Skip to content

fix: make GS Scorecard non-blocking for releases #505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mbruzda-splunk wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: make GS Scorecard non-blocking for releases #505

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 5 additions & 17 deletions .github/workflows/reusable-build-test-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -937,19 +937,18 @@ jobs:
with:
name: gs-scorecard-report
path: ./gs_scorecard.json
- name: Print and verify GS Scorecard report
- name: Print GS Scorecard report
run: |
if [ ! -f ./gs_scorecard.json ]; then
echo "::error::GS Scorecard report not found"
exit 1
echo "::warning::GS Scorecard report not found"
exit 0
fi
echo "::group::GS Scorecard Report"
jq . ./gs_scorecard.json
echo "::endgroup::"
passed=$(jq -r '.result.passed' ./gs_scorecard.json)
if [ "$passed" != "true" ]; then
echo "::error::GS Scorecard failed"
exit 1
echo "::warning::GS Scorecard did not pass - this is informational only and will not block the release"
fi

setup:
Expand Down Expand Up @@ -3231,18 +3230,7 @@ jobs:
id: check
shell: bash
run: |
# GS Scorecard: must have run for PRs to main (result doesn't matter, but skipped = blocked)
GS_RESULT=$(echo "$NEEDS" | jq -r '.["run-gs-scorecard"].result')
if [[ "${{ github.event_name }}" == "pull_request" ]] && [[ "${{ github.base_ref }}" == "main" ]] && [[ "$GS_RESULT" == "skipped" ]] && [[ "${{ needs.check-docs-changes.outputs.docs-only }}" != "true" ]]; then
echo "::error::GS Scorecard is required for merging PRs to main. To unblock merging please add the 'execute_gs_scorecard' label and re-run the workflow."
echo "## GS Scorecard Required" >> "$GITHUB_STEP_SUMMARY"
echo "Add the \`execute_gs_scorecard\` label to this PR and re-run the workflow. GS Scorecard must complete before merging to main (result does not need to pass)." >> "$GITHUB_STEP_SUMMARY"
echo "run-publish=false" >> "$GITHUB_OUTPUT"
echo "Publish conditions are not met."
exit 1
fi

# Exclude run-gs-scorecard from the general check since it has its own handling above
# GS Scorecard: informational only, never blocks release
RUN_PUBLISH=$(echo "$NEEDS" | jq 'del(.["run-gs-scorecard"]) | .[] | select((.result != "skipped") and .result != "success") | length == 0')
if [[ "$RUN_PUBLISH" != *'false'* ]] && [[ "${{ needs.check-docs-changes.outputs.docs-only }}" == 'false' ]]
then
Expand Down
Loading