fix: remove fossa restriction on forks #3953
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3953 +/- ##
=======================================
Coverage 98.61% 98.61%
=======================================
Files 828 828
Lines 15126 15126
Branches 4340 4340
=======================================
Hits 14917 14917
Misses 201 201
Partials 8 8
Continue to review full report in Codecov by Sentry.
|
Bundle ReportBundle size has no change ✅ |
Bundle ReportBundle size has no change ✅ |
![sentry[bot]](https://avatars.githubusercontent.com/u/1396951?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| needs: install | ||
| if: ${{ !github.event.pull_request.head.repo.fork && github.repository_owner == 'codecov' }} | ||
| if: ${{ github.repository_owner == 'codecov' }} |
There was a problem hiding this comment.
Bug: FOSSA job fails on fork PRs due to unavailable secrets.FOSSA_API_KEY.
Severity: CRITICAL | Confidence: 0.95
🔍 Detailed Analysis
The FOSSA job will fail when triggered by pull requests originating from forked repositories. This occurs because GitHub Actions intentionally provides an empty string for secrets.FOSSA_API_KEY on pull_request events from forks. The change removed the if: ${{ !github.event.pull_request.head.repo.fork }} condition, allowing the job to run on forks without a valid API key, leading to failure.
💡 Suggested Fix
Implement a mechanism to handle unavailable secrets on fork PRs, such as using pull_request_target, GitHub Environments, FOSSA's push-only API token, or conditional logic to skip the API key step.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/ci.yml#L378
Potential issue: The FOSSA job will fail when triggered by pull requests originating
from forked repositories. This occurs because GitHub Actions intentionally provides an
empty string for `secrets.FOSSA_API_KEY` on `pull_request` events from forks. The change
removed the `if: ${{ !github.event.pull_request.head.repo.fork }}` condition, allowing
the job to run on forks without a valid API key, leading to failure.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference_id: 2688885
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #3953 +/- ##
=======================================
Coverage 98.61% 98.61%
=======================================
Files 828 828
Lines 15126 15126
Branches 4348 4340 -8
=======================================
Hits 14917 14917
Misses 201 201
Partials 8 8
Continue to review full report in Codecov by Sentry.
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found. @@ Coverage Diff @@
## main #3953 +/- ##
=======================================
Coverage 98.61% 98.61%
=======================================
Files 828 828
Lines 15126 15126
Branches 4340 4348 +8
=======================================
Hits 14917 14917
Misses 201 201
Partials 8 8
Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
✅ Deploy preview for gazebo ready!Previews expire after 1 month automatically.
|
thomasrockhu-codecov
deleted the
th/remove-fossa-restriction-on-non-forks
branch
Description
Remove the restriction on FOSSA on forks, we should still run it if it's incoming into
codecov. Note that a Codecov eng will still need to run by pushing up an empty commitgit commit --allow-emptyCode Example
Notable Changes
Screenshots
Link to Sample Entry
Legal Boilerplate
Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. In 2022 this entity acquired Codecov and as result Sentry is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.
Note
Allows the
fossajob in.github/workflows/ci.ymlto run whenevergithub.repository_owner == 'codecov'by removing the fork check.Written by Cursor Bugbot for commit cbced96. This will update automatically on new commits. Configure here.