Skip to content

Fix workflows #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Happypig375 merged 4 commits into from
Feb 15, 2026
Merged

Fix workflows #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dcc2a3e
Fix workflows
Happypig375 Feb 13, 2026
96b1c07
Update Label workflow
Happypig375 Feb 14, 2026
78dc6ea
More comments
Happypig375 Feb 14, 2026
59a9a3a
Fix forks trying to publish Uno Example on push but without gh-pages …
Happypig375 Feb 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/Benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ jobs:
steps:
- uses: actions/checkout@v6
with:
submodules: 'recursive'
submodules: recursive
- name: Setup .NET
uses: actions/setup-dotnet@v5
with:
Expand All @@ -18,7 +18,7 @@ jobs:
uses: benchmark-action/github-action-benchmark@v1
with:
name: CSharpMath.Rendering.Benchmarks
tool: 'benchmarkdotnet'
tool: benchmarkdotnet
output-file-path: .benchmarkresults/results/CSharpMath.Rendering.Benchmarks.Program-report-full-compressed.json
github-token: ${{ github.token }}
auto-push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} # Push and deploy GitHub pages branch automatically
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/Format.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,6 @@ jobs:
workloads: maui-ios, maui-maccatalyst, maui-android, wasm-tools
- uses: actions/checkout@v6
with:
submodules: 'recursive'
submodules: recursive
- name: Check formatting (Fix with "dotnet format --exclude Typography" at repository root)
run: dotnet format --exclude Typography --verify-no-changes --verbosity diagnostic
21 changes: 10 additions & 11 deletions .github/workflows/Label.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,20 @@
name: Label breaking changes for semantic versioning

on: [pull_request]
on: pull_request_target # Run on the merge target branch instead of the merge commit to grant pull-requests:write permission
Copy link

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment states that the workflow runs "on the merge target branch instead of the merge commit", but the checkout configuration uses ref: ${{ github.event.pull_request.head.sha }} which checks out the PR branch (head), not the target branch (base). The comment may be misleading. The pull_request_target event does run in the context of the base repository (for permissions), but the code being checked out is from the PR head.

Suggested change
on: pull_request_target # Run on the merge target branch instead of the merge commit to grant pull-requests:write permission
on: pull_request_target # Use pull_request_target to run with base repository permissions (while checking out the PR head) so we can add labels

Copilot uses AI. Check for mistakes.
jobs:
Label:
runs-on: windows-latest
permissions:
pull-requests: write # Allow adding a label to this pull request
steps:
- uses: actions/checkout@v6
with:
submodules: recursive
fetch-depth: 0 # Fetch all commit history and tags, instead of the default fetch of only one commit
ref: ${{ github.event.pull_request.head.sha }} # Checkout the PR branch
Comment on lines +3 to +13
Copy link

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using pull_request_target with ref: ${{ github.event.pull_request.head.sha }} can introduce security risks if the checked-out code is executed in the workflow. This workflow executes PowerShell scripts that process the PR's code (git diff output). While the current implementation appears safe since it only reads and analyzes the diff output, be aware that pull_request_target runs with write permissions in the context of the base repository, not the fork. Any future modifications that execute untrusted code from the PR should be carefully reviewed for security implications.

Copilot uses AI. Check for mistakes.
- name: If there are changes in PublicApi.Shipped.txt, fail the workflow
if: github.head_ref != 'action/ship-publicapi' # Same branch name specified in Release.yml
run: |
git fetch origin ${{ github.base_ref }}
$changes = git diff --numstat --shortstat origin/${{ github.base_ref }}...HEAD -- '**/PublicApi.Shipped.txt'
$changes = git diff --numstat --shortstat origin/${{ github.base_ref }}...HEAD -- '**/PublicApi.Shipped.txt' # Note that ** must expand to at least one folder here, this doesn't check root
Copy link

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The git diff command references origin/${{ github.base_ref }} but there's no git fetch operation to ensure the base branch is available locally. While fetch-depth: 0 fetches all history, when checking out a specific PR head SHA with pull_request_target, the base branch may not be available as a remote tracking branch. This could cause the git diff to fail with an error like "unknown revision or path not in the working tree". Consider adding git fetch origin ${{ github.base_ref }} before this line, or use git fetch origin ${{ github.event.pull_request.base.sha }} to explicitly fetch the base commit.

Copilot uses AI. Check for mistakes.
Write-Output "$changes"
if ($changes) {
Write-Error "Changes detected in PublicApi.Shipped.txt files. Public API changes must be shipped through the release process, not in regular pull requests."
Expand All @@ -21,12 +23,9 @@ jobs:
shell: pwsh
- name: Label based on PublicApi.Unshipped.txt
run: |
git fetch origin ${{ github.base_ref }}

# Determine the appropriate label (Sync these labels with release-drafter.yml)
if ("${{ github.head_ref }}" -eq "action/ship-publicapi") { # Same branch name specified in Release.yml
if ("${{ github.head_ref }}" -eq "action/ship-publicapi") {
$labels = @('Type/Housekeeping')
Write-Output "This is a ship-publicapi PR, labeling as Type/Maintenance"
Write-Output "This is a ship-publicapi PR, labeling as Type/Housekeeping"
} else {
# For regular PRs, check for API changes
$changes = git diff origin/${{ github.base_ref }}...HEAD -- '**/PublicApi.Unshipped.txt'
Copy link

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The git diff command references origin/${{ github.base_ref }} but there's no git fetch operation to ensure the base branch is available locally. While fetch-depth: 0 fetches all history, when checking out a specific PR head SHA with pull_request_target, the base branch may not be available as a remote tracking branch. This could cause the git diff to fail. Consider adding git fetch origin ${{ github.base_ref }} before this line, or use git fetch origin ${{ github.event.pull_request.base.sha }} to explicitly fetch the base commit.

Copilot uses AI. Check for mistakes.
Expand All @@ -44,8 +43,8 @@ jobs:
Write-Output "Publicly facing API changes include only additions. Labelling as enhancement."
}
} else {
$labels = @('Type/Bug')
Write-Output "No publicly facing API changes. Labelling as bug."
Write-Output "No publicly facing API changes. Exiting the workflow."
Exit
}
}

Expand Down
11 changes: 3 additions & 8 deletions .github/workflows/Nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
GITHUB_TOKEN: ${{ github.token }}
- uses: actions/checkout@v6
with:
submodules: 'recursive'
submodules: recursive
- uses: actions/setup-dotnet@main
with:
dotnet-version: '10.x'
Expand Down Expand Up @@ -75,12 +75,6 @@ jobs:
with:
name: CSharpMath.Rendering.Tests results
path: CSharpMath.Rendering.Tests/*/*.png
- name: Upload CSharpMath.Xaml.Tests.NuGet results as CI artifacts
uses: actions/upload-artifact@v4
if: always()
with:
name: CSharpMath.Xaml.Tests.NuGet results
path: CSharpMath.Xaml.Tests.NuGet/*.png
- name: Upload NuGet packages as CI artifacts
uses: actions/upload-artifact@v4
if: always()
Expand All @@ -97,11 +91,12 @@ jobs:
# By using *.* as the file path, this command will fail when .nupkgs folder contains any file that isn't a .nupkg or .snupkg file.
# --skip-duplicate enables re-running this workflow even if some packages from the same commit are already uploaded.
# --no-symbols omits uploading .snupkg files which is not supported by GitHub Packages: https://github.com/orgs/community/discussions/38678
dotnet nuget push '.nupkgs\*.*' -s 'https://nuget.pkg.github.com/verybadcat/index.json' -k ${{ github.token }} --skip-duplicate --no-symbols
dotnet nuget push '.nupkgs\*.*' -s 'https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json' -k ${{ github.token }} --skip-duplicate --no-symbols
shell: pwsh
- name: Publish CSharpMath.Uno.Example
run: |
git fetch origin gh-pages
if (-not $?) { Exit } # For forks that didn't include the gh-pages branch, don't fail the workflow
git worktree add website/wwwroot gh-pages
Get-ChildItem -Path website/wwwroot/* -Exclude dev,.nojekyll | Remove-Item -Recurse -Force # dev is the output folder of Benchmark.yml and .nojekyll ensures _framework folder is served, keep them
# TODO: why can't this publish use --no-build? For example, see https://github.com/verybadcat/CSharpMath/actions/runs/21600019106/job/62243168945
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/Release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,13 @@ jobs:
CSharpMath:
runs-on: windows-latest
permissions:
# permissions requested by https://github.com/marketplace/actions/create-pull-request#token
# Permissions requested by https://github.com/marketplace/actions/create-pull-request#token
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v6
with:
submodules: 'recursive'
submodules: recursive
- uses: actions/setup-dotnet@main
with:
dotnet-version: '10.x'
Expand Down Expand Up @@ -56,4 +56,5 @@ jobs:
commit-message: 'Move PublicApi.Unshipped.txt to PublicApi.Shipped.txt for ${{ github.event.release.tag_name }}'
title: 'Ship PublicApi for ${{ github.event.release.tag_name }}'
body: 'This PR moves the contents of PublicApi.Unshipped.txt to PublicApi.Shipped.txt to mark the API as shipped for version ${{ github.event.release.tag_name }}.'
branch: action/ship-publicapi # Same branch name specified in Label.yml
branch: action/ship-publicapi # Same branch name specified in Label.yml
base: '${{ github.event.repository.default_branch }}' # Releases are checked out on the tag commit but we need a target branch for the pull request. Let's just always submit it against the default branch
2 changes: 1 addition & 1 deletion .github/workflows/Test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
workloads: ${{ case(startsWith(matrix.os, 'ubuntu'), 'maui-android, wasm-tools', 'maui, wasm-tools') }}
- uses: actions/checkout@v6
with:
submodules: 'recursive'
submodules: recursive
- name: Build Everything
run: dotnet build
- name: Run Tests
Expand Down
Loading