ci: support external read-only cache for untrusted PRs #14570
Conversation
scotthart
force-pushed
the
ci-gha-external-read-only
branch
from
f51cf88
to
60534fa
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #14570 +/- ##
=======================================
Coverage 93.59% 93.59%
=======================================
Files 2316 2316
Lines 206915 206915
=======================================
+ Hits 193654 193661 +7
+ Misses 13261 13254 -7 ☔ View full report in Codecov by Sentry. |
| io::run bazelisk "${args[@]}" test "${test_args[@]}" "${integration_test_args[@]}" \ | ||
| //google/cloud/storage/tests/... | ||
| } | ||
| if [[ "${EXECUTE_INTEGRATION_TESTS}" == "true" ]]; then |
There was a problem hiding this comment.
Consider using getopt and something like --skip-integration-tests=true. Environment variables are global variables in disguise, one should use them sparingly
| --test_env=GRPC_DEFAULT_SSL_ROOTS_FILE_PATH="${HOME}/roots.pem" \ | ||
| //google/cloud/storage/tests/... | ||
| } | ||
| if [[ "${EXECUTE_INTEGRATION_TESTS}" == "true" ]]; then |
There was a problem hiding this comment.
Ditto, consider using an argument to the script.
| @@ -45,7 +45,11 @@ function bazel::test_args() { | |||
| ) | |||
| if [[ -n "${BAZEL_REMOTE_CACHE:-}" ]]; then | |||
| args+=("--remote_cache=${BAZEL_REMOTE_CACHE}") | |||
| args+=("--google_default_credentials") | |||
| if [[ "${BAZEL_REMOTE_CACHE_RW_MODE}" == "READ_WRITE" ]]; then | |||
There was a problem hiding this comment.
Also consider something other than enviroment variables for these.
There was a problem hiding this comment.
Reviewable status: 0 of 9 files reviewed, 3 unresolved discussions (waiting on @coryan)
ci/gha/builds/macos-bazel.sh line 53 at r1 (raw file):
Previously, coryan (Carlos O'Ryan) wrote…
Consider using
getoptand something like--skip-integration-tests=true. Environment variables are global variables in disguise, one should use them sparingly
created #14572
ci/gha/builds/windows-bazel.sh line 49 at r1 (raw file):
Previously, coryan (Carlos O'Ryan) wrote…
Ditto, consider using an argument to the script.
Ack
ci/gha/builds/lib/bazel.sh line 48 at r1 (raw file):
Previously, coryan (Carlos O'Ryan) wrote…
Also consider something other than enviroment variables for these.
Ack
While sccache is unavailable in a read_only mode, both the bazel-cache and vcpkg-cache can be used without credentials.
Integration tests, since they require credentials, will not be run by workflows started by test-runner-untrusted.yml.
This change is