I la matou pou muamua, na matou vaʻaia le auala e iloa ai ma puipuia ai mai le Poisoned Tuusaʻo Pipeline Fa'atinoina (D-PPE). Na matou va'aia fo'i le auala e iloa ai lena vaivaiga e fa'aaoga ai Xygeni Scanner, faapea foi ma nisi o auala e puipuia ai.
Faʻasalaina Pipeline Fa'asalaga (PPE) e gaosia pe a mafai e le tagata osofaʻi ona suia le pipeline lojika i se tasi o auala e lua:
- I le suia o le faila fa'atulagaina o le CI (le pipeline) -> PPE Tuusa'o (D-PPE)
- I le suia o faila o loʻo faʻasino i ai le pipeline (mo se faʻataʻitaʻiga: tusitusiga o loʻo faʻasino i ai mai totonu o le pipeline faila fa'atulagaina) -> PPE lē tuusa'o (I-PPE)
I lenei pou, o le a tatou suʻesuʻeina loloto le Indirect PPE. Ae, aʻo leʻi faia lena mea, ma o se faʻaopoopoga i laʻu pou muamua, seʻi o tatou vaʻai muamua pe faʻapefea ona pulea e le GitHub le faʻatinoina o pipelinema o a ni auala e puipuia ai fa'asaga i le D-PPE.
E faʻapefea ona puipuia e le GitHub le faʻatinoina o pipelinee sau mai PR?
E faʻapefea ona galue le GitHub e faʻatatau i le faʻatinoina o mea ua suia pipelines?
Suia pipelinee mafai ona sau mai le Pushes po'o le Pull Requests (PR). I le avea ai o se faiga sili ona lelei, e matua fautuaina lava e aloese mai soʻo se "tuleia" tuusaʻo i se lala puipuia ma faʻaaoga Pull Requests o se auala e faʻamalosia ai nisi o iloiloga aʻo leʻi taliaina soʻo se tulafono faʻatonutonu na tuʻufaʻatasia.
Pull Requests e mafai ona sau mai ni punaoa se lua eseese:
- PR e sau mai tui
- PR e sau mai lala
PR mai tui e mafai ona sau mai lautele or patino fale teu oloa.
A o tatou feagai ma le PPE (Poisoned Pipeline (Fa'atinoina), o la tatou manatu autū e lē o le "taliaina" o se PR ae o le fa'atinoina o se suiga ua fa'aleleia pipeline i le taimi o le faagasologa o le taliaina/faamaoniga a le PR. I le totonugalemu o se osofaiga a le PPE, o loʻo i ai se faʻatinoina e leʻi mafaufauina o se "mea leaga" ua suia pipeline.
I ni nai upu, Fa'a'ona Pipeline E gaosia le Fa'atinoina (PPE) pe a e mafai e le tagata osofaʻi ona suia le pipeline losika.
E lua eseesega:
- PPE tuusa'o (D-PPE): I se tulaga o le D-PPE, Ua suia e le tagata osofaʻi le faila faʻatulagaina o le CI i totonu o se fale teu oloa latou te maua le avanoa i ai, e ala i le tuleia sa'o o le suiga i se lala mamao e le'i puipuia i luga o le repo, pe ala i le tu'uina atu o se PR fa'atasi ai ma le suiga mai se lala po'o se tui. Talu mai le CI pipeline O le faʻatinoga e faʻamatalaina e poloaiga i le faila faʻatulagaina CI ua suia, o poloaiga leaga a le tagata osofaʻi e iu lava ina tamoʻe i le node build pe a uma le build pipeline ua faaoso.
- PPE lē tuusa'o (I-PPE): I nisi tulaga, o le avanoa o le D-PPE e le avanoa i se fili e iai le avanoa i se SCM fale teu oloa (e pei o le pipeline ua fa'atulagaina e toso mai le faila fa'atulagaina CI mai se lala ese'ese ma puipuia i totonu o le fale teuoloa lava e tasi). I se tulaga faapena, nai lo le faʻaonaina o le pipeline lava ia, e fa'aofi e se tagata osofa'i le code leaga i totonu o faila o lo'o fa'asino i ai le pipeline (mo se faʻataʻitaʻiga: tusitusiga o loʻo faʻasino i ai mai totonu o le pipeline faila fa'atulagaina)
I tulaga uma e lua, O le a fa'atino e GitHub le fa'asa'oga ua suia pipeline e aunoa ma se manaʻomia o se iloiloga muamua poʻo se faʻamaoniga.
PR mai forks i luga lautele malolo
E mafai e le GitHub ona faʻatulagaina le amio pe a faʻagasoloina PR e sau mai forks i repo lautele.
A sau se PR mai se fork, e faʻamalosia e le GitHub sina tulaga o le "faʻamaoniga" aʻo leʻi faʻatinoina le pipeline e fesoʻotaʻi ma le PRO lenei tulaga o le faamaoniga e fesuia'i mai se faamaoniga vaivai i se faamaoniga maumaututu.
At Tulaga fa'alapotopotoga (Org>>Settings>>Gaioiga>>Lautele), e mafai ona e filifili mai ni nai filifiliga "fa'amaoniga":
O le mea e sili ona faigata o le mea mulimuli lea (“Mana'omia le fa'amaoniga mai tagata faigaluega uma mai fafo"") auā o le a manaʻomia pea e le GitHub le faʻamaoniga pe a sau le PR mai ni forks mai ni paʻaga mai fafo.
Ae e oʻo lava i lenei tulaga faigata, e iai eseesega i le va o tagata galulue fa'atasi ma fa'atagaga faitau ma tusi.
- A sau le PR mai se faitau tagata faʻaoga, le faʻatinoina o le pipeline ua TAOFI se'ia o'o ina iai se fa'amaoniga o suiga. Afai e lelei le fa'amaoniga, ona fa'atulaga lea o le suiga pipeline ua fasiotia.
- A sau le PR mai se tusi tagata faʻaoga, le e le manaʻomia le faʻamaoniga ma le suiga ua faia pipeline e fa'atinoina i taimi uma lava!!
O le fa'ai'uga, o PR e sau mai forks i luga o fale teuoloa faitele e puipuia māmā mai PPE. E iai sina puipuiga mai tagata fa'aoga mai fafo (faitau), ae leai se mea e feso'ota'i ma tagata fa'aoga i totonu (tusitusi).
Ae a le PR e sau mai forks mai private repos?
PR mai forks i luga patino malolo
I lenei tulaga, ua saunia e GitHub ni faʻatulagaga faʻatulagaina aoga.
E mafai ona fa'atulagaina fa'atulagaga o lo'o i luga i le Totoga poʻo i repo Laʻasaga.
a e leai se filifiliga ua siakiina, o le a faia e GitHub fesili mo se faamaoniga ma o le a le faʻatinoina le suiga ua faʻaleleia pipeline. O le fa'atulagaga sili lea ona saogalemu!!
le fa'atulagaga e sili ona le saogalemu o afea "Fa'atino galuega mai le fork pull request"ua siakiina. I lenei tulaga, e tutusa lava mo tagata e faitau ma tusitusi, o le a otometi lava ona faʻatinoina e Github le mea ua suia pipeline!! Ma e mafai ona tutusa lenei tulaga leaga afai "Auina atu fa'ailoga tusitusi i ala o galuega mai le fork pull requests"Ma le"Auina atu mea lilo ma fesuia'iga i ala o galuega mai le fork pull requests"ua siakiina. Aua le faia lenei mea se'i vagana ua manino lelei lona tauamiotonuina!!
Afai "Mana'omia le fa'amaoniga mo le tui pull request workflows"a siakiina, ua fa'aleleia atili le tulaga o lo'o i luga: O le a talosagaina e le GitHub se fa'atagaga ma o le a le fa'atinoina le suiga ua fa'asa'oina pipeline mo le tagata faʻaoga faitau, ae o le a faʻatinoina pea mo se tagata faʻaoga tusitusi.
Ua vaaia ni tui, ae fa'apefea? PR e sau mai lala?
PR mai lala
Mo le puipuia o lenei tulaga e tatau ona e faʻalagolago i ai Tulafono Puipuiga o Lālā.
I le tulaga o le repo, e mafai ona e fatuina ni tulafono puipuia o lala mo soʻo se lala. O nei tulafono e faʻaopoopoina ai nisi tapula'a i le suiga o lala puipuia.
E ui lava ina e fa'atulagaina se tulafono i le "Manaomia a pull request a'o le'i tu'ufa'atasia"Ma le"Manaʻomia faʻatagaga" le ua suia pipeline o le a otometi lava ona fa'atinoina pe a faia le PRO le "fa'amaoniga" o le a na'o le gaioiga o le tu'ufa'atasia e fa'aoga ai.
Ae fa'apefea le Indirect Poisoned Pipeline faatinoga
E pei ona tatou vaʻaia i luga, e mafai ona faʻaitiitia le D-PPE e ala i le faʻaaogaina talosaga_toso_taumafaiga, ae e leai e le fa'atatau i le I-PPE.
Afai e te faʻaaogaina le pull_request_target, o le siaki masani o le a avea ma code autu. Ae afai e te manaʻo e faʻamaonia nisi siaki i luga o le code na tuʻuina atu (PR code) e tatau ona e siaki manino le PR code. O le mea lea, afai ua suia e le PR code soʻo se shell script na faʻaaogaina e le pipeline, le “nofoaga autu” (saogalemu) pipeline o le a vala'auina le tusitusiga o le atigi "ua suia" → PPE lē tuusa'o!!
O le fofo i lenei mea e fai si faigata (e leai se fofo fa'ataulaitu e pei o le pull_request_target).
O lo tatou pipeline ua saogalemu nei mo le D-PPE auā o loʻo matou faʻaaogaina le pull_request_target. Ae o loʻo vaivai pea i le I-PPE.
I la tatou faʻataʻitaʻiga o suʻega, e manaʻomia ona tatou siakiina le tulafono PR i le faiga o le fausiaina, ae o suʻega e faʻatinoina i luga o le mea na gaosia e le fausiaina.
Ia .. Aiseā e te lē siaki ai uma fa'amaumauga uma e lua?
- Siaki le PR code auā o le code na saofagā mai o le mea lea tatou te mananaʻo e fausia ma faʻataʻitaʻi
- Siaki le code autu e fa'agaoioi ai le lomiga muamua o le pipeline ma tusitusiga fau/suega
Atonu e faia lenei mea e siakiina o na fa'avae tulafono i faila eseese: atonu e siakiina le code autu i le faila autu, ma le PR i se isi faila. I lenei tulaga o le a tatou faatinoina le fausiaina ma le tusitusiga suega mai le faila autu e faasaga i le code ua tuuina i totonu o le faila fou.
O se tali faigofie lenei, ioe!! Ae, mo le faʻamoemoega o le aʻoaʻoina ou te fia faʻalauiloa atu se fesuiaiga manaia tele (...)
GitHub workflow_run mea na tupu
E le gata i talosaga_toso_taumafaiga, ua saunia e GitHub se isi mea e fa'aosofia ai: workflow_run. O lenei mea na tupu e mafai ai fa'atinoina o se pipeline fa'atulagaina i se isi pipelinele faasalaga oti.
workflow_run ma talosaga_toso_taumafaiga e tutusa lava mea e fa'agaoioia i le tasi itu: o le a fa'atinoina uma i le faiga fa'apitoa ma, e ui i suiga o le PR, o le faavae pipeline o le a fasiotia!!
Se'i o tatou va'ai i lo tatou tulaga i le taimi nei pipeline:
name: PR TARGET CI
on:
pull_request_target:
branches: [ main ]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
jobs:
prt_build_test_and_merge:
runs-on: ubuntu-latest
steps:
# checkout PR code
- name: Checkout repository
uses: actions/checkout@v4
with:
# This is to get the PR code instead of the repo code
ref: ${{ github.event.pull_request.head.sha }}
# Simulation of a compilation
- name: Building ...
run: |
mkdir ./bin
touch ./bin/mybin.exe
ls -lR
# Simulation of running tests
- name: Running tests ...
id : run_tests
run: |
echo Running tests..
chmod +x runtests.sh
./runtests.sh
echo Tests executed.
#
# Let’s omit the check conditions at this moment …
#
- name: pr_check_conditions_to_merge
[...]
E saogalemu le vaega na fausia ai mo le D-PPE, ae o le vaega na faia ai le suega e vaivai lava i le I-PPE.
le pipeline e saogalemu lava ia i le D-PPE ona o le talosaga_toso_taumafaiga fa'aosofia. Ae o le la'asaga o le su'ega e vaivai pea i le I-PPE ona o le fa'aaogaina o se tusitusiga o le atigi fafo.
Aloese mai le I-PPE
O le fa'amoemoega o mea o lo'o i luga pipeline o le fausiaina ma le fa'ata'ita'iina lea o le tulafono na tu'ufa'atasia, ina ia saogalemu mo PPE.
Ia .. Aiseā e lē vaevaeina ai pipeline i ni lua? Tasi mo le fausiaina ma le isi mo le fa'ata'ita'iga..
- O le 1st pipeline (Fausia CI) faia siaki le PR code (e fausia ai), fai le fauga ma fatuina se mea faitino.
- Le lona 2 pipeline (Su'ega CI) faia siaki le Base code (e aloese ai mai le suia o le shell script) ma faʻatino ia tusitusiga muamua e faʻasaga i le mea na tupu.
- Ina ia fa'afetaui le Test CI pipeline e tamoe pe a mae'a le Build CI pipeline, o le a matou faʻaaogaina le workflow_run faʻaoso
I lenei auala:
- pipeline Fausia CI is sao i mea uma e lua D-PPE (talu ai le talosaga_toso_taumafaiga) ma I-PPE (auā ua le toe faʻatinoina le tusitusiga o le atigi).
- pipeline Su'ega CI foi o sao i mea uma e lua D-PPE (talu ai le workflow_run) ma I-PPE (auā e siaki ai le code autu e maua ai le uluai tusitusiga o le atigi)
Se'i o tatou va'ai i le code o ia mea uma e lua pipelinee tusa ai ma nei suiga …
1st pipeline (Fausia CI):
name: Build CI
on:
pull_request_target:
branches: [ main ]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
GITHUB_PAT: ${{ secrets.GH_PAT }}
jobs:
prt_build_and_upload:
runs-on: ubuntu-latest
steps:
- name: Checking out PR code
uses: actions/checkout@v4
if: ${{ github.event_name == 'pull_request_target' }}
with:
# This is to get the PR code instead of the repo code
ref: ${{ github.event.pull_request.head.sha }}
- name: Building ...
run: |
mkdir ./bin
touch ./bin/mybin.exe
# Save some PR info for later use by the 2nd pipeline
echo "${{github.event.pull_request.title}}" > ./bin/PR_TITLE.txt
echo "${{github.event.number}}" > ./bin/PR_ID.txt
# Upload the binary as a pipeline artifact
- name: Archive building artifacts
uses: actions/upload-artifact@v3
with:
name: archive-bin
path: |
bin
2nd pipeline (Su'ega CI):
ame: Test CI
on:
workflow_run:
workflows: [ 'PR TARGET CI' ]
types: [completed]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
GITHUB_PAT: ${{ secrets.GH_PAT }}
jobs:
deploy:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.conclusion == 'success' }}
steps:
# By default, checks out base code (not PR code)
- name: Checkout repository
uses: actions/checkout@v4
# Download the artifact
- name: 'Download artifact'
uses: actions/github-script@v6
with:
script: |
let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: context.payload.workflow_run.id,
});
let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
return artifact.name == "archive-bin"
})[0];
let download = await github.rest.actions.downloadArtifact({
owner: context.repo.owner,
repo: context.repo.repo,
artifact_id: matchArtifact.id,
archive_format: 'zip',
});
let fs = require('fs');
fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/myartifact.zip`, Buffer.from(download.data));
# Unzip the artifact
- name: 'Unzip artifact'
run: |
unzip -o myartifact.zip
# Runs tests
- name: Running tests ...
id : run_tests
run: |
echo Running tests..
chmod +x runtests.sh
./runtests.sh
echo Tests executed.
#
# Let’s omit the check conditions at this moment …
#
- name: pr_check_conditions_to_merge
[...]
Oi… fofo lelei!! Ae ….. Ua tatou saogalemu ea? Ou te fefe ne’i leai 😭
E moni, ua matou faʻalauiloaina se vaivaiga fou!! O fea? O le a avea lea ma autu o la matou pou e sosoo ai 🙂 … Ia faʻatali pea!!
PS: Fa'amolemole, e le mafai ona ou filemu 🤐 ..Ua e fa'alogo ea i ai Fa'a'ona o Mea Fa'alenatura ? 😂
