fix(ci): make test build work on pull requests from forks - #173
Open
ganeshkumarashok wants to merge 1 commit into
Open
fix(ci): make test build work on pull requests from forks#173ganeshkumarashok wants to merge 1 commit into
ganeshkumarashok wants to merge 1 commit into
Conversation
The CI test build tags the image with `${{ secrets.AZURE_REGISTRY_SERVER }}`.
Secrets are not exposed to `pull_request` workflows triggered from a fork, so
on those runs the expression resolves to an empty string and the tag becomes
`/public/aks/<repo>:<version>`, which buildx rejects:
ERROR: failed to build: invalid tag "/public/aks/aks-gpu-grid:...":
invalid reference format
Every job then fails within seconds, so pull requests from forks get no build
signal at all and the red checks are indistinguishable from a genuine breakage.
Fall back to a placeholder registry when the secret is unavailable. This
workflow only builds images, it never logs in to a registry and never pushes,
so the registry portion of the tag is not meaningful here - it only has to be a
syntactically valid reference for buildx to accept.
Runs that do have the secret are unaffected and keep tagging exactly as before.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8cd619fe-2501-4bcc-97ea-4a895088ffc2
Collaborator
Author
VerificationThe CI run on this PR passes, but it runs from a branch on this repo, so secrets are present and it does not exercise the fallback. To validate the actual failing configuration I ran a controlled A/B in a fork with no repository secrets (identical to the
Control reproduced the reported error exactly: Treatment built every image against the placeholder: Notes:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
ci.yamltags the test image with${{ secrets.AZURE_REGISTRY_SERVER }}. Secrets are not exposed topull_requestworkflows triggered from a fork, so on those runs the expression resolves to an empty string and the tag becomes/public/aks/<repo>:<version>, which buildx rejects:All six build jobs then fail within seconds. Pull requests from forks get no build signal at all, and the red checks are indistinguishable from a genuine breakage — which makes fork PRs hard to review.
This is long-standing rather than new. For example #161 (from a fork) failed this way, while #159 passed only because that run had
Secret source: Actions.Fix
Fall back to a placeholder registry when the secret is unavailable:
-t ${{ secrets.AZURE_REGISTRY_SERVER || 'localhost:5000' }}/public/aks/...This workflow only builds images — it never runs
azure/login, never runsaz acr login, and never runsdocker push(verified: zero occurrences of each inci.yaml). The registry portion of the tag is therefore not meaningful here; it only has to be a syntactically valid reference for buildx to accept.Runs that do have the secret are unaffected and keep tagging exactly as before, since
||returns the first truthy operand and a populated secret is truthy.Validation
actionlint: 7 pre-existing SC2086 findings onmain, 7 on this branch — identical, no new findings introduced.localhost:5000/public/aks/...(valid), secret present gives<registry>/public/aks/...(unchanged from today).ci.yamlwhere the registry secret is consumed, and it is build-only.Note
This is intentionally independent of #172 (the workflow expression-injection fix). Both touch the same
docker buildx buildlines, so whichever merges second will need a trivial conflict resolution — in #172 the fallback simply moves into theenv:block asREGISTRY_SERVER: ${{ secrets.AZURE_REGISTRY_SERVER || 'localhost:5000' }}.