Skip to content

test: qualify external fork safety and portable fixture identities #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
soulbah merged 3 commits into from
Oct 2, 2026
Merged

test: qualify external fork safety and portable fixture identities #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9d03301
test: bind artifact and fixture provenance to actual consumer context
soulbah Oct 2, 2026
ea3d836
Merge pull request #1 from soulbah/chore/qualification-baseline
soulbah Oct 2, 2026
8af011a
docs: exercise external fork reporting with reduced permissions
soulbah Oct 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,7 @@ offline job. Its TLS key and raw input fixtures are never artifacts.

Review job permissions and artifact inventories before changing tests. Keep
one serialized root reporter per PR; no fork or privileged-target comment.

Fork qualification uses a pull request into the public upstream repository:
the integrated Action keeps its Form, reports, artifacts and Summary with the
fork's reduced token, while PR commenting is skipped.
2 changes: 1 addition & 1 deletion scripts/assert-output.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ assert.equal(outputs.version, '0.1.0-pr.117.1');
if (expectedCode !== undefined) assert.equal(outputs['exit-code'], expectedCode);
if (process.env.ROOTFORM_EXPECT_ARTIFACT === 'true') {
assert.match(outputs['artifact-id'], /^\d+$/);
assert.match(outputs['artifact-url'], /^https:\/\/github\.com\/rootform-dev\/action-qualification\/actions\/runs\/\d+\/artifacts\/\d+$/);
assert.equal(outputs['artifact-url'], `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}/artifacts/${outputs['artifact-id']}`);
}
if (process.env.ROOTFORM_PREVIOUS_FORM) {
assert.equal(outputs.form, process.env.ROOTFORM_PREVIOUS_FORM, 'saved Form path must be reused');
Expand Down
2 changes: 1 addition & 1 deletion scripts/prepare-registry.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ const home = join(root, 'selection-builder-home'); mkdirSync(home);
const project = 'external-project'; mkdirSync(project);
const layout = join(root, 'registry-layout');
const auth = { ROOTFORM_HOME: home, SSL_CERT_FILE: join(tls,'cert.pem') };
command('rootform',['package','policy-packs','fixtures/negative','--to',layout,'--source-url','https://github.com/rootform-dev/action-qualification','--revision',process.env.GITHUB_SHA,'--licenses','Apache-2.0'],auth);
command('rootform',['package','policy-packs','fixtures/negative','--to',layout,'--source-url',`${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}`,'--revision',process.env.GITHUB_SHA,'--licenses','Apache-2.0'],auth);
// Wait only for this owned registry's TLS readiness, with a bounded interval.
for (let attempt=0; attempt<20; attempt++) {
try { command('curl',['--fail','--silent','--cacert',join(tls,'cert.pem'),'https://localhost:5000/v2/']); break; }
Expand Down
Loading