From 41a70a7bc62e9793a43025cd72823ddbd98cacbf Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 29 Jan 2024 17:48:30 -0500 Subject: [PATCH 1/5] Update to actions/checkout@v4 for master merge workflow --- .github/workflows/stable-merge.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/stable-merge.yml b/.github/workflows/stable-merge.yml index 8b77f4d7d3..9135dc5f7a 100644 --- a/.github/workflows/stable-merge.yml +++ b/.github/workflows/stable-merge.yml @@ -12,7 +12,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v1 + uses: actions/checkout@v4 + with: + fetch-depth: 0 - name: Merge master into dev uses: robotology/gh-action-nightly-merge@22f5e45d028f22837d617fa07512925457eec184 #v1.3.3 From 62423db1c52b9fc8d308cff2267ce64c67333a3b Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 29 Jan 2024 17:49:02 -0500 Subject: [PATCH 2/5] Fix Code Scanning start conditional --- .github/workflows/ci-pipeline.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index c8612242b9..2df78f5bf2 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -85,6 +85,7 @@ jobs: name: Code Scanning needs: start-ci-run-gate runs-on: ubuntu-latest + if: (!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success') steps: - name: Setup dotnet uses: actions/setup-dotnet@v4 From ad43286ba88dfc3d173769b84c908e3be5f932ab Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 29 Jan 2024 22:52:56 -0500 Subject: [PATCH 3/5] Remove the need for the extra CI token --- .github/CONTRIBUTING.md | 1 - .github/workflows/ci-pipeline.yml | 13 ++++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 7c0274a445..48b19a8566 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -64,7 +64,6 @@ For the full CI gambit, the following repository configuration must be set: ![image](https://github.com/tgstation/tgstation-server/assets/8171642/ab17fa74-364f-4e66-b7c4-b9bb24c6a599) - Label `CI Cleared`: To allow PRs from forks to run CI with secrets after approval. - Integration [CodeCov](https://github.com/apps/codecov): Enables CodeCov status checks. -- Secret `CI_STATUSES_TOKEN`: A GitHub token with read access to the repository's contents/actions and write access to the repository's checks/security events. Used to create CI completion statuses. - Secret `CODECOV_TOKEN`: A CodeCov repo token to work around https://github.com/codecov/codecov-action/issues/837. - Secret `LIVE_TESTS_TOKEN`: A GitHub token with read access to the repository and write access to https://github.com/Cyberboss/common_core (TODO: Make the target repository here configurable). Despite it's name, it may be used across the entire test suite. - Secret `TGS_TEST_DISCORD_TOKEN`: See above note about test environment variables. diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 2df78f5bf2..4f653587be 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -85,6 +85,9 @@ jobs: name: Code Scanning needs: start-ci-run-gate runs-on: ubuntu-latest + permissions: + security-events: write + actions: read if: (!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success') steps: - name: Setup dotnet @@ -100,7 +103,6 @@ jobs: uses: github/codeql-action/init@v3 with: languages: csharp - token: ${{ secrets.CI_STATUSES_TOKEN }} - name: Build run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true @@ -109,8 +111,6 @@ jobs: uses: github/codeql-action/analyze@v3 with: category: "/language:csharp" - token: ${{ secrets.CI_STATUSES_TOKEN }} - dmapi-build: name: Build DMAPI @@ -1374,12 +1374,15 @@ jobs: name: CI Completion Gate needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template, code-scanning ] runs-on: ubuntu-latest - if: (!(cancelled() || failure()) && needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success') + permissions: + checks: write + contents: read + if: (!(cancelled() || failure()) && needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success' && needs.code-scanning.result == 'success') steps: - name: Create Completion Check uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 with: - token: ${{ secrets.CI_STATUSES_TOKEN }} + token: ${{ secrets.GITHUB_TOKEN }} name: CI Completion conclusion: success output: | From 3246ac93bb14de31ff91fd2a7d3a620befd213ed Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Mon, 29 Jan 2024 22:56:36 -0500 Subject: [PATCH 4/5] Use the correct checkout for Code Scanning --- .github/workflows/ci-pipeline.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 4f653587be..e7cc858520 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -96,8 +96,15 @@ jobs: dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x' dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - name: Checkout + - name: Checkout (Branch) uses: actions/checkout@v4 + if: github.event_name == 'push' || github.event_name == 'schedule' + + - name: Checkout (PR Merge) + uses: actions/checkout@v4 + if: github.event_name != 'push' && github.event_name != 'schedule' + with: + ref: "refs/pull/${{ github.event.number }}/merge" - name: Initialize CodeQL uses: github/codeql-action/init@v3 From 0497dd328ebd3c19ffa10e82a46e7537121d0f9a Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Wed, 31 Jan 2024 17:16:57 -0500 Subject: [PATCH 5/5] Fix duplicate artefact uploads/steps --- .github/workflows/ci-pipeline.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index e7cc858520..49d1a5bc69 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -618,7 +618,7 @@ jobs: path: C:/tgs_api.json - name: Package Server Service - if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }} + if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }} run: | cd src/Tgstation.Server.Host.Service dotnet publish -c ${{ matrix.configuration }} -o ../../artifacts/Service @@ -630,14 +630,14 @@ jobs: build/RemoveUnsupportedServiceRuntimes.ps1 artifacts/Service - name: Store Server Service - if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }} + if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }} uses: actions/upload-artifact@v4 with: name: ServerService path: artifacts/Service/ - name: Install Code Signing Certificate - if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }} + if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }} shell: powershell run: | $pfxBytes = [convert]::FromBase64String("${{ secrets.CODE_SIGNING_BASE64 }}") @@ -647,7 +647,7 @@ jobs: rm tg_codesigning.pfx - name: Test Sign Service .exe - if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }} + if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }} shell: powershell run: Set-AuthenticodeSignature artifacts/Service/Tgstation.Server.Host.Service.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"