ci: fast-fail on forked PRs with no credentials (#1522)

Summary:
PRs created from forks don’t have credentials when running CI. This
commit causes the `test-full` job (which requires credentials) to fail
fast with a helpful error message.

Test Plan:
Push distinct versions of this commit to a fork and to the main
repository, and open pull requests for each. Note that the tests pass
from the main repository, but fail with a nice message from the fork:

![Screenshot of expected fast-fail behavior][ss]

The “team member pushes to trusted branch” workflow has already been
successfully exercised for #1521.

[ss]: https://user-images.githubusercontent.com/4317806/71707839-b782ab00-2da1-11ea-8aa9-7d8720538a87.png

wchargin-branch: forked-pr-fail-fast
This commit is contained in:
William Chargin 2020-01-07 21:03:23 -08:00 committed by GitHub
parent fa00751cd4
commit 32f83ad676
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -10,6 +10,11 @@ main();
function main() {
const options = parseArgs();
if (isForkedPrFullRun(options)) {
printForkedPrFullRunErrorMessage();
process.exitCode = 1;
return;
}
const printVerboseResults = options.mode === "FULL";
const runOptions = {printVerboseResults};
const tasks = makeTasks(options.mode, options.limitMemoryUsage);
@ -33,6 +38,37 @@ function parseArgs() {
return options;
}
/**
* Check whether we're running full CI for a PR created on a fork. In
* this state, Circle CI omits secure environment variables (which is
* good and desired), but this means that we'll have to abort tests.
*/
function isForkedPrFullRun(options) {
if (options.mode !== "FULL") {
return false;
}
if (!process.env["CIRCLE_PR_NUMBER"]) {
// This environment variable is only set on forked PRs.
// https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables
return false;
}
if (process.env["SOURCECRED_GITHUB_TOKEN"]) {
return false;
}
return true;
}
function printForkedPrFullRunErrorMessage() {
console.error(
[
"fatal: cannot run full test suite: missing credentials",
"Tests on forked PRs run without credentials by default. A core team ",
"member will sanity-check your PR and push its head commit to a branch ",
"on the main SourceCred repository, which will re-run these tests.",
].join("\n")
);
}
function makeTasks(
mode /*: "BASIC" | "FULL" */,
limitMemoryUsage /*: boolean */