Reorganize the CI (attempt #2) #1084
Conversation
mwouts
commented
Jun 21, 2023
mwouts
commented
- Run on push/pull requests onto main
- Use concurrency rather than skip_duplicate
- Remove old lint job since it has been superseded by pre-commit
- Simplify CodeQL
- Upload coverage with codecov/codecov-action@v3
- Use trusted publishing
- Run on push/pull requests onto main - Use concurrency rather than skip_duplicate - Remove old lint job since it has been superseded by pre-commit - Simplify CodeQL - Upload coverage with codecov/codecov-action@v3 - Use trusted publishing
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
mwouts
force-pushed
the
reorganize_ci_2
branch
4 times, most recently
from
197a845 to
aea8179
Compare
| - "v[0-9]+.[0-9]+.[0-9]+-rc[0-9]+" | ||
|
|
||
| jobs: | ||
| publish: |
There was a problem hiding this comment.
Can add a:
tests:
uses: ./.github/workflows/continuous-integration.yml
secrets: inheritWith a needs on publish and a on.workflow_call on continuous-integration.yml
There was a problem hiding this comment.
I think it would make sense to have publish step executed only when the tests pass, but isn't the current version fine? I.e. the maintainer should not release a new version until all the CI jobs pass, right?
Also what is the meaning of secrets? I have not tried yet the trusted publishing approach, but I thought that it would not use secrets anymore?
There was a problem hiding this comment.
Yes, for the most part it is ok. Adding a dependency like that will make sure that if there were any upstream changes in the meantime, everything is still good. I usually run ci-build-wheel only before release because of how thorough it is and test just for good measure.
secrets is not really necessary there. It basically makes sure that your secrets (in publish) propagate to continous-integration.yml. Since these are within the same project and there are no special secret treatments, it can be dropped.
