Skip to content

Conversation

@kevinbackhouse
Copy link
Collaborator

Unfortunately, this seems to be the only solution. See #111 for my previous attempts.

Copilot AI review requested due to automatic review settings December 5, 2025 17:04
Copilot finished reviewing on behalf of kevinbackhouse December 5, 2025 17:05
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refactors the smoketest workflow by consolidating it from a two-job structure into a single job that checks the branch-deploy output on each subsequent step. This approach eliminates the need for job dependencies and output passing between jobs.

Key Changes:

  • Merged permission-check and run-tests jobs into a single Linux job
  • Added conditional checks on each step to verify branch-deploy continue output
  • Removed job-level needs and outputs configuration

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

python -m pip install hatch
- name: Run tests
- if steps.branch-deploy.outputs.continue == "true"
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The if conditional syntax is incorrect. In GitHub Actions, the if keyword should be followed by a colon : and the condition expression should reference the step output using ${{ }} syntax.

The correct syntax should be:

- if: steps.branch-deploy.outputs.continue == 'true'
  name: Run tests

Note the colon after if and the proper expression syntax with ${{ }}.

Copilot uses AI. Check for mistakes.
Comment on lines +50 to +57
- if: steps.branch-deploy.outputs.continue == "true"
name: Setup Python venv
run: |
python -m venv .venv
source .venv/bin/activate
python -m pip install hatch
- name: Run tests
- if: steps.branch-deploy.outputs.continue == "true"

Check failure

Code scanning / CodeQL

Untrusted Checkout TOCTOU Critical

Insufficient protection against execution of untrusted code on a privileged workflow (
issue_comment
).
Copilot AI review requested due to automatic review settings December 5, 2025 17:25
Copilot finished reviewing on behalf of kevinbackhouse December 5, 2025 17:27
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +51 to +52
- if: steps.branch-deploy.outputs.continue == "true"
name: Run tests
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The if conditional should be placed after the name field. Consider:

- name: Run tests
  if: steps.branch-deploy.outputs.continue == 'true'
  env:
    AI_API_TOKEN: ${{ secrets.AI_API_TOKEN }}
    GITHUB_AUTH_HEADER: "Bearer ${{ secrets.GITHUB_TOKEN }}"
  run: |
    ...

See below for a potential fix:

      - name: Setup Python
        if: steps.branch-deploy.outputs.continue == "true"
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Checkout the repo
        if: steps.branch-deploy.outputs.continue == "true"
        uses: actions/checkout@v6
        with:
          ref: ${{ steps.branch-deploy.outputs.sha }}

      - name: Setup Python venv
        if: steps.branch-deploy.outputs.continue == "true"
        run: |
          python -m venv .venv
          source .venv/bin/activate
          python -m pip install hatch

      - name: Run tests
        if: steps.branch-deploy.outputs.continue == "true"

Copilot uses AI. Check for mistakes.
Comment on lines +32 to +33
- if: steps.branch-deploy.outputs.continue == "true"
name: Setup Python
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The if conditional should be placed after the name field in the step definition, not before it. While GitHub Actions is sometimes forgiving about field order, the standard convention is:

- name: Setup Python
  if: steps.branch-deploy.outputs.continue == 'true'
  uses: actions/setup-python@v5
  with:
    python-version: '3.11'

This ensures better readability and follows GitHub Actions best practices.

See below for a potential fix:

      - name: Setup Python
        if: steps.branch-deploy.outputs.continue == "true"
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Checkout the repo
        if: steps.branch-deploy.outputs.continue == "true"
        uses: actions/checkout@v6
        with:
          ref: ${{ steps.branch-deploy.outputs.sha }}

      - name: Setup Python venv
        if: steps.branch-deploy.outputs.continue == "true"
        run: |
          python -m venv .venv
          source .venv/bin/activate
          python -m pip install hatch

      - name: Run tests
        if: steps.branch-deploy.outputs.continue == "true"

Copilot uses AI. Check for mistakes.
Comment on lines +38 to +39
- if: steps.branch-deploy.outputs.continue == "true"
name: Checkout the repo
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The if conditional should be placed after the name field. Consider:

- name: Checkout the repo
  if: steps.branch-deploy.outputs.continue == 'true'
  uses: actions/checkout@v6
  with:
    ref: ${{ steps.branch-deploy.outputs.sha }}

See below for a potential fix:

      - name: Setup Python
        if: steps.branch-deploy.outputs.continue == "true"
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Checkout the repo
        if: steps.branch-deploy.outputs.continue == "true"
        uses: actions/checkout@v6
        with:
          ref: ${{ steps.branch-deploy.outputs.sha }}

      - name: Setup Python venv
        if: steps.branch-deploy.outputs.continue == "true"
        run: |
          python -m venv .venv
          source .venv/bin/activate
          python -m pip install hatch

      - name: Run tests
        if: steps.branch-deploy.outputs.continue == "true"

Copilot uses AI. Check for mistakes.
Comment on lines +44 to +45
- if: steps.branch-deploy.outputs.continue == "true"
name: Setup Python venv
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The if conditional should be placed after the name field. Consider:

- name: Setup Python venv
  if: steps.branch-deploy.outputs.continue == 'true'
  run: |
    python -m venv .venv
    source .venv/bin/activate
    python -m pip install hatch
Suggested change
- if: steps.branch-deploy.outputs.continue == "true"
name: Setup Python venv
- name: Setup Python venv
if: steps.branch-deploy.outputs.continue == "true"

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant