From 5bb2dc0cea95dc8263fcd6f892f160605871b55f Mon Sep 17 00:00:00 2001 From: Marco Bambini Date: Fri, 13 Nov 2026 13:22:04 +0100 Subject: [PATCH] ci: run on pull requests, and only on main for pushes A pull request never ran this workflow: the only trigger was a push, and a push to a fork does not run the workflow of the base repository. Pull requests #22, #23 and #24 all show "no checks reported" and were merged without a single job having seen them; the jobs ran on main afterwards. That is how the test that #22 added reached main-adjacent review still failing on arm64 Linux, which linux-arm64 and linux-musl-arm64 would have caught at once. Pushes are now limited to main, since a pull request from a branch of this repository would otherwise run all 14 jobs twice, once for the push and once for the pull request. To run the jobs on a branch of its own, as a dry run of a fork's pull request for instance, use the workflow_dispatch that is already here: gh workflow run main.yml --ref . The signing steps are skipped where there are no secrets to sign with, which is every pull request from a fork: the build and the tests still run, which is what the pull request is for, and without this the six macOS, iOS and xcframework jobs would fail on every outside contribution. Their artifacts are then unsigned, and the release job runs only for main, so an unsigned artifact is never released. A secret can be read in a job's env but not in a step's if, which is why SIGNING is an env entry. This takes effect for pull requests opened after it is merged: GitHub reads the workflow of the base branch for a pull_request event, so this branch cannot run its own new trigger. It was checked with a workflow_dispatch run on the branch instead. Co-Authored-By: Claude Opus 5 --- .github/workflows/main.yml | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index a76de50..4dd262d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,10 +1,12 @@ name: build, test and release sqlite-js on: + # Pushes to main only: a pull request from a branch of this repository would otherwise run + # everything twice, once for the push and once for the pull request. Use the workflow_dispatch + # below to run this on a branch of its own (gh workflow run main.yml --ref ). push: branches: - - '**' - tags-ignore: - - '**' + - main + pull_request: workflow_dispatch: permissions: @@ -74,6 +76,14 @@ jobs: run: shell: ${{ matrix.container && 'sh' || 'bash' }} + env: + # A pull request from a fork gets no secrets, so there is nothing to sign or notarize with: + # those steps are skipped there and the build and the tests, which is what the pull request + # is for, still run. The artifacts of such a run are unsigned, and the release job below + # runs only for main, so they are never released. Secrets can be read here but not in a + # step's if, which is why this is an env entry. + SIGNING: ${{ secrets.APPLE_CERTIFICATE != '' }} + steps: - uses: actions/checkout@v4.2.2 @@ -112,7 +122,7 @@ jobs: run: ${{ matrix.name == 'linux-musl' && matrix.arch == 'arm64' && 'docker exec alpine' || '' }} make extension ${{ matrix.make && matrix.make || ''}} - name: create keychain for codesign - if: matrix.os == 'macos-15' + if: matrix.os == 'macos-15' && env.SIGNING == 'true' run: | echo "${{ secrets.APPLE_CERTIFICATE }}" | base64 --decode > certificate.p12 security create-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" build.keychain @@ -122,7 +132,7 @@ jobs: security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${{ secrets.KEYCHAIN_PASSWORD }}" build.keychain - name: codesign and notarize dylib - if: matrix.os == 'macos-15' && matrix.name != 'apple-xcframework' + if: matrix.os == 'macos-15' && matrix.name != 'apple-xcframework' && env.SIGNING == 'true' run: | codesign --sign "${{ secrets.APPLE_TEAM_ID }}" --timestamp --options runtime dist/js.dylib ditto -c -k dist/js.dylib dist/js.zip @@ -130,7 +140,7 @@ jobs: rm dist/js.zip - name: codesign and notarize xcframework - if: matrix.name == 'apple-xcframework' + if: matrix.name == 'apple-xcframework' && env.SIGNING == 'true' run: | find dist/js.xcframework -name "*.framework" -exec echo "Signing: {}" \; -exec codesign --sign "${{ secrets.APPLE_TEAM_ID }}" --timestamp --options runtime {} \; # Sign each individual framework FIRST codesign --sign "${{ secrets.APPLE_TEAM_ID }}" --timestamp --options runtime dist/js.xcframework # Then sign the xcframework wrapper @@ -139,7 +149,7 @@ jobs: rm -rf dist/js.xcframework - name: cleanup keychain for codesign - if: matrix.os == 'macos-15' + if: matrix.os == 'macos-15' && env.SIGNING == 'true' run: | rm certificate.p12 security delete-keychain build.keychain