Something other than the person who wrote the change has to run the checks from the checks issue.
Linux only to begin with. Windows and macOS earn their place at the packaging epic, where the three platform promise is what is actually being tested.
The awkward part is our own arrangement: this repository depends on link:../harmony-explorations/packages/codec, and a runner checks out one repository. So the workflow checks out both into the sibling layout the link expects, and pins which branch it takes. That goes away once the libraries are published.
Never pull_request_target. It runs the base branch's workflow with a writable token and the repository's secrets against a stranger's code, which is this project's rule about text from outside, in workflow form. pull_request is the safe trigger: a read only token, no secrets, and a first time contributor needs approval before anything runs.
Local checks stay the first line, since CI only runs once something has been pushed.
Done when a pull request shows a passing check that installed both repositories, typechecked, linted and ran the tests.
Something other than the person who wrote the change has to run the checks from the checks issue.
Linux only to begin with. Windows and macOS earn their place at the packaging epic, where the three platform promise is what is actually being tested.
The awkward part is our own arrangement: this repository depends on
link:../harmony-explorations/packages/codec, and a runner checks out one repository. So the workflow checks out both into the sibling layout the link expects, and pins which branch it takes. That goes away once the libraries are published.Never
pull_request_target. It runs the base branch's workflow with a writable token and the repository's secrets against a stranger's code, which is this project's rule about text from outside, in workflow form.pull_requestis the safe trigger: a read only token, no secrets, and a first time contributor needs approval before anything runs.Local checks stay the first line, since CI only runs once something has been pushed.
Done when a pull request shows a passing check that installed both repositories, typechecked, linted and ran the tests.