github/workflows: fix zizmor syntax by quaresmajose · Pull Request #3170 · qualcomm-linux/meta-qcom

Jose Quaresma (quaresmajose) · 2026-09-16T15:06:50Z

Use GitHub's dedicated self-repository syntax: use '$/...' instead of './...'
Secrets unconditionally inherited by called workflow: this reusable workflow

Jose Quaresma (quaresmajose) · 2026-09-16T15:11:19Z

Issue reported in #1900 (comment)

github-actions · 2026-09-16T18:58:49Z

Test run workflow

Test jobs for commit `c7d6e50`

qcom-distro
Pass: 295 | Fail: 21 | Total: 357

qcom-distro_linux-qcom-6.18
Pass: 232 | Fail: 7 | Total: 259

nodistro
Pass: 10 | Fail: 0 | Total: 10

test-reporting-app · 2026-09-16T18:59:11Z

Test Results

119 files + 51 715 suites +396 9h 32m 31s ⏱️ + 4h 25m 7s
175 tests + 24 144 ✅ - 1 1 💤 + 1 30 ❌ +24
4 590 runs +2 489 4 490 ✅ +2 414 61 💤 +42 39 ❌ +33

For more details on these failures, see this check.

Results for commit c7d6e50. ± Comparison against base commit cbf084d.

♻️ This comment has been updated with latest results.

Ricardo Salveti (ricardosalveti) · 2026-09-16T19:26:48Z

Not really fixed it seems?

Jose Quaresma (quaresmajose) · 2026-09-16T20:43:13Z

Not really fixed it seems?

It looks like there is a new error now, but I can't quite figure out if it's caused by the change. It seems more likely that the error is appearing because the file in question was modified. I also don't know how to fix this new issue with the secrets unconditionally inherited.

Jose Quaresma (quaresmajose) · 2026-09-16T20:49:35Z

Not really fixed it seems?

It looks like there is a new error now, but I can't quite figure out if it's caused by the change. It seems more likely that the error is appearing because the file in question was modified. I also don't know how to fix this new issue with the secrets unconditionally inherited.

Some useful information in https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow

Ricardo Salveti (ricardosalveti) · 2026-09-16T22:17:18Z

It looks like there is a new error now, but I can't quite figure out if it's caused by the change. It seems more likely that the error is appearing because the file in question was modified. I also don't know how to fix this new issue with the secrets unconditionally inherited.

Some useful information in https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow

Maybe:

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 0b990aed..a2342576 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -69,7 +69,8 @@ jobs:
       checks: write
       pull-requests: write
     uses: $/.github/workflows/test.yml
-    secrets: inherit
+    secrets:
+      LAVATOKEN: ${{ secrets.LAVATOKEN }}
     with:
       build_id: ${{ github.event.workflow_run.id }}
       pr_number: ${{ needs.determine-target-branch.outputs.pr_number }}

qcomlnxci · 2026-09-20T06:49:07Z

Test Coral run workflow

Test jobs for commit `32a3010`

qcomdistro: multimedia image-prop
Pass: 36 | Fail: 3 | Others: 2 | Total: 41
qcomdistro: multimedia image
Pass: 9 | Fail: 0 | Total: 9

Use GitHub's dedicated self-repository syntax: | use '$/...' instead of './...' Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>

Jose Quaresma (quaresmajose) · 2026-09-21T16:26:44Z

It looks like there is a new error now, but I can't quite figure out if it's caused by the change. It seems more likely that the error is appearing because the file in question was modified. I also don't know how to fix this new issue with the secrets unconditionally inherited.

Some useful information in https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow

Maybe:
diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 0b990aed..a2342576 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -69,7 +69,8 @@ jobs:
       checks: write
       pull-requests: write
     uses: $/.github/workflows/test.yml
-    secrets: inherit
+    secrets:
+      LAVATOKEN: ${{ secrets.LAVATOKEN }}
     with:
       build_id: ${{ github.event.workflow_run.id }}
       pr_number: ${{ needs.determine-target-branch.outputs.pr_number }}

Thanks

Ricardo Salveti (ricardosalveti) · 2026-09-21T19:04:43Z

publish-results is not really using LAVATOKEN, so that can be removed, and we can replace with TEST_REPORTING_APP_TOKEN instead, like:

--- a/.github/workflows/publish-results.yml
+++ b/.github/workflows/publish-results.yml
@@ -19,9 +19,6 @@ on:
       TEST_REPORTING_APP_TOKEN:
         required: true
         description: "Private key of the GitHub App used to report test results"
-      LAVATOKEN:
-        required: true
-        description: "Token used to submit jobs to the LAVA lab"

 permissions:
   checks: write
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -37,7 +37,7 @@ jobs:
     uses: $/.github/workflows/publish-results.yml
     needs: test
     secrets:
-      LAVATOKEN: ${{ secrets.LAVATOKEN }}
+      TEST_REPORTING_APP_TOKEN: ${{ secrets.TEST_REPORTING_APP_TOKEN }}
     with:
       workflow_id: ${{ github.run_id }}
--- a/.github/workflows/test-pr-wrynose.yml
+++ b/.github/workflows/test-pr-wrynose.yml
@@ -117,7 +117,7 @@ jobs:
     uses: $/.github/workflows/publish-results.yml
     secrets:
-      LAVATOKEN: ${{ secrets.LAVATOKEN }}
+      TEST_REPORTING_APP_TOKEN: ${{ secrets.TEST_REPORTING_APP_TOKEN }}
     needs: [test-wrynose]
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -141,7 +141,7 @@ jobs:
     uses: $/.github/workflows/publish-results.yml
     secrets:
-      LAVATOKEN: ${{ secrets.LAVATOKEN }}
+      TEST_REPORTING_APP_TOKEN: ${{ secrets.TEST_REPORTING_APP_TOKEN }}
     needs: [test]

Secrets unconditionally inherited by called workflow: this reusable workflow Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>

qcomlnxci · 2026-09-21T19:42:16Z

Test Coral run workflow

Test jobs for commit `4c4d3e5`

qcomdistro: multimedia image-prop
Pass: 35 | Fail: 6 | Total: 41
qcomdistro: multimedia image
Pass: 9 | Fail: 0 | Total: 9

Ricardo Salveti (ricardosalveti) · 2026-09-22T01:42:42Z

Pushed to next: https://github.com/qualcomm-linux/meta-qcom/actions/runs/35676743857

qcomlnxci · 2026-09-22T06:15:18Z

Test Coral run workflow

Test jobs for commit `c7d6e50`

qcomdistro: multimedia image-prop
Pass: 40 | Fail: 0 | Others: 2 | Total: 42
qcomdistro: multimedia image
Pass: 9 | Fail: 0 | Total: 9

Ricardo Salveti (ricardosalveti) · 2026-09-22T19:46:49Z

Next is good.

Ricardo Salveti (ricardosalveti) · 2026-09-22T19:47:18Z

Jose Quaresma (@quaresmajose) can you look at mirroring these changes to the other branches and repos?

Jose Quaresma (quaresmajose) · 2026-09-23T13:47:00Z

Yes, I will handle that.

Jose Quaresma (quaresmajose) · 2026-09-25T20:15:10Z

Need to also pick from #3222

Jose Quaresma (quaresmajose) requested review from Anuj Mittal (anujm1), Koen Kooi (koenkooi), Dmitry Baryshkov (lumag), Nicolas Dechesne (ndechesne), Ricardo Salveti (ricardosalveti) and Viswanath Kraleti (vkraleti) as code owners September 16, 2026 15:06

github-advanced-security Bot found potential problems Sep 16, 2026

View reviewed changes

Comment thread .github/workflows/push.yml Fixed

Comment thread .github/workflows/push.yml Fixed

Comment thread .github/workflows/test-pr-wrynose.yml Fixed

Comment thread .github/workflows/test-pr.yml Fixed

Comment thread .github/workflows/test-pr.yml Fixed

Jose Quaresma (quaresmajose) mentioned this pull request Sep 16, 2026

ci: add testimage #1900

Open

Ricardo Salveti (ricardosalveti) mentioned this pull request Sep 18, 2026

[Backport wrynose] ci: backport CI infrastructure changes from master #3187

Merged

Dmitry Baryshkov (lumag) previously approved these changes Sep 20, 2026

View reviewed changes

github/workflows: fix zizmor 'uses' syntax

d34bb87

Use GitHub's dedicated self-repository syntax: | use '$/...' instead of './...' Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>

Jose Quaresma (quaresmajose) dismissed Dmitry Baryshkov (lumag)’s stale review via 4c4d3e5 September 21, 2026 16:16

Jose Quaresma (quaresmajose) force-pushed the zizmor branch from 32a3010 to 4c4d3e5 Compare September 21, 2026 16:16

Jose Quaresma (quaresmajose) changed the title ~~github/workflows: fix zizmor 'uses' syntax~~ github/workflows: fix zizmor syntax Sep 21, 2026

github/workflows: fix zizmor 'secrets' syntax

c7d6e50

Secrets unconditionally inherited by called workflow: this reusable workflow Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>

Jose Quaresma (quaresmajose) force-pushed the zizmor branch from 4c4d3e5 to c7d6e50 Compare September 21, 2026 19:20

Ricardo Salveti (ricardosalveti) approved these changes Sep 22, 2026

View reviewed changes

Koen Kooi (koenkooi) approved these changes Sep 22, 2026

View reviewed changes

Ricardo Salveti (ricardosalveti) merged commit 1d8048f into qualcomm-linux:master Sep 22, 2026
412 of 416 checks passed

Jose Quaresma (quaresmajose) deleted the zizmor branch September 23, 2026 13:46

Ricardo Salveti (ricardosalveti) mentioned this pull request Sep 29, 2026

[Backport wrynose] ci: make the shared FSx build cache robust under parallel jobs #3263

Open

Conversation

Jose Quaresma (quaresmajose) commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jose Quaresma (quaresmajose) commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test run workflow

Test jobs for commit c7d6e50

Uh oh!

test-reporting-app Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

Ricardo Salveti (ricardosalveti) commented Sep 16, 2026

Uh oh!

Jose Quaresma (quaresmajose) commented Sep 16, 2026

Uh oh!

Jose Quaresma (quaresmajose) commented Sep 16, 2026

Uh oh!

Ricardo Salveti (ricardosalveti) commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qcomlnxci commented Sep 20, 2026

Test Coral run workflow

Test jobs for commit 32a3010

Uh oh!

Jose Quaresma (quaresmajose) commented Sep 21, 2026

Uh oh!

Ricardo Salveti (ricardosalveti) commented Sep 21, 2026

Uh oh!

qcomlnxci commented Sep 21, 2026

Test Coral run workflow

Test jobs for commit 4c4d3e5

Uh oh!

Ricardo Salveti (ricardosalveti) commented Sep 22, 2026

Uh oh!

qcomlnxci commented Sep 22, 2026

Test Coral run workflow

Test jobs for commit c7d6e50

Uh oh!

Ricardo Salveti (ricardosalveti) commented Sep 22, 2026

Uh oh!

Uh oh!

Ricardo Salveti (ricardosalveti) commented Sep 22, 2026

Uh oh!

Jose Quaresma (quaresmajose) commented Sep 23, 2026

Uh oh!

Jose Quaresma (quaresmajose) commented Sep 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Jose Quaresma (quaresmajose) commented Sep 16, 2026 •

edited

Loading

github-actions Bot commented Sep 16, 2026 •

edited

Loading

Test jobs for commit `c7d6e50`

test-reporting-app Bot commented Sep 16, 2026 •

edited

Loading

Ricardo Salveti (ricardosalveti) commented Sep 16, 2026 •

edited

Loading

Test jobs for commit `32a3010`

Test jobs for commit `4c4d3e5`

Test jobs for commit `c7d6e50`