A cikin rubutunmu na baya, mun ga yadda ake ganowa da kuma kariya daga guba kai tsaye Pipeline Zartarwa (D-PPE). Mun kuma ga yadda za a gano wannan rauni ta amfani da Na'urar Duba Xygeni, da kuma wasu hanyoyin kariya.
Guba Pipeline Kisa (PPE) ana samar da shi ne lokacin da maharin zai iya gyara pipeline dabaru ta hanyoyi biyu:
- Ta hanyar canza fayil ɗin CI (wanda pipeline) -> PPE kai tsaye (D-PPE)
- Ta hanyar canza fayilolin da aka ambata ta hanyar pipeline (misali: rubutun da aka ambata daga cikin pipeline fayil ɗin sanyi) -> PPE mara kai tsaye (I-PPE)
A cikin wannan rubutun, za mu zurfafa cikin zurfafa cikin tsarin kariya ta kai tsaye (Indirect PPE). Amma, kafin hakan, kuma a matsayin ƙarin bayani ga rubutuna na baya, bari mu fara ganin yadda GitHub ke sarrafa aiwatar da pipelines da kuma menene hanyoyin kariya daga D-PPE.
Ta yaya GitHub ke kare aiwatar da pipelineyana fitowa daga PRs?
Ta yaya GitHub ke aiki game da aiwatar da gyare-gyare pipelines?
Gyara pipelines na iya fitowa daga Turawa ko Pull Requests (PR). A matsayin babban mafi kyawun aiki, ana ba da shawarar a guji duk wani "tura" kai tsaye zuwa wani reshe mai kariya da amfani da shi. Pull Requests a matsayin wata hanya ta tilasta yin bita kafin karɓar kowace lambar da aka bayar.
Pull Requests Zai iya zuwa daga hanyoyi daban-daban guda biyu:
- PRs suna fitowa daga kaya
- PRs suna fitowa daga rassan
PRs daga kaya zai iya zuwa ko dai daga jama'a or masu zaman kansu ajiya.
Yayin da muke mu'amala da PPE (Guba) Pipeline Aiwatarwa), babban abin da muke nufi ba shine "karɓar" hulɗar jama'a ba amma aiwatar da wani gyara pipeline a lokacin karɓar/amincewa da PR. A tsakiyar harin PPE, akwai aiwatar da wani "mummunan" da aka gyara ba tare da niyya ba pipeline.
A cikin 'yan kalmomi kaɗan, An guba Pipeline Ana aiwatar da aiwatarwa (PPE) lokacin da maharin zai iya canza yanayin pipeline dabaru.
Akwai biyu bambance-bambancen karatu:
- PPE kai tsaye (D-PPE): A cikin yanayin D-PPE, maharin yana canza fayil ɗin saitin CI a cikin ma'ajiyar ajiya suna da damar shiga, ko dai ta hanyar tura canjin kai tsaye zuwa wani reshe mai nisa wanda ba shi da kariya a kan ma'ajiyar, ko kuma ta hanyar aika PR tare da canjin daga reshe ko cokali mai yatsu. Tun daga CI pipeline Ana bayyana aiwatarwa ta hanyar umarni a cikin fayil ɗin CI da aka gyara, umarnin mugunta na maharin a ƙarshe suna gudana a cikin ma'aunin gini da zarar ginin ya fara. pipeline an kunna shi.
- PPE na kai tsaye (I-PPE): A wasu lokuta, yiwuwar D-PPE ba ta samuwa ga abokin gaba mai damar shiga SCM ma'ajiyar bayanai (misali idan pipeline an tsara shi don cire fayil ɗin daidaitawar CI daga wani reshe daban, mai kariya a cikin ma'ajiyar iri ɗaya). A irin wannan yanayi, maimakon guba pipeline da kansa, wani mahari yana saka lambar mugunta a cikin fayilolin da aka ambata pipeline (misali: rubutun da aka ambata daga cikin pipeline fayil ɗin sanyi)
A dukkan bangarorin, GitHub zai aiwatar da gyare-gyaren da aka gyara pipeline ba tare da buƙatar sake dubawa ko amincewa a baya ba.
PRs daga forks jama'a sauran
GitHub yana ba da damar daidaita halayen lokacin sarrafawa PRs suna fitowa daga forks a cikin wuraren ajiyar jama'a.
Lokacin da hulɗar jama'a ta fito daga cokali mai yatsu, GitHub koyaushe yana tilasta wani matakin "amincewa" kafin aiwatar da shi. pipeline dangantaka da PRWannan matakin amincewa ya bambanta daga rauni zuwa amincewa mai tsauri.
At Matakin tsari (Org>>Saituna>>Ayyuka>>Gabaɗaya), zaku iya zaɓar daga cikin zaɓuɓɓukan "amincewa" da yawa:
Mafi tsauri shine na ƙarshe (“)”Nemi amincewa daga duk masu haɗin gwiwa na waje") domin GitHub koyaushe zai buƙaci amincewa lokacin da hulɗar jama'a ta fito daga masu haɗin gwiwa na waje.
Amma ko da a cikin wannan mawuyacin hali, akwai bambance-bambance tsakanin masu haɗin gwiwa tare da izinin karatu da rubutu.
- Lokacin da PR ta fito daga wani karanta mai amfani, kisan Ubangiji pipeline an TSAYA har sai an sami amincewar canje-canje. Idan amincewar ta yi daidai, to an gyara ta pipeline aka zartar.
- Lokacin da PR ta fito daga wani rubuta mai amfani, Ba a buƙatar amincewa kuma an gyara shi pipeline ana aiwatar da shi koyaushe!!
A ƙarshe, kamfanonin sadarwa da ke fitowa daga forks a rumbunan ajiyar jama'a ba su da kariya daga PPE. Akwai wasu kariya daga masu amfani da waje (karantawa), amma babu wani abu da ya shafi masu amfani da ciki (rubutawa).
Me game da PRs suna fitowa daga forks daga wuraren ajiyar sirri?
PRs daga forks masu zaman kansu sauran
A cikin wannan yanayin, GitHub yana ba da wasu saitunan sanyi masu amfani.
Ana iya saita saitunan da ke sama ko dai a Gabar ko a repo matakin.
A lokacin da babu wani zaɓi da aka duba, GitHub zai nemi amincewa da kuma ba zai aiwatar da canje-canjen da aka yi ba pipelineWannan shine mafi aminci tsari!!
The mafi rashin aminci tsarin shine lokacin da "Shigar da tsarin aiki daga maɓalli pull request"an duba"A wannan yanayin, iri ɗaya ne ga masu amfani da rubutu da karatu, Github zai aiwatar da gyare-gyaren ta atomatik. pipeline!! Kuma wannan yanayin zai iya zama daidai mafi muni idan"Aika alamun rubutu zuwa hanyoyin aiki daga fork pull requests"Da kuma"Aika sirri da masu canji zuwa hanyoyin aiki daga fork pull requests"an duba. Kada ku yi haka sai dai idan an tabbatar da hujja!!
Idan “Ana buƙatar amincewa don cokali mai yatsu pull request workflows"an duba, yanayin da ke sama ya ɗan inganta: GitHub zai nemi amincewa kuma ba zai aiwatar da gyare-gyaren ba pipeline ga mai karatu, amma har yanzu zai aiwatar da shi ga mai amfani da rubutu.
An ga cokali mai yatsu, me game da shi? PRs daga rassan?
PRs daga rassan
Don kare wannan yanayin dole ne ku dogara Dokokin Kare Reshe.
A matakin repo, zaku iya ƙirƙirar ƙa'idodin kariyar reshe ga kowane reshe. Waɗannan ƙa'idodi suna ƙara wasu ƙuntatawa ga gyaran rassan da aka kare.
Kodayake kun saita ƙa'ida don "Bukatar a pull request kafin haɗawa"Da kuma"Ana buƙatar amincewa", wanda aka gyara pipeline za a aiwatar da shi ta atomatik bayan ƙirƙirar PR"Yarda da" zai shafi aikin haɗakar ne kawai.
Me game da Indirect Poisoned Pipeline kisa
Kamar yadda muka gani a sama, ana iya rage D-PPE ta amfani da pull_request_target, amma shi bai shafi I-PPE ba.
Idan ka yi amfani da pull_request_target, rajistar da aka saba yi za ta zama lambar tushe. Amma idan kana son tabbatar da wasu bincike kan lambar da aka bayar (lambar PR) kana buƙatar duba lambar PR a sarari. Saboda haka, idan lambar PR ta gyara duk wani rubutun harsashi da aka yi amfani da shi ta hanyar da aka ambata. pipeline, "tushe" (amintacce) pipeline zai yi amfani da rubutun harsashi "wanda aka gyara" → PPE kai tsaye!!
Mafita ga wannan ya ɗan fi rikitarwa (babu wani sihiri kamar pull_request_target).
Mu pipeline yanzu yana da aminci ga D-PPE saboda muna amfani da pull_request_target. Amma har yanzu yana da rauni ga I-PPE.
A cikin misalin gwajinmu, muna buƙatar duba lambar PR don yin ginin, amma ana yin gwaje-gwajen akan kayan tarihi da ginin ya samar.
Don haka .. Me yasa ba za a duba duka lambobin biyu ba?
- Duba lambar PR domin ita ce lambar da aka bayar da gudummawa abin da muke son ginawa da gwadawa
- Lambar tushe don gudanar da sigar asali ta pipeline da kuma rubutun ginawa/gwaji
Ana iya yin hakan ta hanyar duba waɗannan tushen lambobin zuwa manyan fayiloli daban-daban: ana iya duba lambar tushe zuwa babban fayil ɗin tushe, da kuma PR zuwa wani babban fayil daban. A wannan yanayin za mu aiwatar da ginawa da rubutun gwaji daga babban fayil ɗin tushe akan lambar da aka sanya a cikin sabon babban fayil ɗin.
Wannan mafita ce mai sauƙi, ba shakka!! Amma, don dalilai na koyo ina so in gabatar da wani nau'in daban mai ban sha'awa (…)
GitHub gudanar da aiki abin da ke haifar da matsala
Bayan pull_request_target, GitHub yana ba da wani abin da ke haifar da matsala: gudanar da aikiWannan taron yana ba da damar aiwatar da wani pipeline an tsara shi ga wani pipelineaiwatar da shi.
gudanar da aiki da kuma pull_request_target abubuwan da ke haifar da matsala iri ɗaya ne a wani fanni: duka za a aiwatar da su a yanayin fifiko kuma, duk da gyare-gyaren PR, tushen pipeline za a kashe!!
Bari mu ga halin da muke ciki a yanzu pipeline:
name: PR TARGET CI
on:
pull_request_target:
branches: [ main ]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
jobs:
prt_build_test_and_merge:
runs-on: ubuntu-latest
steps:
# checkout PR code
- name: Checkout repository
uses: actions/checkout@v4
with:
# This is to get the PR code instead of the repo code
ref: ${{ github.event.pull_request.head.sha }}
# Simulation of a compilation
- name: Building ...
run: |
mkdir ./bin
touch ./bin/mybin.exe
ls -lR
# Simulation of running tests
- name: Running tests ...
id : run_tests
run: |
echo Running tests..
chmod +x runtests.sh
./runtests.sh
echo Tests executed.
#
# Let’s omit the check conditions at this moment …
#
- name: pr_check_conditions_to_merge
[...]
Sashen ginin yana da aminci ga D-PPE, amma sashen gwaji har yanzu yana da rauni ga I-PPE.
The pipeline kanta ba ta da haɗari ga D-PPE saboda pull_request_target abin da ke haifar da matsala. Amma matakin gwajin har yanzu yana da rauni ga I-PPE saboda kiran rubutun harsashi na waje.
Gujewa I-PPE
Manufar da ke sama pipeline shine ginawa da gwada lambar da aka bayar, kasancewa lafiya ga PPE.
Don haka .. Me yasa ba za a raba ba? pipeline cikin biyu? Ɗaya don gini ɗayan kuma don gwaji..
- Na farko pipeline (Gina CI) zai duba lambar PR (don gina shi), yi ginin kuma samar da wani kayan tarihi.
- Na biyu pipeline (Gwaji CI) zai duba lambar tushe (don guje wa gyaran rubutun harsashi) kuma aiwatar da rubutun asali akan kayan tarihi.
- Don daidaita gwajin CI pipeline don gudanar da BAYAN Gina CI pipeline, za mu yi amfani da gudanar da aiki jawo.
Ta wannan hanyar:
- pipeline Gina CI is lafiya ga duka D-PPE (saboda pull_request_target) da kuma I-PPE (domin ba ya aiwatar da rubutun harsashi).
- pipeline Gwaji CI ne kuma lafiya ga duka D-PPE (saboda gudanar da aiki) da kuma I-PPE (saboda yana duba lambar tushe don samun rubutun harsashi na asali)
Bari mu ga lambar duka biyun pipelinebisa ga waɗannan gyare-gyaren…
1st pipeline (Gina CI):
name: Build CI
on:
pull_request_target:
branches: [ main ]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
GITHUB_PAT: ${{ secrets.GH_PAT }}
jobs:
prt_build_and_upload:
runs-on: ubuntu-latest
steps:
- name: Checking out PR code
uses: actions/checkout@v4
if: ${{ github.event_name == 'pull_request_target' }}
with:
# This is to get the PR code instead of the repo code
ref: ${{ github.event.pull_request.head.sha }}
- name: Building ...
run: |
mkdir ./bin
touch ./bin/mybin.exe
# Save some PR info for later use by the 2nd pipeline
echo "${{github.event.pull_request.title}}" > ./bin/PR_TITLE.txt
echo "${{github.event.number}}" > ./bin/PR_ID.txt
# Upload the binary as a pipeline artifact
- name: Archive building artifacts
uses: actions/upload-artifact@v3
with:
name: archive-bin
path: |
bin
2nd pipeline (Gwajin CI):
ame: Test CI
on:
workflow_run:
workflows: [ 'PR TARGET CI' ]
types: [completed]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
GITHUB_PAT: ${{ secrets.GH_PAT }}
jobs:
deploy:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.conclusion == 'success' }}
steps:
# By default, checks out base code (not PR code)
- name: Checkout repository
uses: actions/checkout@v4
# Download the artifact
- name: 'Download artifact'
uses: actions/github-script@v6
with:
script: |
let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: context.payload.workflow_run.id,
});
let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
return artifact.name == "archive-bin"
})[0];
let download = await github.rest.actions.downloadArtifact({
owner: context.repo.owner,
repo: context.repo.repo,
artifact_id: matchArtifact.id,
archive_format: 'zip',
});
let fs = require('fs');
fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/myartifact.zip`, Buffer.from(download.data));
# Unzip the artifact
- name: 'Unzip artifact'
run: |
unzip -o myartifact.zip
# Runs tests
- name: Running tests ...
id : run_tests
run: |
echo Running tests..
chmod +x runtests.sh
./runtests.sh
echo Tests executed.
#
# Let’s omit the check conditions at this moment …
#
- name: pr_check_conditions_to_merge
[...]
Kai… mafita mai kyau!! Amma ….. Shin muna lafiya? Ina jin tsoron a'a 😭
Hakika, mun gabatar da wani sabon rauni!! Wanne? Wannan zai zama batun rubutunmu na gaba 🙂 … Ku kasance tare da mu!!
PS: Yi haƙuri, ba zan iya yin shiru ba 🤐 .. Kun ji labarin Guba ta Kayan Tarihi ? 😂
