Azure / Azure/azure-functions-host
Builds: How should builds from forks work?
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
In opening a few PRs yesterday (#7917, #7919, #7920) , we noticed that PR builds weren't allowed from forks at all. I have permissions so we tried `/azp run` but building from forks was not allowed. This is allowed in the WebJobs SDK repo but not in the Host.
There are 2 issues:
1. Builds are not allowed on forks at all.
2. If they are allowed, even with the `full-ci` label, secrets aren't allowed to the forks.
Overall, this means external contributors aren't able to file PRs that we're able to run checks on. Creating this issue to find a best path on resolving this (I'm happy to help chase this down).
cc @liliankasem @brettsam @fabiocav
Contributor guide
Research direction
Compare the fork-PR behavior with the WebJobs SDK repository, starting with the `/azp run` entry point, the `full-ci` label, and the handling of secrets for forks. Done means external contributors' pull requests can run checks while repository secrets remain protected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100