Repository navigation
fix(ci): allow data-only fork checkout for catalog admission - #9
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork catalog submissions fail before inspection because
actions/checkout@v7rejects the proposal checkout in the protectedpull_request_targetjob. This enables its documented opt-in only for the proposal checkout, preserving read-only permissions, disabled credential persistence, protected-base tools and hashed dependencies, and the fixed Host checker.Carries #8 unchanged on a branch in this repository using the original Desolate-Jix commit
c4b344ccf01de3af4376d84a3c0b5462504bdf2b. The same-repository PR lets the existing required admission check run while the protected base still contains the old workflow. No protection-rule changes are needed.The regression invokes the real admission CLI with a pinned Host and proposal-side Python sentinels, checking the exit status, exact result and absence of code execution. The original #8 CI passed all four proposal/SDK checks, including 39 pinned-Host catalog tests; its admission check remains blocked by the old fork-checkout rule. This internal PR must pass its own checks before merge.
After merge, trigger a fresh PR event on #7 and verify that the updated protected-base workflow checks out the fork as data and completes admission. Re-running the old failed workflow does not establish that result. Catalog review and publication remain separate.