ci: add fork branch sync workflow #629
Conversation
- Implement automated sync every 30 minutes - Enable manual sync via workflow dispatch - Use fork-sync action for branch synchronization Signed-off-by: mingcheng <[email protected]>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAdds a new GitHub Actions workflow to periodically and manually sync the fork’s master branch with upstream using the tgymnich/fork-sync action. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Pull Request Overview
This PR adds a CI workflow to automatically synchronize a fork's master branch with the upstream repository using the tgymnich/fork-sync action.
- Implements automated sync every 30 minutes via cron schedule
- Enables manual sync through workflow dispatch trigger
- Uses merge method for synchronization
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| with: | ||
| base: master | ||
| head: master | ||
| merge_method: merge |
There was a problem hiding this comment.
The workflow is missing a token parameter for authentication. The fork-sync action requires a GitHub token with appropriate permissions to perform the sync operation. Add a token parameter with a GitHub token that has write access to the repository.
| merge_method: merge | |
| merge_method: merge | |
| token: ${{ secrets.GITHUB_TOKEN }} |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `.github/workflows/sync-branch.yaml:14` </location>
<code_context>
uses: tgymnich/[email protected]
</code_context>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
|
||
| steps: | ||
| - name: Fork Sync | ||
| uses: tgymnich/[email protected] |
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
|
Migrated to #631 |
Why are these changes needed?
Related issue number
Checks
git commit -s) in this PR.scripts/format.shto lint the changes in this PR.method in Tune, I've added it in
doc/source/tune/api/under thecorresponding
.rstfile.Summary by Sourcery
Add a scheduled and manual GitHub Actions workflow to keep forked master branch in sync with upstream master using the fork-sync action
CI: