CI: gate nightly/release publishing on successful builds#8464
CI: gate nightly/release publishing on successful builds#8464
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| needs: | ||
| [ | ||
| set-nightly-metadata, | ||
| build-macos, | ||
| build-windows, | ||
| build-linux, | ||
| build-android, | ||
| build-ios, | ||
| publish, | ||
| ] | ||
| if: | | ||
| always() && | ||
| !cancelled() && | ||
| github.event.inputs.dry_run != 'true' && | ||
| ( | ||
| needs.build-macos.result == 'failure' || | ||
| needs.build-windows.result == 'failure' || | ||
| needs.build-linux.result == 'failure' || | ||
| needs.build-android.result == 'failure' || | ||
| needs.build-ios.result == 'failure' || | ||
| needs.publish.result == 'failure' | ||
| ) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Cleanup Failed GitHub Pre-Release | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| VERSION: ${{ needs.set-nightly-metadata.outputs.version }} | ||
| run: | | ||
| set -euxo pipefail | ||
| # Delete if it exists | ||
| gh release delete "$VERSION" --cleanup-tag || true |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
In general, the fix is to define an explicit permissions: block in the workflow, specifying the minimal scopes required. You can do this either at the workflow root (so it applies to all jobs) or per job. Since the CodeQL warning is about the workflow not limiting GITHUB_TOKEN, the most straightforward fix is to add a root‑level permissions: block with contents: read as a safe baseline, and then selectively elevate permissions for jobs that must modify releases or other resources.
For this specific file, the cleanup job uses gh release delete, which requires write access to repository contents. At minimum, that job needs contents: write. Other jobs like publish are likely also creating or updating releases or assets, but since their internals are not shown and the CodeQL report is specifically pointing at the workflow lacking any permissions: block, we can provide a minimal, non‑breaking fix by: (1) adding a workflow‑level permissions: contents: read immediately after the name: Nightly line, and (2) adding a job‑level permissions: block to the cleanup job specifying contents: write. This keeps the default for all jobs read‑only while granting write rights only where clearly needed, without altering the jobs’ logic.
Concretely:
-
Edit
.github/workflows/nightly.yml. -
After line 1 (
name: Nightly), insert:permissions: contents: read
-
In the
cleanupjob definition (around lines 374–399), add:permissions: contents: write
just before
runs-on: ubuntu-latest. This ensures that only thecleanupjob has write permissions needed forgh release delete, while other jobs run with read‑only contents permissions by default.
No additional imports or external dependencies are required; this is purely a YAML configuration change.
| @@ -1,4 +1,6 @@ | ||
| name: Nightly | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| schedule: | ||
| @@ -394,6 +396,8 @@ | ||
| needs.build-ios.result == 'failure' || needs.build-ios.result == 'cancelled' || | ||
| needs.publish.result == 'failure' || needs.publish.result == 'cancelled' | ||
| ) | ||
| permissions: | ||
| contents: write | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
Pull request overview
Updates the release and nightly GitHub Actions workflows to prevent publishing and store uploads from running when upstream build jobs fail, addressing cases where if: always() previously allowed artifact publication despite failed builds.
Changes:
- Gate
publishjobs in bothrelease.ymlandnightly.ymlon upstream job results beingsuccessorskipped(and not cancelled). - Reorder app store upload jobs in
release.ymlto depend on a successfulpublish. - Replace an inline “cleanup failed pre-release” step in
nightly.ymlwith a dedicatedcleanupjob that runs after failures.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/release.yml | Prevent publishing/app store uploads unless metadata + relevant builds complete successfully (or are skipped). |
| .github/workflows/nightly.yml | Prevent nightly publish on failed builds and move GitHub release cleanup into a dedicated post-failure job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Hey @atavism, I'm sorry I didn't mention this sooner, but I saw the same problem, and decided that having separate release.yaml and nightly.yaml was making for some duplicated and convoluted logic, and I've rewritten this to just use one release file (and extracted some inline code out into scripts).
I'm happy to do whatever you prefer here:
- close this and only merge mine, or
- merge yours first, then'll I'll rebase mine on the changes and deal with the conflict
@atavism #8455 does already have cleanup on failure that does the same thing. The only part of this PR not already covered there are the Google Play changes you added. |
2 participants
This PR fixes a CI issue where nightly and release workflows could still publish artifacts even when build jobs fail (due to
if: always()on publish and app store uploads not being gated on overall success)