59 lines
No EOL
2.4 KiB
Markdown
59 lines
No EOL
2.4 KiB
Markdown
# GitHub actions at Flutter
|
|
|
|
Action workflows can be enabled by writing a yaml file inside .github/workflows
|
|
folder of a given repository. These workflows run arbitrary code from GitHub
|
|
repositories and with read/write permissions in the repository assets. This can
|
|
be dangerous as anyone with write permissions to the repository can enable
|
|
workflows using malicious code. To mitigate this only workflows with pinned
|
|
commits within an allowed list can be executed.
|
|
|
|
Flutter repositories have workflows enabled with readonly ACLs by default. The
|
|
ACLs can be overwritten providing specific permissions in the configuration
|
|
file.
|
|
|
|
Determining whether a given workflow is secure or not goes well beyond flutter's
|
|
capacity and it is the responsibility of the person enabling the workflow to
|
|
diligently check the workflow for any potential security issues.
|
|
|
|
## Adding a new GitHub Actions workflow
|
|
|
|
To add a new workflow please open a new bug using the [ticket queue process](Infra-Ticket-Queue.md). The following data points are required:
|
|
|
|
* Description/reason to enable this workflow
|
|
* workflow repository
|
|
* pinned commit
|
|
|
|
## Updating a GitHub Actions workflow
|
|
|
|
To update an existing workflow please open a new bug using the [ticket queue process](Infra-Ticket-Queue.md). The following data points are required:
|
|
|
|
* Description/reason to update the pinned version
|
|
* workflow/old_pinned_version
|
|
* workflow/new_pinned_version
|
|
|
|
## flutter/engine and flutter/flutter
|
|
|
|
***flutter/engine*** please do not add any action workflows to this repository.
|
|
The preferred way of building and testing is to use LUCI. This allows to plan
|
|
for scalability, security and maintainability.
|
|
|
|
***flutter/flutter*** the main use of workflows in this repo is to process bugs,
|
|
projects, etc. Please do not use action workflows to build, run tests or release
|
|
artifacts.
|
|
|
|
## Checklist
|
|
|
|
New workflow:
|
|
|
|
* Does it have an associated bug?
|
|
* Was the workflow/commit added to the allow list? Is the workflow pinned to a
|
|
given commit?
|
|
* If the workflow require write access, is it overriding the ACLs explicitly?
|
|
* If the target repository has branch protection, is the configuration using
|
|
***secrets.FLUTTERGITHUBBOT_TOKEN*** instead of the default one?
|
|
* Is the workflow configured to not run on forks?
|
|
|
|
Update workflow:
|
|
|
|
* Does it have an associated bug?
|
|
* Was the workflow with old and new commits added to the allowed list? |