Re: [PATCH v2 1/2] CI: limit GitHub Actions to designated branches

From: Jeff King <peff@peff.net>
Date: May 5, 2020, 21:58 UTC
Message-ID: <20200505215843.GA646020@coredump.intra.peff.net>
In-Reply-To: <xmqqlfm69il6.fsf@gitster.c.googlers.com>

On Tue, May 05, 2020 at 02:29:09PM -0700, Junio C Hamano wrote:

Show 6 quoted lines

> > This commit adds a new job which checks a special ref within the
> > repository for CI config, and (optionally) causes all of the other jobs
> > to be skipped.
> 
> Nice---that way, all existing jobs do not even need to know about
> the special controlling ref.

Yep. Also, it only has to run once. It's not too expensive, but it does seem to take a few seconds to run.

I think the VM setup is usually pretty quick due to the way Actions is implemented. I made sure we avoid cloning the whole normal git.git tree, but we still have to clone the individual config branch. It seems to take ~3-5s to run that job. I'd have liked to make it even cheaper for branches which don't want CI (less for latency, but more just because I hate to waste GitHub's resources), but I think that's the best we can do. And for cases where we actually run CI, 3s is a drop in the bucket. ;)

Show 5 quoted lines

> > Right now the logic is to run CI for all branches by default, unless a
> > whitelist exists, in which case the branch must be mentioned there
> > (using its fully qualified ref name).
> 
> So there is no wildcard?  Not really complaining, but am wondering.

Correct, there's no wildcard. It would be easy to add one, now that this gets us to a working shell environment with the refname available. And probably worth doing if we don't just go the "execute a program from the config tree" route.

Show 6 quoted lines

> > Or since we're running a shell in a VM, we really
> > could just run "./allow-ref $refname" and let individual forks specify
> > whatever shell code they like.
> 
> I presume that you are saying "checking out the tree of refs/ci/config
> and there is a program allow-ref that can tell which one to run ci on"?

Yes, exactly.

-Peff