1
1
name : build
2
2
3
3
on :
4
- pull_request_target : # Runs on PRs from forks, safely (no secrets)
4
+ pull_request_target :
5
5
push :
6
- branches : master # Runs on direct pushes to master
6
+ branches : master
7
7
8
8
jobs :
9
9
test :
10
10
runs-on : ubuntu-latest
11
-
12
11
steps :
13
12
- name : Checkout PR Code Securely
14
13
uses : actions/checkout@v3
15
14
with :
16
15
ref : ${{ github.event.pull_request.head.sha }}
17
16
18
- - name : Debug - Print GitHub Event
19
- run : echo "Triggered by ${{ github.event_name }}"
20
-
21
17
- name : Setup Java
22
18
uses : actions/setup-java@v2
23
19
with :
@@ -34,20 +30,47 @@ jobs:
34
30
- name : Run Jacoco (No Secrets)
35
31
run : ./gradlew jacocoTestReport
36
32
37
- - name : Upload Test Report (No Secrets)
38
- uses : ' actions/upload-artifact@v4'
33
+ - name : Debug - Verify Coverage Report Exists
34
+ run : ls -la ${{ github.workspace }}/ipv8/build/reports/jacoco/test/
35
+
36
+ - name : Upload Test Coverage Report
37
+ uses : actions/upload-artifact@v4
39
38
with :
40
- name : report.xml
39
+ name : coverage- report
41
40
path : ${{ github.workspace }}/ipv8/build/reports/jacoco/test/jacocoTestReport.xml
42
41
43
- secure-tasks :
42
+ manual-approval :
44
43
needs : test
45
44
runs-on : ubuntu-latest
46
- if : github.event_name == 'push' || github.event.pull_request.head.repo.fork == false # Runs only if merged or trusted contributor
45
+ if : github.event.pull_request.head.repo.fork == true
46
+ steps :
47
+ - name : Request Maintainer Approval
48
+ uses : hmarr/auto-approve-action@v3
49
+ with :
50
+ github-token : ${{ secrets.GITHUB_TOKEN }}
51
+
52
+ - name : Pause for Maintainer Approval
53
+ run : |
54
+ echo "A maintainer must approve this job before secrets are used."
55
+ exit 1
56
+
57
+ secure-tasks :
58
+ needs : [test, manual-approval]
59
+ runs-on : ubuntu-latest
60
+ if : github.event_name == 'push' || github.event.pull_request.head.repo.fork == false
47
61
steps :
48
62
- name : Checkout Latest Code
49
63
uses : actions/checkout@v3
50
64
65
+ - name : Download Test Coverage Report
66
+ uses : actions/download-artifact@v4
67
+ with :
68
+ name : coverage-report
69
+ path : ${{ github.workspace }}/ipv8/build/reports/jacoco/test/
70
+
71
+ - name : Debug - Verify Coverage Report Exists After Download
72
+ run : ls -la ${{ github.workspace }}/ipv8/build/reports/jacoco/test/
73
+
51
74
- name : Upload Coverage to Codecov (Requires Secrets)
52
75
uses : codecov/codecov-action@v1
53
76
with :
65
88
- name : Get Coverage Info
66
89
run : |
67
90
echo "Total coverage ${{ steps.jacoco.outputs.coverage-overall }}"
68
- echo "Changed Files coverage ${{ steps.jacoco.outputs.coverage-changed-files }}"
91
+ echo "Changed Files coverage ${{ steps.jacoco.outputs.coverage-changed-files }}"
0 commit comments