implement RPC support for inbound UDP connect() event #14029
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run internal build | ||
|
Check warning on line 1 in .github/workflows/internal-build.yml
|
||
| on: | ||
| pull_request_target: | ||
| # Read-only permissions are enough | ||
| permissions: read-all | ||
| concurrency: | ||
| # Cancel existing builds for the same PR. | ||
| # Otherwise, all other builds will be allowed to run through. | ||
| group: internal-build-${{ github.event.pull_request.number || github.run_id }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| internal-build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| # Check if this is a fork and if the owner is a Cloudflare org member | ||
| - name: Check fork status and org membership | ||
| if: github.event.pull_request.head.repo.fork | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| FORK_OWNER: ${{ github.event.pull_request.head.repo.owner.login }} | ||
| run: | | ||
| echo "Fork detected. Checking if $FORK_OWNER is a Cloudflare org member..." | ||
| if gh api "orgs/cloudflare/members/$FORK_OWNER" --silent 2>/dev/null; then | ||
| echo "✓ Cloudflare org member confirmed" | ||
| else | ||
| echo "✗ Fork owner '$FORK_OWNER' is not a public Cloudflare org member." | ||
| echo "" | ||
| echo "GitHub's public membership API cannot verify private organization membership." | ||
| echo "If you are a Cloudflare org member, open the page below, find your account," | ||
| echo "change your organization visibility from Private to Public, and re-run this workflow:" | ||
| echo "https://github.com/orgs/cloudflare/people" | ||
| echo "" | ||
| echo "If you are an external contributor, please ask the auto-assigned reviewers for help." | ||
| exit 1 | ||
| fi | ||
| - name: Checkout trusted workflow tooling | ||
| uses: actions/checkout@v7 | ||
| with: | ||
| path: trusted | ||
| persist-credentials: false | ||
| show-progress: false | ||
| # Try to checkout the merge commit - will fail if PR isn't mergeable | ||
| - uses: actions/checkout@v7 | ||
| id: checkout_merge | ||
| continue-on-error: true | ||
| with: | ||
| # Fork PRs reach this step only after their owner is confirmed to be a | ||
| # public Cloudflare org member. Workflow tooling runs from the trusted checkout. | ||
| allow-unsafe-pr-checkout: true | ||
| path: pull-request | ||
| persist-credentials: false | ||
| ref: refs/pull/${{ github.event.pull_request.number }}/merge | ||
| show-progress: false | ||
| # Fail the workflow if checkout failed (PR isn't mergeable) | ||
| - name: Fail if PR isn't mergeable | ||
| if: steps.checkout_merge.outcome != 'success' | ||
| run: | | ||
| echo "The pull request is not mergeable. Please rebase and resolve any conflicts." | ||
| exit 1 | ||
| - name: Run internal build | ||
| working-directory: trusted | ||
| env: | ||
| CI_URL: ${{ secrets.CI_URL }} | ||
| CI_CLIENT_ID: ${{ secrets.CI_CF_ACCESS_CLIENT_ID }} | ||
| CI_CLIENT_SECRET: ${{ secrets.CI_CF_ACCESS_CLIENT_SECRET }} | ||
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | ||
| FORK_OWNER: ${{ github.event.pull_request.head.repo.owner.login }} | ||
| run: | | ||
| # Format ref based on whether this is a fork | ||
| if [ "${{ github.event.pull_request.head.repo.fork }}" = "true" ]; then | ||
| REF="$FORK_OWNER/$HEAD_REF" | ||
| else | ||
| REF="$HEAD_REF" | ||
| fi | ||
| python3 -u ./tools/cross/internal_build.py \ | ||
| ${{github.event.pull_request.number}} \ | ||
| ${{steps.checkout_merge.outputs.commit}} \ | ||
| ${{github.event.pull_request.head.sha}} \ | ||
| ${{github.run_attempt}} \ | ||
| "$REF" \ | ||
| $CI_URL \ | ||
| $CI_CLIENT_ID \ | ||
| $CI_CLIENT_SECRET | ||
