From ba28010bc3ecaf7f1ce91c264698d111d540b46f Mon Sep 17 00:00:00 2001 From: burhankhanzada Date: Sat, 3 Oct 2026 10:55:21 +0200 Subject: [PATCH 1/2] Skip the secret-needing jobs on fork and Dependabot pull requests The repository is public now, so pull requests can come from forks, and those (like Dependabot's) get none of its secrets. CI's analysis, tests and builds load deploy keys for the private pdl and cdl packages, and the release trial also needs the signing keys; both would fail on the missing secrets rather than say why. analyze-and-test and the release workflow's version job now run only for pushes and same-repository pull requests; the jobs that need them skip with them. A fork-note job tells a fork's author why, and that the checks run once a maintainer takes the change in. workflow-lint and detect-native-changes, which need no secrets, still run for everyone. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ci.yml | 16 ++++++++++++++++ .github/workflows/release.yml | 3 +++ 2 files changed, 19 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 87b1f81..ec85796 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,8 +27,13 @@ permissions: # --web-renderer flag survived the 3.44 upgrade in some steps and not others. jobs: + # A pull request from a fork, or Dependabot's, gets none of this repository's + # secrets, and so cannot read the private format packages (pdl, cdl) that + # everything below builds against. Those skip here, and fork-note says + # why; build-web and build-desktop need this job, so they skip with it. analyze-and-test: name: Analyze & Test + if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') runs-on: ubuntu-latest timeout-minutes: 30 steps: @@ -189,6 +194,17 @@ jobs: # A malformed workflow fails the run in 0s with no usable error in the API — # `shell: ${{ matrix.shell }}` (expressions are not allowed there) cost a # push to discover. actionlint catches that class of mistake in ~2s. + fork-note: + name: Note for forks + if: github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]') + runs-on: ubuntu-latest + timeout-minutes: 2 + steps: + - run: >- + echo "::notice::Analysis, tests and builds need the private pdl and + cdl packages, which a pull request from a fork cannot read. They run + when a maintainer merges, or opens this branch here." + workflow-lint: name: Workflow Lint runs-on: ubuntu-latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9ab3759..233a971 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,8 +35,11 @@ permissions: contents: read jobs: + # The builds need the private format packages, and the release the signing + # keys: neither reaches a pull request from a fork or Dependabot. version: name: Version + if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') runs-on: ubuntu-latest outputs: name: ${{ steps.v.outputs.name }} From 1e98c273728cf4553ad8bb476bf06b5f5aeefdc6 Mon Sep 17 00:00:00 2001 From: burhankhanzada Date: Sat, 3 Oct 2026 11:13:47 +0200 Subject: [PATCH 2/2] Drop the deploy keys: pdl and cdl are public now Every job loaded read-only deploy keys for the two format repositories, private until now. They are public, and the app fetches them over https (the submodule URLs and the pub git URLs), so the keys are not needed: CI says to drop them once the repositories are public. Without them, a fork's or Dependabot's pull request can run the whole of CI, so analyze-and-test no longer skips those and fork-note goes. The release trial still runs only for same-repository pull requests: it needs the signing keys, and a macOS build is the dearest minute there is. The PDL_DEPLOY_KEY and CDL_DEPLOY_KEY secrets, and the deploy keys on the two repositories, can be deleted. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ci.yml | 58 ----------------------------------- .github/workflows/release.yml | 21 ++----------- 2 files changed, 2 insertions(+), 77 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec85796..977745b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,32 +27,13 @@ permissions: # --web-renderer flag survived the 3.44 upgrade in some steps and not others. jobs: - # A pull request from a fork, or Dependabot's, gets none of this repository's - # secrets, and so cannot read the private format packages (pdl, cdl) that - # everything below builds against. Those skip here, and fork-note says - # why; build-web and build-desktop need this job, so they skip with it. analyze-and-test: name: Analyze & Test - if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') runs-on: ubuntu-latest timeout-minutes: 30 steps: - uses: actions/checkout@v7 - # pinbench_pdl and pinbench_cdl are private, and so needed twice: as - # submodules, and as git dependencies that `flutter pub get` fetches. The - # default token reads neither. Each has a read-only deploy key, whose - # private half is a secret here; the key's comment names its repository, - # which is how the action rewrites that repository's https:// and git@ - # URLs to use it — for git and therefore for pub. Drop this once the two - # repositories are public. - - name: Load the deploy keys for the private format repositories - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - with: - ssh-private-key: | - ${{ secrets.PDL_DEPLOY_KEY }} - ${{ secrets.CDL_DEPLOY_KEY }} - - name: Fetch submodules run: git submodule update --init --recursive @@ -194,17 +175,6 @@ jobs: # A malformed workflow fails the run in 0s with no usable error in the API — # `shell: ${{ matrix.shell }}` (expressions are not allowed there) cost a # push to discover. actionlint catches that class of mistake in ~2s. - fork-note: - name: Note for forks - if: github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]') - runs-on: ubuntu-latest - timeout-minutes: 2 - steps: - - run: >- - echo "::notice::Analysis, tests and builds need the private pdl and - cdl packages, which a pull request from a fork cannot read. They run - when a maintainer merges, or opens this branch here." - workflow-lint: name: Workflow Lint runs-on: ubuntu-latest @@ -232,20 +202,6 @@ jobs: steps: - uses: actions/checkout@v7 - # pinbench_pdl and pinbench_cdl are private, and so needed twice: as - # submodules, and as git dependencies that `flutter pub get` fetches. The - # default token reads neither. Each has a read-only deploy key, whose - # private half is a secret here; the key's comment names its repository, - # which is how the action rewrites that repository's https:// and git@ - # URLs to use it — for git and therefore for pub. Drop this once the two - # repositories are public. - - name: Load the deploy keys for the private format repositories - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - with: - ssh-private-key: | - ${{ secrets.PDL_DEPLOY_KEY }} - ${{ secrets.CDL_DEPLOY_KEY }} - - name: Fetch submodules run: git submodule update --init --recursive @@ -353,20 +309,6 @@ jobs: steps: - uses: actions/checkout@v7 - # pinbench_pdl and pinbench_cdl are private, and so needed twice: as - # submodules, and as git dependencies that `flutter pub get` fetches. The - # default token reads neither. Each has a read-only deploy key, whose - # private half is a secret here; the key's comment names its repository, - # which is how the action rewrites that repository's https:// and git@ - # URLs to use it — for git and therefore for pub. Drop this once the two - # repositories are public. - - name: Load the deploy keys for the private format repositories - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - with: - ssh-private-key: | - ${{ secrets.PDL_DEPLOY_KEY }} - ${{ secrets.CDL_DEPLOY_KEY }} - - name: Fetch submodules run: git submodule update --init --recursive diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 233a971..52d89c7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,8 +35,8 @@ permissions: contents: read jobs: - # The builds need the private format packages, and the release the signing - # keys: neither reaches a pull request from a fork or Dependabot. + # A trial needs the signing keys, which a pull request from a fork or + # Dependabot does not get, and a macOS build is the dearest minute there is. version: name: Version if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') @@ -84,15 +84,6 @@ jobs: steps: - uses: actions/checkout@v7 - # The two format packages are private: submodules here, and git - # dependencies for pub. See ci.yml. - - name: Load the deploy keys for the private format repositories - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - with: - ssh-private-key: | - ${{ secrets.PDL_DEPLOY_KEY }} - ${{ secrets.CDL_DEPLOY_KEY }} - - name: Fetch submodules run: git submodule update --init --recursive @@ -225,14 +216,6 @@ jobs: steps: - uses: actions/checkout@v7 - # tools/release_metadata.dart needs the app's dependencies (crypto), - # which resolve through the private format packages. - - name: Load the deploy keys for the private format repositories - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - with: - ssh-private-key: | - ${{ secrets.PDL_DEPLOY_KEY }} - ${{ secrets.CDL_DEPLOY_KEY }} - run: git submodule update --init --recursive - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0 with: