From 724a062ecf86c798012d6456c68e8eb2a69eab6e Mon Sep 17 00:00:00 2001 From: jeremyhi Date: Tue, 22 Sep 2026 16:56:49 +0800 Subject: [PATCH] ci: pin full PR07 validation to reviewed source Signed-off-by: jeremyhi --- .github/workflows/integration.yml | 88 +++++++++++++++++++++++++++++++ .github/workflows/rust.yml | 68 +++++++++++++++++++++++- 2 files changed, 155 insertions(+), 1 deletion(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 2cbfa1e1541..2016215049a 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -49,6 +49,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -138,6 +146,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - if: matrix.mode.kafka name: Setup Kafka @@ -188,6 +204,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -265,6 +289,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 fetch-depth: 0 - name: Run compat updater unit tests run: python3 -m unittest discover -s .github/scripts/tests -p 'test_*.py' @@ -283,6 +315,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 fetch-depth: 0 - name: Download pre-built binaries uses: actions/download-artifact@v4 @@ -322,6 +362,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -453,6 +501,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - name: Download prebuilt fuzz binaries uses: actions/download-artifact@v4 with: @@ -515,6 +571,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - name: Download prebuilt fuzz binaries uses: actions/download-artifact@v4 with: @@ -576,6 +640,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -682,6 +754,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - name: Setup Kind uses: ./.github/actions/setup-kind - if: matrix.mode.minio @@ -916,6 +996,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - name: Setup Kind uses: ./.github/actions/setup-kind - name: Setup Chaos Mesh diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index b274931bc5b..93ef5d4a223 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -40,6 +40,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -58,6 +66,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -84,6 +100,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -111,6 +135,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -138,6 +170,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: ./.github/actions/setup-cyborg - uses: arduino/setup-protoc@v3 with: @@ -165,6 +205,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - name: Merge Conflict Finder uses: olivernybroe/action-conflict-finder@v4.0 @@ -177,6 +225,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -200,7 +256,9 @@ jobs: run: ../../.github/scripts/pull-test-deps-images.sh && docker compose up -d --wait - name: Run nextest cases - run: cargo nextest run --workspace -F dashboard -F pg_kvbackend -F mysql_kvbackend -F vector_index + run: | + echo 'features: dashboard,pg_kvbackend,mysql_kvbackend,vector_index' + cargo nextest run --workspace -F dashboard -F pg_kvbackend -F mysql_kvbackend -F vector_index env: CARGO_BUILD_RUSTFLAGS: "-C link-arg=-fuse-ld=mold" RUST_BACKTRACE: 1 @@ -233,6 +291,14 @@ jobs: - uses: actions/checkout@v4 with: persist-credentials: false + ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04 + - name: Record tested source and runner identity + shell: bash + run: | + git rev-parse HEAD + whoami + id + test "$(id -u)" -ne 0 - uses: arduino/setup-protoc@v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }}