CI is broken for community contributions

heroku / heroku-buildpack-php

Heroku's buildpack for PHP applications.

https://devcenter.heroku.com/categories/php

MIT License

805 stars 1.59k forks source link

Open stof opened 3 months ago

stof commented 3 months ago

the CI jobs seems to be relying on github secrets to be present. But those secrets are not exposed in pull_request jobs for untrusted PRs (i.e. PRs coming from forks) to avoid the risk of a malicious PR leaking the secret. See https://github.com/heroku/heroku-buildpack-php/actions/runs/9665966313/job/26664478221?pr=738 for the result of such CI job.

This creates a confusing experience for contributors.

dzuelke commented 3 months ago

Right, but... what do you suggest we do about it? ;)

stof commented 3 months ago

Well, maybe those CI jobs requiring secrets should be skipped when secrets are not available instead of reporting weird failures.