Subject: [Ietf-and-github] (no subject)

From: Spencer Dawkins at IETF <[email-masked]>
Date: Tue, 27 Jul 2021 14:57:25 -0500

I hope this qualifies as a how-to-use-git-in-ietf-wg-practice question.

I'm contributing to at least one working group repo that has moved from
CircleCI to Github Actions, and I noticed that (quoting) "First-time
contributors need a maintainer to approve running workflows".

I'm looking at
https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks,
and the only reason I'm seeing NOT to approve a new contributor's workflow
is "Although workflows from forks do not have access to sensitive data such
as secrets, they can be an annoyance for maintainers if they are modified
for abusive purposes".

A bit further down, I'm seeing "By default, all first-time contributors
require approval to run workflows. However, you can configure this behavior
for a repository, organization, or enterprise". Is anyone already doing
that?

Best,

Spencer

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 27 Jul 2021 20:07:31 +0000

*   I'm contributing to at least one working group repo that has moved from CircleCI to Github Actions, and I noticed that (quoting) "First-time contributors need a maintainer to approve running workflows".

People were submitting nonsense pull-request that, for example, changed the ci.yaml file to do crypto mining.

Don’t turn on auto-accept.  Turn it one once you’ve looked at the PR.

---

From: "Martin Thomson" <[email-masked]>
Date: Wed, 28 Jul 2021 11:38:09 +1000

> Don’t turn on auto-accept.  Turn it one once you’ve looked at the PR.

There are other protections, but this is the obvious one.  Review the PR, if it looks fine, let CI at it.  You might then have to wait ~30s or so before the run completes, but it isn't that bad.  I occasionally take PRs without clicking the button for small stuff and that's fine too.