mirror of
https://github.com/eclipse-sailing-analytics/sailing-analytics.git
synced 2026-11-03 09:39:38 +00:00
Axel Uhl
dfc113c19f
A submitted PR now triggers a build automatically, split by trust: - Same-repo PR (branch pushed by a committer): full build with tests and secrets — same trust level as a direct branch push, which already builds with secrets. build-gate can go green with no manual tag. - Fork PR: compile-only with NO secrets. GitHub withholds secrets from fork pull_request runs at the event level, and a compile-only build needs none, so this is both automatic and safe. build-gate stays red; the secret-bearing full build of fork code remains gated behind a maintainer pushing a *-reviewed-for-build tag. Uses pull_request (not pull_request_target), so fork runs get a read-only token and no secrets; with the secret env values already resolving to '' when tests are skipped, fork code never meets a secret. - pull_request trigger: types [opened, synchronize, reopened, ready_for_review] with the same paths-ignore as push; no branches: filter (targets PRs into any base branch). - build job if:: draft PRs are excluded (build only once marked ready). - Determine build mode: a fork pull_request (head.repo.full_name != the base repo) sets skip_tests=true; same-repo PRs run the full build. The conditional secret env, -t flag, Test Reports guard, and both gate jobs already key on the computed skip_tests flag, so they need no change. Assisted-By: Claude Opus 4.8