jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-13 13:30:00 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[CI] Run the nightly legs from their own jobs

Browse source 
jobs.<id>.if cannot read matrix, so the previous filter never validated and
no leg of this workflow ran. matrix.exclude cannot express it either: GitHub
processes exclude before include, and these matrices are include-only.

Split the regular and nightly legs into two jobs per platform, sharing the
step list through a YAML anchor and gating the jobs on the event instead of
on matrix. The nightly run now covers only the legs a push leaves out, and
the event name is part of the concurrency group so a nightly and a master
push do not cancel each other.
This commit is contained in:
Lukas Brübach 2026-10-30 10:17:19 +01:00
parent 00b33f6960
commit 789f647cf1
2 changed files with 100 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

16
.github/workflows/vcpkg-cache-import.yml vendored
View file

@ -4,12 +4,14 @@ name: Import vcpkg cache
# rebuilds protobuf, openssl and abseil from source and saves them into the shared
# cache, where every later run can restore them.
#
# Only master pushes are imported here: the collect step, keys.txt and the zip
# contents all come from the workflow run being imported, so importing from an
# unmerged pull request would let anyone who can push a branch — or a bot actor
# such as Dependabot, whose PRs are same-repo — promote arbitrary binaries into
# the scope that master and tag builds restore and link into signed releases.
# Forks build untrusted code and must never reach that scope either.
# Only master pushes and the nightly schedule run on master are imported here: the
# collect step, keys.txt and the zip contents all come from the workflow run being
# imported, so importing from an unmerged pull request would let anyone who can push
# a branch — or a bot actor such as Dependabot, whose PRs are same-repo — promote
# arbitrary binaries into the scope that master and tag builds restore and link into
# signed releases. Forks build untrusted code and must never reach that scope either.
# A scheduled run is the default branch at the commit a master push already built, so
# it carries the same trust as a push.
#
# repository_dispatch is not used on purpose: it would also resolve to the default branch,
# but it counts as a low-trust trigger and may only write there when it declares a
@ -38,7 +40,7 @@ jobs:
# the shared scope even if they somehow target the default branch.
if: >-
github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'push' &&
(github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
github.event.workflow_run.head_branch == 'master' &&
github.event.workflow_run.head_repository.full_name == github.repository &&
!endsWith(github.event.workflow_run.actor.login, '[bot]') &&