On Wed, May 29, 2024 at 03:19:43PM +0100, Andrew Cooper wrote:
> This restriction doesn't provide any security because anyone with suitable
> permissions on the HW runners can bypass it with this local patch.
>
> Requiring branches to be protected hampers usability of transient testing
> branches (specifically, can't delete branches except via the Gitlab UI).
>
> Drop the requirement.
>
> Fixes: 746774cd1786 ("automation: introduce a dom0less test run on Xilinx
> hardware")
> Fixes: 0ab316e7e15f ("automation: add a smoke and suspend test on an Alder
> Lake system")
> Signed-off-by: Andrew Cooper <[email protected]>Runners used to be set to run only on protected branches. I think it isn't the case anymore from what I see, but it needs checking (I don't see specific settings in all the projects). If it were still the case, removing variable check would result in jobs forever pending. Other than that, I'm okay with this change, since the hw runners are added only to select projects. You can interpret this as Acked-by, if you verify if indeed runners are not limited to protected branches only. I will need to adjust setting of my project, to set "QUBES_JOBS" only to some branches - I used to use branch protection rules as a proxy to selecting on which branch to run hw tests... > --- > CC: Roger Pau Monné <[email protected]> > CC: Stefano Stabellini <[email protected]> > CC: Michal Orzel <[email protected]> > CC: Marek Marczykowski-Górecki <[email protected]> > CC: Oleksii Kurochko <[email protected]> > > Fixes because this wants backporting, but it also needs acks from both Marek > and Stefano as the owners of the hardware in question. > --- > automation/gitlab-ci/test.yaml | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml > index ad249fa0a5d9..efd3ad46f08e 100644 > --- a/automation/gitlab-ci/test.yaml > +++ b/automation/gitlab-ci/test.yaml > @@ -92,7 +92,7 @@ > when: always > only: > variables: > - - $XILINX_JOBS == "true" && $CI_COMMIT_REF_PROTECTED == "true" > + - $XILINX_JOBS == "true" > tags: > - xilinx > > @@ -112,7 +112,7 @@ > when: always > only: > variables: > - - $QUBES_JOBS == "true" && $CI_COMMIT_REF_PROTECTED == "true" > + - $QUBES_JOBS == "true" > tags: > - qubes-hw2 > > -- > 2.30.2 > -- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab
signature.asc
Description: PGP signature
