Просмотр исходного кода

fix(ci): zizmor no-op blocks gates (#6889)

Without this, when a commit is tested multiple times, it is not tested
again.

As we require to test for merging (rightfully so), the CI will be
blocked when the commit is tested multiple times.

Creating another commit should fix it.
For me, the noop job was an optimization that lead to this kind
of failures.

Unless zizmor rate limits us, there is no reason to _NOT TEST_
the last commit of a PR, even if it was tested before.
So I removed the noop handling and I am now closer to the
upstream recommendations.

There are indeed other ways to fix it, like keeping the noop
but always run on last commit. But this seems convoluted compared
to simply remove the noop check.

Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>
Jean-Philippe Evrard 1 неделя назад
Родитель
Сommit
e5d96d674c
1 измененных файлов с 4 добавлено и 22 удалено
  1. 4 22
      .github/workflows/zizmor.yml

+ 4 - 22
.github/workflows/zizmor.yml

@@ -10,34 +10,16 @@ permissions:
   contents: read
 
 jobs:
-  detect-noop:
-    permissions:
-      actions: write  # for fkirc/skip-duplicate-actions to skip or stop workflow runs
-      contents: read  # for fkirc/skip-duplicate-actions to read and compare commits
-    runs-on: ubuntu-latest
-    outputs:
-      noop: ${{ steps.noop.outputs.should_skip }}
-    steps:
-      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-      - name: Detect No-op Changes
-        id: noop
-        uses: fkirc/skip-duplicate-actions@b974a9395958c231af965b70070979a577efa578 # v5.3.2
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          paths_ignore: '["**.md", "**.png", "**.jpg"]'
-          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
-
   zizmor:
     name: Run zizmor 🌈
     runs-on: ubuntu-latest
-    needs: detect-noop
-    if: needs.detect-noop.outputs.noop != 'true'
     permissions:
       security-events: write
     steps:
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: