
# });
152+
# }
153+
# }
154+
# });

.github/workflows/build_tests.yml renamed to .github/workflows/tests_build.yml

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ jobs:
2020
id: ${{ github.event.pull_request.number || github.ref }}-${{ github.event.pull_request.head.sha || github.sha }}-${{ inputs.chip }}-${{ inputs.type }}
2121
steps:
2222
- name: Check if already built
23-
if: ${{ github.event.pull_request.number != null }}
2423
id: cache-build-binaries
2524
uses: actions/cache/restore@v4
2625
with:
@@ -46,21 +45,6 @@ jobs:
4645
- name: Checkout user repository
4746
if: ${{ steps.check-build.outputs.enabled == 'true' }}
4847
uses: actions/checkout@v4
49-
with:
50-
ref: ${{ github.event.pull_request.head.sha || github.sha }}
51-
persist-credentials: false
52-
sparse-checkout-cone-mode: false
53-
sparse-checkout: |
54-
/*
55-
!.github
56-
57-
# To avoid giving unknown scripts elevated permissions, download them from the master branch
58-
- name: Get CI scripts from master
59-
if: ${{ steps.check-build.outputs.enabled == 'true' }}
60-
run: |
61-
mkdir -p .github
62-
cd .github
63-
curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github
6448

6549
- name: Get libs cache
6650
uses: actions/cache@v4

.github/workflows/hw.yml renamed to .github/workflows/tests_hw.yml

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@ jobs:
2222
image: python:3.10.1-bullseye
2323
options: --privileged
2424
steps:
25-
- name: Check if already built
26-
if: ${{ github.event.pull_request.number != null }}
25+
- name: Check if already passed
2726
id: cache-results
2827
uses: actions/cache/restore@v4
2928
with:
@@ -48,21 +47,6 @@ jobs:
4847
- name: Checkout user repository
4948
if: ${{ steps.check-tests.outputs.enabled == 'true' }}
5049
uses: actions/checkout@v4
51-
with:
52-
ref: ${{ github.event.pull_request.head.sha || github.sha }}
53-
persist-credentials: false
54-
sparse-checkout-cone-mode: false
55-
sparse-checkout: |
56-
/*
57-
!.github
58-
59-
# To avoid giving unknown scripts elevated permissions, download them from the master branch
60-
- name: Get CI scripts from master
61-
if: ${{ steps.check-tests.outputs.enabled == 'true' }}
62-
run: |
63-
mkdir -p .github
64-
cd .github
65-
curl https://codeload.github.com/${{ github.repository }}/tar.gz/master | tar -xz --strip=2 arduino-esp32-master/.github
6650

6751
# setup-python currently only works on ubuntu images
6852
# - uses: actions/setup-python@v5
@@ -95,7 +79,7 @@ jobs:
9579
9680
- name: Upload ${{ inputs.chip }} ${{ inputs.type }} hardware results as cache
9781
uses: actions/cache/save@v4
98-
if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
82+
if: ${{ steps.check-tests.outputs.enabled == 'true' }}
9983
with:
10084
key: tests-${{ env.id }}-results-hw
10185
path: |

‎.github/workflows/tests_publish.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Publish test results
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Wokwi tests"]
6+
types:
7+
- completed
8+
9+
# No permissions by default
10+
permissions: { contents: read }
11+
12+
jobs:
13+
unit-test-results:
14+
name: Unit Test Results
15+
if: |
16+
github.event.workflow_run.conclusion == 'success' ||
17+
github.event.workflow_run.conclusion == 'failure' ||
18+
github.event.workflow_run.conclusion == 'timed_out'
19+
runs-on: ubuntu-latest
20+
permissions:
21+
actions: read
22+
statuses: write
23+
checks: write
24+
pull-requests: write
25+
steps:
26+
- name: Download and Extract Artifacts
27+
uses: dawidd6/action-download-artifact@v6
28+
with:
29+
run_id: ${{ github.event.workflow_run.id }}
30+
path: ./artifacts
31+
32+
- name: Get original info
33+
run: |
34+
original_event=$(cat ./artifacts/parent-artifacts/event.txt)
35+
original_sha=$(cat ./artifacts/parent-artifacts/sha.txt)
36+
echo "original_event=$original_event" >> $GITHUB_ENV
37+
echo "original_sha=$original_sha" >> $GITHUB_ENV
38+
39+
echo "original_event = $original_event"
40+
echo "original_sha = $original_sha"
41+
42+
- name: Publish Unit Test Results
43+
uses: EnricoMi/publish-unit-test-result-action@v2
44+
with:
45+
commit: ${{ env.original_sha }}
46+
event_file: ./artifacts/parent-artifacts/event_file/event.json
47+
event_name: ${{ env.original_event }}
48+
files: ./artifacts/**/*.xml
49+
action_fail: true
50+
51+
- name: Report conclusion
52+
uses: actions/github-script@v7
53+
if: always()
54+
with:
55+
script: |
56+
const owner = '${{ github.repository_owner }}';
57+
const repo = '${{ github.repository }}'.split('/')[1];
58+
const sha = '${{ env.original_sha }}';
59+
core.debug(`owner: ${owner}`);
60+
core.debug(`repo: ${repo}`);
61+
core.debug(`sha: ${sha}`);
62+
const { context: name, state } = (await github.rest.repos.createCommitStatus({
63+
context: 'Runtime Tests / Report results (${{ env.original_event }} -> workflow_run -> workflow_run)',
64+
owner: owner,
65+
repo: repo,
66+
sha: sha,
67+
state: '${{ job.status }}',
68+
description: '${{ job.status }}' ? 'Runtime tests successful' : 'Runtime tests failed',
69+
target_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
70+
})).data;
71+
core.info(`${name} is ${state}`);

.github/workflows/qemu.yml renamed to .github/workflows/tests_qemu.yml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@ jobs:
1818
QEMU_INSTALL_PATH: "$HOME"
1919
runs-on: ubuntu-latest
2020
steps:
21-
- name: Check if already run
22-
if: ${{ github.event.pull_request.number != null }}
21+
- name: Check if already passed
2322
id: get-cache-results
2423
uses: actions/cache/restore@v4
2524
with:
@@ -97,7 +96,7 @@ jobs:
9796
with:
9897
path: |
9998
~/qemu
100-
key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/qemu.yml') }}
99+
key: qemu-${{ steps.get-qemu-version.outputs.release }}-${{ hashFiles('.github/workflows/tests_qemu.yml') }}
101100

102101
- name: Download QEMU
103102
if: ${{ steps.cache-qemu.outputs.cache-hit != 'true' && steps.check-tests.outputs.enabled == 'true' }}
@@ -125,7 +124,7 @@ jobs:
125124

126125
- name: Upload ${{ inputs.chip }} ${{ inputs.type }} QEMU results as cache
127126
uses: actions/cache/save@v4
128-
if: ${{ always() && steps.check-tests.outputs.enabled == 'true' }}
127+
if: ${{ steps.check-tests.outputs.enabled == 'true' }}
129128
with:
130129
key: tests-${{ env.id }}-results-qemu
131130
path: |

0 commit comments

Comments
 (0)