Add build workflow (fix issue #35)

[mkhansenbot]

Checks to make sure no secrets are exposed, then searches for and runs any build script found

[mkhansenbot]

@ivanperez-keera - please take a look. This and space-ros/space-ros#200 give the expected results. If you agree, I'll remove the temporary test commit from this (the "Delete this commit before merging") and merge this into the repo.

[ivanperez-keera]

Seems good to me.

Just to make it clear, the check for the docker secrets does not in itself constitute any kind of protection: people could modify the .github/workflows/ directory and add another job. In this case, it's just that there are no secrets for this repo (apparently).

We still want to be careful with any PRs sent against the space-ros repo. We may want to disable automatically building PRs over there.

[mkhansenbot]

I removed the test commit and updated the README with instructions, @ivanperez-keera and @EzraBrooks please approve and merge

[EzraBrooks]

I'm not sure the check is necessary; GitHub doesn't forward secrets into CI jobs dispatched from forks.

So, the only case in which the DOCKER_HUB_TOKEN would be populated is if one of us maintainers pushes a branch directly to this repo.

[mkhansenbot]

OK, I just tested a PR from a fork into space-ros/space-ros and it looks like you're correct. I'll remove the secret check if we don't need it

[ivanperez-keera]

Well, the check itself won't matter, because the PR could alter the GA workflow.

What we wanted was to check that it was also not making the secret available to other repos.

[EzraBrooks]

What we wanted was to check that it was also not making the secret available to other repos.

which isn't possible anyway AFAIK. The only workflow type that is allowed to do this is pull_request_target, which we should be sure to never approve someone adding to the repo.

[ivanperez-keera]

So, you can turn the step into:

    - name: Run the build.sh scripts
      run: |
              find . -iname 'build.sh' -exec ./{} \;
```

[mkhansenbot]

I started to do that but then I realized that doesn't fail if the build.sh fails. find only fails if it fails to traverse a tree. I want to fail if any build.sh fails. Right now I've tried a few variations and can't seem to find one that works correctly, in both the passing and failing case

[EzraBrooks]

Probably need to change from find -exec to find | xargs

[EzraBrooks]

oh, interesting, GNU find (AKA what you have in Ubuntu) apparently has a -quit argument?

[mkhansenbot]

Updated to call scripts directly, this works, please approve & merge

[EzraBrooks]

ah, wait, we need an issue reference in the commits here

[mkhansenbot]

Good catch, updated commit message and PR name to include issue #35