feat: restrict who can trigger mirror and release builds (#139)

* feat: restrict mirror and release actions to valid users * refactor: remove superfluous defaults
mage-os · Oct 5, 2023 · 07f1acb · 07f1acb
1 parent a293d6e
commit 07f1acb
Show file tree

Hide file tree

Showing 7 changed files with 10 additions and 13 deletions.
diff --git a/.github/workflows/build-mageos-nightly.yml b/.github/workflows/build-mageos-nightly.yml
@@ -1,4 +1,4 @@
-name: Build & check Mage-OS Nightly
+name: Build, deploy & check Mage-OS Nightly
 
 on:
   schedule:

diff --git a/.github/workflows/build-mageos-release.yml b/.github/workflows/build-mageos-release.yml
@@ -34,14 +34,11 @@ on:
         default: false
         type: boolean
 
-  push:
-    branches:
-    - main
-
 jobs:
   deploy:
     uses: ./.github/workflows/deploy.yml
     name: "generate & deploy"
+    if: contains('["vinai","mage-os-ci"]', github.actor)
     with:
       repo: ${{ inputs.repo }}
       remote_dir: ${{ inputs.remote_dir }}

diff --git a/.github/workflows/build-preview-mirror.yml → .github/workflows/build-upstream-mirror.yml b/.github/workflows/build-preview-mirror.yml → .github/workflows/build-upstream-mirror.yml
@@ -27,9 +27,10 @@ jobs:
   deploy:
     uses: ./.github/workflows/deploy.yml
     name: "generate & deploy"
+    if: contains('["vinai","mage-os-ci"]', github.actor)
     with:
-      repo: ${{ inputs.repo || 'https://preview-mirror.mage-os.org' }}
-      remote_dir: ${{ inputs.remote_dir || '/var/www/preview-mirror.mage-os.org/html/' }}
+      repo: ${{ inputs.repo }}
+      remote_dir: ${{ inputs.remote_dir }}
       entrypoint: src/make/mirror.js
       delete: true
     secrets:
@@ -39,6 +40,6 @@ jobs:
     needs: [deploy]
     uses: ./.github/workflows/integrity-check.yml
     with:
-      repo: ${{ inputs.repo || 'https://preview-mirror.mage-os.org/' }}
+      repo: ${{ inputs.repo }}
     secrets:
       composer_auth: ${{ secrets.composer_auth }}
diff --git a/.github/workflows/build-upstream-nightly.yml b/.github/workflows/build-upstream-nightly.yml
@@ -1,4 +1,4 @@
-name: Build & check Upstream Nightly
+name: Build, deploy & check Upstream Nightly
 
 on:
   schedule:

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-name: Build & deploy given Mage-OS composer repo
+name: "[workflow call] Build & deploy given Mage-OS composer repo"
 
 on:
   workflow_call:
@@ -121,4 +121,3 @@ jobs:
         with:
           name: release-build-working-copies-${{ env.mageos_release }}
           path: release-build-working-copies-${{ env.mageos_release }}.tar
-
diff --git a/.github/workflows/integrity-check.yml b/.github/workflows/integrity-check.yml
@@ -1,4 +1,4 @@
-name: Check integrity of given Mirror repo
+name: "[workflow call] Check integrity of given mirror repo"
 
 on:
   workflow_call:

diff --git a/.github/workflows/push-release-tag.yml b/.github/workflows/push-release-tag.yml
@@ -1,4 +1,4 @@
-name: "Publish Mage-OS release tag to GIT repositories"
+name: "[workflow call] Publish Mage-OS release tag to git repositories"
 
 on:
   workflow_call: