CycodeLabs / CycodeLabs/raven

take care for action references that are submodules

Aperta
#39 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
downloader good first issue Low Priority
Lingua principale
Python
Stelle
747
Fork
45
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

When we try to resolve the actions, and when there are relative paths, we try to resolve these paths into absolute paths and download the referenced action.

Sometimes the resolved absolute path is referencing a submodule. We aren't aware of that, and try to download the file which means nothing.

A real-world example:
This is part of [ci.yml](https://github.com/apache/airflow/blob/main/.github/workflows/ci.yml) file for [apache/airflow](https://github.com/apache/airflow) repository:
```
- name: Configure AWS credentials
uses: ./.github/actions/configure-aws-credentials
if: >
github.ref == 'refs/heads/main' && github.repository == 'apache/airflow' &&
github.event_name == 'push'
```

the `configure-aws-credentials` is actually a submodule, so we are unable to find the `action.yml` file beneath it (even though he exists in the submodule)

This is how raven logs looks like:

```
[+] Found 6 workflows for apache/airflow
[+] Fetching build-images.yml
[+] Fetching ci.yml
[-] Couldn't download the action.yml for the dependent action referenced by './.github/actions/configure-aws-credentials' (Maybe runs a local action that was checked out previously? Maybe the action is executed through a Dockerfile?)
[-] Couldn't download the action.yml for the dependent action referenced by './.github/actions/github-push-action' (Maybe runs a local action that was checked out previously? Maybe the action is executed through a Dockerfile?)
```

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Usa l'esempio ci.yml indicato per tracciare la risoluzione del percorso relativo dell'azione, quindi esamina come viene scaricato action.yml quando il percorso punta a un sottomodulo Git. Il lavoro è completato quando le azioni locali ospitate nei sottomoduli vengono riconosciute e i relativi file action.yml vengono risolti senza l'errore di download segnalato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
git, github-actions, python
Ambito
devops, security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
45/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.