Things to review | OE license security for PRs from forks JM ā Playground for āTrusted user posts a special GH comment that allows CI on the latest commit to have access to secretsā
JM ā Generally, this would be possible, but weād either need to duplicate all the CI yamls to have trusted and untrusted variants, or Add ~100 lines to each CI yaml to add trust-detection logic
So basically, itās not possible to have an external file that can just be added to repos to make a āmagic wordā for maintainers to allow CI secret access to previous commit.
Decision ā After one research cycle on this, weāve decided not to try rolling our own privileged/fine-grained secrets access for PRs from forks. Instead, when people open a new PR to master , a maintainer will make a new branch (like contrib-987 ) off master, redirect the PR to that, expect that secrets-requiring CI will fail, merge the PR into contrib-987 , then the maintainer will open a PR from contrib-987 into master and merge if CI passes.
|