From 471077fce94044e6bec9502d308a127834269262 Mon Sep 17 00:00:00 2001 From: Amp Date: Sat, 8 Aug 2026 08:37:16 +0000 Subject: [PATCH 1/3] Simplify repository checkout credentials Amp-Thread-ID: https://ampcode.com/threads/T-019fdfc1-9b2d-764b-b31c-ce76721b3d3e Co-authored-by: Lachlan Donald --- DEVELOPMENT.md | 4 +-- README.md | 23 ++------------- hooks/command | 10 ++----- plugin.yml | 2 +- tests/command.bats | 71 ++++++++++++++++++++++++++-------------------- 5 files changed, 47 insertions(+), 63 deletions(-) diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md index 621ffc1..74af670 100644 --- a/DEVELOPMENT.md +++ b/DEVELOPMENT.md @@ -22,12 +22,10 @@ The Buildkite pipeline's required released-default smoke test: 3. Uploads `.github/workflows/plugin-smoke.yml` 4. Checks out the same commit in a generated hosted job and verifies the release defaults -This lane requires Linux x86-64 Hosted Agents, but no configured secrets, provider tokens, or cache service. Cache integration is tested separately in the `buildkite/buildkite-gha` demo pipeline. +This lane requires Linux x86-64 Hosted Agents, but no configured secrets or cache service. Cache integration is tested separately in the `buildkite/buildkite-gha` demo pipeline. Set `GITHUB_ACTIONS_SOURCE_REF` to `latest` or a full lowercase 40-character CLI commit on a manually created Buildkite build to run the optional source smoke instead. This lane uses the repository's `mise.toml` to install pinned mise 2026.5.12 and Go 1.26.5, pins the plugin to the build's exact commit, and exercises `buildkite-gha-source-ref` end to end. Ordinary builds continue to prove the released archive and installation path. -The smoke tests leave `private-checkout` unset so they remain service-free. Bats covers its argument wiring; the `buildkite/buildkite-gha` repository tests its runtime behavior with GHAC minting. - ## Release Plugin releases are Git tags and contain no generated assets. Before creating a `v0.x.y` tag, verify that: diff --git a/README.md b/README.md index 4b71d0b..ae16d47 100644 --- a/README.md +++ b/README.md @@ -22,10 +22,11 @@ The importer step must have a `key`. Each workflow job and static matrix entry b | `workflow` | Yes | — | Path to the GitHub Actions workflow. | | `version` | No | `0.6.0` | Exact pre-1.0 `buildkite-gha` CLI version. | | `buildkite-gha-source-ref` | No | — | `latest` or a full lowercase commit for unreleased CLI testing. | -| `private-checkout` | No | `false` | Enable read-only checkout of the pipeline's private GitHub repository. | The plugin release (`github-actions#v0.6.0`) and CLI `version` are independent. Set `version` only when you need a CLI release other than the default. `version` and `buildkite-gha-source-ref` are mutually exclusive. +The deprecated `private-checkout` boolean is accepted for compatibility but ignored. Remove it from pipeline configuration. For CLI releases from v0.3.0 onward, the plugin derives the legacy checkout flag only from Buildkite's credential-availability signals; older releases do not support the flag. These signals indicate availability only; they do not grant authorization. The repository-provider backend remains authoritative for whether credentials are issued for each concrete repository URL. Workflow permissions remain separate: this mechanism does not populate `GITHUB_TOKEN` or `github.token`, enable private actions, or permit alternate repositories or refs. + ## Compatibility `buildkite-gha` intentionally supports a subset of GitHub Actions. For the default CLI, see the [`v0.6.0` compatibility guide](https://github.com/buildkite/buildkite-gha/blob/v0.6.0/docs/compatibility.md) before migrating a workflow. Unsupported behavior fails explicitly rather than silently choosing a substitute. @@ -41,24 +42,6 @@ Configure branch, tag, schedule, and pull request triggers in Buildkite. The wor Released mode downloads the selected public `buildkite/buildkite-gha` release without a GitHub token and does not require importer-side mise. Downloads and cached copies are verified before execution. Generated jobs prepare mise only when their resolved action trees can execute JavaScript; shell-only, native-adapter-only, and Docker-only jobs skip that setup. -## Private repositories - -By default, generated `actions/checkout` steps perform a credential-free, shallow checkout, so the workflow repository must be public. Set `private-checkout` to give verified checkout jobs read-only access to the pipeline's exact GitHub repository: - -```yaml -steps: - - label: ":github: GitHub Actions" - key: "github-actions" - plugins: - - github-actions#v0.6.0: - workflow: .github/workflows/ci.yml - private-checkout: true -``` - -This requires Buildkite's job-bound GitHub scoped access-token service. The CLI requests fixed `contents:read` authority, and the service independently requires the event repository to match the pipeline's GitHub repository. The credential is redacted before use and supplied only to Git through a one-shot askpass pipe. - -This option does not populate `GITHUB_TOKEN` or `github.token`, grant write access, enable private actions, or permit alternate repositories or refs. - ## Caching On hosted agents, attach the plugin's cache volume to speed up the importer: @@ -88,7 +71,7 @@ plugins: buildkite-gha-source-ref: latest ``` -`latest` resolves `buildkite/buildkite-gha` `main` once, logs its full commit, and runs that immutable commit with `mise --no-config` and Go 1.26.5. Use the logged full commit instead of `latest` for reproducible retries. Other refs are rejected. +`latest` resolves `buildkite/buildkite-gha` `main` once, logs its full commit, and runs that immutable commit with `mise --no-config` and Go 1.26.5. Use the logged full commit instead of `latest` for reproducible retries. Other refs are rejected. Source mode passes the checkout compatibility flag through whenever Buildkite reports repository-provider credentials; exact unreleased commits must accept that interface. The mise plugin requires a repository mise config. Source mode does not test release archives, checksums, or caching; normal released mode remains unchanged. diff --git a/hooks/command b/hooks/command index 20ffb49..5c0f459 100755 --- a/hooks/command +++ b/hooks/command @@ -10,7 +10,6 @@ PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" workflow="${BUILDKITE_PLUGIN_GITHUB_ACTIONS_WORKFLOW:-${BUILDKITE_PLUGIN__WORKFLOW:-}}" configured_version="${BUILDKITE_PLUGIN_GITHUB_ACTIONS_VERSION:-${BUILDKITE_PLUGIN__VERSION:-}}" source_ref="${BUILDKITE_PLUGIN_GITHUB_ACTIONS_BUILDKITE_GHA_SOURCE_REF:-${BUILDKITE_PLUGIN__BUILDKITE_GHA_SOURCE_REF:-}}" -private_checkout="${BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT:-${BUILDKITE_PLUGIN__PRIVATE_CHECKOUT:-false}}" if [[ -z "$workflow" ]]; then echo "github-actions plugin: workflow is required" >&2 @@ -20,12 +19,6 @@ if [[ "$workflow" == -* || "$workflow" == *$'\n'* || "$workflow" == *$'\r'* ]]; echo "github-actions plugin: workflow must be a path, not an option or multiline value" >&2 exit 1 fi -# An unrecognised value must not silently select either behaviour: treating it as -# false hides the opt-in, and treating it as true would widen authority. -case "$private_checkout" in - true|false) ;; - *) echo "github-actions plugin: private-checkout must be true or false" >&2; exit 1 ;; -esac if [[ -n "$source_ref" && -n "$configured_version" ]]; then echo "github-actions plugin: version and buildkite-gha-source-ref are mutually exclusive" >&2 exit 1 @@ -56,7 +49,8 @@ fi echo "~~~ :github: Prepare workflow" upload_args=(upload) -if [[ "$private_checkout" == true ]]; then +if [[ "${BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS:-}" == true || "${BUILDKITE_USE_GITHUB_APP_GIT_CREDENTIALS:-}" == true ]] && + [[ -n "$source_ref" || "${configured_version:-0.6.0}" =~ ^v?0\.([3-9]|[1-9][0-9]+)\. ]]; then upload_args+=(--private-checkout) fi upload_args+=(--runtime-queue hosted "$workflow") diff --git a/plugin.yml b/plugin.yml index 32fcb2f..6b92358 100644 --- a/plugin.yml +++ b/plugin.yml @@ -30,7 +30,7 @@ configuration: private-checkout: type: boolean default: false - description: Opt verified checkout jobs into read-only authority for the pipeline's exact GitHub repository. + description: Deprecated compatibility setting. Ignored; verified checkout jobs use Buildkite's repository-provider credential availability automatically. required: - workflow additionalProperties: false diff --git a/tests/command.bats b/tests/command.bats index 9f01161..66ed54a 100755 --- a/tests/command.bats +++ b/tests/command.bats @@ -10,13 +10,15 @@ setup() { export BUILDKITE_COMMIT=1111111111111111111111111111111111111111 unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_VERSION BUILDKITE_PLUGIN__VERSION unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_BUILDKITE_GHA_SOURCE_REF BUILDKITE_PLUGIN__BUILDKITE_GHA_SOURCE_REF + unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT BUILDKITE_PLUGIN__PRIVATE_CHECKOUT + unset BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS BUILDKITE_USE_GITHUB_APP_GIT_CREDENTIALS export MOCK_LOG="$TMP/mock.log" mkdir -p "$TMP/bin" "$TMP/payload" : > "$MOCK_LOG" printf 'license\n' > "$TMP/payload/LICENSE" cat > "$TMP/payload/buildkite-gha" <<'EOF' #!/usr/bin/env bash -if [[ "${1:-}" == --version ]]; then echo 'buildkite-gha 0.6.0'; exit; fi +if [[ "${1:-}" == --version ]]; then echo "buildkite-gha ${MOCK_CLI_VERSION:-0.6.0}"; exit; fi printf 'executable=%s\n' "$0" >> "${MOCK_LOG:?}" printf 'group=%s\n' "${BUILDKITE_GROUP_LABEL:-}" >> "${MOCK_LOG:?}" printf 'path=%s\n' "$PATH" >> "${MOCK_LOG:?}" @@ -131,41 +133,47 @@ teardown() { rm -rf "$TMP"; } ! grep -q '^upload ' "$MOCK_LOG" } -@test "opts into private checkout only when explicitly enabled" { - export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT=true - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" +@test "ignores the deprecated private-checkout setting" { + for value in true false unset; do + : > "$MOCK_LOG" + if [[ "$value" == unset ]]; then + unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT + else + export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT="$value" + fi + run "$REPO/hooks/command" + [ "$status" -eq 0 ] || { echo "$output"; false; } + grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + ! grep -q -- '--private-checkout' "$MOCK_LOG" + done +} - : > "$MOCK_LOG" +@test "bridges Buildkite repository-provider credential availability to the default CLI" { export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT=false - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" - - : > "$MOCK_LOG" - unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" - - # An empty value falls back to the unprivileged default, as `version` does. - : > "$MOCK_LOG" - export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT= - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + for signal in BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS BUILDKITE_USE_GITHUB_APP_GIT_CREDENTIALS; do + : > "$MOCK_LOG" + export "$signal"=true + run "$REPO/hooks/command" + [ "$status" -eq 0 ] || { echo "$output"; false; } + grep -Fx 'upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + unset "$signal" + done } -@test "rejects a non-boolean private-checkout without running importer" { - for value in yes 1 TRUE ' true' '--event-path'; do +@test "passes the credential bridge only to release CLIs that support it" { + export BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS=true + for version in 0.2.9 0.3.0 0.5.0; do : > "$MOCK_LOG" - export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT="$value" + export BUILDKITE_PLUGIN_GITHUB_ACTIONS_VERSION="$version" + export MOCK_CLI_VERSION="$version" run "$REPO/hooks/command" - [ "$status" -ne 0 ] || { echo "accepted '$value'"; false; } - [[ "$output" == *"private-checkout must be true or false"* ]] - run grep -q '^upload ' "$MOCK_LOG" - [ "$status" -eq 1 ] + [ "$status" -eq 0 ] || { echo "$output"; false; } + if [[ "$version" == 0.2.9 ]]; then + grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + ! grep -q -- '--private-checkout' "$MOCK_LOG" + else + grep -Fx 'upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + fi done } @@ -202,11 +210,12 @@ teardown() { rm -rf "$TMP"; } @test "builds an exact source commit without resolving latest" { export BUILDKITE_PLUGIN_GITHUB_ACTIONS_BUILDKITE_GHA_SOURCE_REF=abcdef0123456789abcdef0123456789abcdef01 + export BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS=true mock_source_tools run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } ! grep -q '^git:' "$MOCK_LOG" - grep -Fx 'mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@abcdef0123456789abcdef0123456789abcdef01 upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@abcdef0123456789abcdef0123456789abcdef01 upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" } @test "rejects invalid or ambiguous source configuration without running importer" { From 5c88d4721422ef05424393e2db05d26ddcb5276d Mon Sep 17 00:00:00 2001 From: Amp Date: Sat, 8 Aug 2026 10:02:43 +0000 Subject: [PATCH 2/3] Remove private checkout compatibility Amp-Thread-ID: https://ampcode.com/threads/T-019fdfc1-9b2d-764b-b31c-ce76721b3d3e Co-authored-by: Lachlan Donald --- README.md | 4 ++-- hooks/command | 7 +------ plugin.yml | 4 ---- tests/command.bats | 52 +++++++++------------------------------------- 4 files changed, 13 insertions(+), 54 deletions(-) diff --git a/README.md b/README.md index ae16d47..01c39f8 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ The importer step must have a `key`. Each workflow job and static matrix entry b The plugin release (`github-actions#v0.6.0`) and CLI `version` are independent. Set `version` only when you need a CLI release other than the default. `version` and `buildkite-gha-source-ref` are mutually exclusive. -The deprecated `private-checkout` boolean is accepted for compatibility but ignored. Remove it from pipeline configuration. For CLI releases from v0.3.0 onward, the plugin derives the legacy checkout flag only from Buildkite's credential-availability signals; older releases do not support the flag. These signals indicate availability only; they do not grant authorization. The repository-provider backend remains authoritative for whether credentials are issued for each concrete repository URL. Workflow permissions remain separate: this mechanism does not populate `GITHUB_TOKEN` or `github.token`, enable private actions, or permit alternate repositories or refs. +Repository checkout behavior is owned by `buildkite-gha` and Buildkite's repository-provider backend. Workflow permissions remain separate: checkout credentials do not populate `GITHUB_TOKEN` or `github.token`, enable private actions, or permit alternate repositories or refs. ## Compatibility @@ -71,7 +71,7 @@ plugins: buildkite-gha-source-ref: latest ``` -`latest` resolves `buildkite/buildkite-gha` `main` once, logs its full commit, and runs that immutable commit with `mise --no-config` and Go 1.26.5. Use the logged full commit instead of `latest` for reproducible retries. Other refs are rejected. Source mode passes the checkout compatibility flag through whenever Buildkite reports repository-provider credentials; exact unreleased commits must accept that interface. +`latest` resolves `buildkite/buildkite-gha` `main` once, logs its full commit, and runs that immutable commit with `mise --no-config` and Go 1.26.5. Use the logged full commit instead of `latest` for reproducible retries. Other refs are rejected. The mise plugin requires a repository mise config. Source mode does not test release archives, checksums, or caching; normal released mode remains unchanged. diff --git a/hooks/command b/hooks/command index 5c0f459..af941d2 100755 --- a/hooks/command +++ b/hooks/command @@ -48,12 +48,7 @@ fi echo "~~~ :github: Prepare workflow" -upload_args=(upload) -if [[ "${BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS:-}" == true || "${BUILDKITE_USE_GITHUB_APP_GIT_CREDENTIALS:-}" == true ]] && - [[ -n "$source_ref" || "${configured_version:-0.6.0}" =~ ^v?0\.([3-9]|[1-9][0-9]+)\. ]]; then - upload_args+=(--private-checkout) -fi -upload_args+=(--runtime-queue hosted "$workflow") +upload_args=(upload --runtime-queue hosted "$workflow") if [[ -n "$source_ref" ]]; then resolved_source_ref="$source_ref" diff --git a/plugin.yml b/plugin.yml index 6b92358..7deb4a3 100644 --- a/plugin.yml +++ b/plugin.yml @@ -27,10 +27,6 @@ configuration: type: string pattern: "^(latest|[0-9a-f]{40})$" description: Build buildkite-gha from the latest main commit or an exact full commit using config-free mise and pinned Go. Mutually exclusive with version. - private-checkout: - type: boolean - default: false - description: Deprecated compatibility setting. Ignored; verified checkout jobs use Buildkite's repository-provider credential availability automatically. required: - workflow additionalProperties: false diff --git a/tests/command.bats b/tests/command.bats index 66ed54a..453b5a4 100755 --- a/tests/command.bats +++ b/tests/command.bats @@ -10,7 +10,6 @@ setup() { export BUILDKITE_COMMIT=1111111111111111111111111111111111111111 unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_VERSION BUILDKITE_PLUGIN__VERSION unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_BUILDKITE_GHA_SOURCE_REF BUILDKITE_PLUGIN__BUILDKITE_GHA_SOURCE_REF - unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT BUILDKITE_PLUGIN__PRIVATE_CHECKOUT unset BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS BUILDKITE_USE_GITHUB_APP_GIT_CREDENTIALS export MOCK_LOG="$TMP/mock.log" mkdir -p "$TMP/bin" "$TMP/payload" @@ -18,7 +17,7 @@ setup() { printf 'license\n' > "$TMP/payload/LICENSE" cat > "$TMP/payload/buildkite-gha" <<'EOF' #!/usr/bin/env bash -if [[ "${1:-}" == --version ]]; then echo "buildkite-gha ${MOCK_CLI_VERSION:-0.6.0}"; exit; fi +if [[ "${1:-}" == --version ]]; then echo 'buildkite-gha 0.6.0'; exit; fi printf 'executable=%s\n' "$0" >> "${MOCK_LOG:?}" printf 'group=%s\n' "${BUILDKITE_GROUP_LABEL:-}" >> "${MOCK_LOG:?}" printf 'path=%s\n' "$PATH" >> "${MOCK_LOG:?}" @@ -133,47 +132,17 @@ teardown() { rm -rf "$TMP"; } ! grep -q '^upload ' "$MOCK_LOG" } -@test "ignores the deprecated private-checkout setting" { - for value in true false unset; do - : > "$MOCK_LOG" - if [[ "$value" == unset ]]; then - unset BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT - else - export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT="$value" - fi - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" - ! grep -q -- '--private-checkout' "$MOCK_LOG" - done -} - -@test "bridges Buildkite repository-provider credential availability to the default CLI" { - export BUILDKITE_PLUGIN_GITHUB_ACTIONS_PRIVATE_CHECKOUT=false +@test "repository-provider credential signals do not alter the upload command" { for signal in BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS BUILDKITE_USE_GITHUB_APP_GIT_CREDENTIALS; do - : > "$MOCK_LOG" - export "$signal"=true - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" - unset "$signal" - done -} - -@test "passes the credential bridge only to release CLIs that support it" { - export BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS=true - for version in 0.2.9 0.3.0 0.5.0; do - : > "$MOCK_LOG" - export BUILDKITE_PLUGIN_GITHUB_ACTIONS_VERSION="$version" - export MOCK_CLI_VERSION="$version" - run "$REPO/hooks/command" - [ "$status" -eq 0 ] || { echo "$output"; false; } - if [[ "$version" == 0.2.9 ]]; then + for value in true false; do + : > "$MOCK_LOG" + export "$signal"="$value" + run "$REPO/hooks/command" + [ "$status" -eq 0 ] || { echo "$output"; false; } grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" ! grep -q -- '--private-checkout' "$MOCK_LOG" - else - grep -Fx 'upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" - fi + done + unset "$signal" done } @@ -210,12 +179,11 @@ teardown() { rm -rf "$TMP"; } @test "builds an exact source commit without resolving latest" { export BUILDKITE_PLUGIN_GITHUB_ACTIONS_BUILDKITE_GHA_SOURCE_REF=abcdef0123456789abcdef0123456789abcdef01 - export BUILDKITE_USE_REPOSITORY_PROVIDER_GIT_CREDENTIALS=true mock_source_tools run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } ! grep -q '^git:' "$MOCK_LOG" - grep -Fx 'mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@abcdef0123456789abcdef0123456789abcdef01 upload --private-checkout --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@abcdef0123456789abcdef0123456789abcdef01 upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" } @test "rejects invalid or ambiguous source configuration without running importer" { From 95fec5bce46cf100d976c2df8cc27892f1f1c621 Mon Sep 17 00:00:00 2001 From: Amp Date: Sat, 8 Aug 2026 10:18:50 +0000 Subject: [PATCH 3/3] Remove runtime queue upload override Amp-Thread-ID: https://ampcode.com/threads/T-019fdfc1-9b2d-764b-b31c-ce76721b3d3e Co-authored-by: Lachlan Donald --- hooks/command | 2 +- tests/command.bats | 23 +++++++++++++++-------- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/hooks/command b/hooks/command index af941d2..8e3c8f7 100755 --- a/hooks/command +++ b/hooks/command @@ -48,7 +48,7 @@ fi echo "~~~ :github: Prepare workflow" -upload_args=(upload --runtime-queue hosted "$workflow") +upload_args=(upload "$workflow") if [[ -n "$source_ref" ]]; then resolved_source_ref="$source_ref" diff --git a/tests/command.bats b/tests/command.bats index 453b5a4..adfe234 100755 --- a/tests/command.bats +++ b/tests/command.bats @@ -95,7 +95,9 @@ teardown() { rm -rf "$TMP"; } mkdir -p "$TMPDIR" run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'upload .github/workflows/ci.yml' "$MOCK_LOG" + ! grep -q -- '--runtime-queue' "$MOCK_LOG" + ! grep -q -- '--private-checkout' "$MOCK_LOG" grep -Fx 'https://github.com/buildkite/buildkite-gha/releases/download/v0.6.0/buildkite-gha_Linux_x86_64.tar.gz' "$MOCK_LOG" grep -Fx 'https://github.com/buildkite/buildkite-gha/releases/download/v0.6.0/checksums.txt' "$MOCK_LOG" grep -Fx "path=$EXPECTED_PATH" "$MOCK_LOG" @@ -139,7 +141,8 @@ teardown() { rm -rf "$TMP"; } export "$signal"="$value" run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'upload .github/workflows/ci.yml' "$MOCK_LOG" + ! grep -q -- '--runtime-queue' "$MOCK_LOG" ! grep -q -- '--private-checkout' "$MOCK_LOG" done unset "$signal" @@ -171,7 +174,9 @@ teardown() { rm -rf "$TMP"; } [ "$status" -eq 0 ] || { echo "$output"; false; } [[ "$output" == *"buildkite-gha source latest resolved to $MOCK_SOURCE_SHA"* ]] grep -Fx 'git:ls-remote --exit-code --refs https://github.com/buildkite/buildkite-gha.git refs/heads/main' "$MOCK_LOG" - grep -Fx "mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@$MOCK_SOURCE_SHA upload --runtime-queue hosted .github/workflows/ci.yml" "$MOCK_LOG" + grep -Fx "mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@$MOCK_SOURCE_SHA upload .github/workflows/ci.yml" "$MOCK_LOG" + ! grep -q -- '--runtime-queue' "$MOCK_LOG" + ! grep -q -- '--private-checkout' "$MOCK_LOG" grep -Fx 'source-env:MISE_YES=1' "$MOCK_LOG" run grep -F 'releases/download' "$MOCK_LOG" [ "$status" -eq 1 ] @@ -183,7 +188,9 @@ teardown() { rm -rf "$TMP"; } run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } ! grep -q '^git:' "$MOCK_LOG" - grep -Fx 'mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@abcdef0123456789abcdef0123456789abcdef01 upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'mise:--no-config x go@1.26.5 -- env CGO_ENABLED=0 GOTOOLCHAIN=local go run -trimpath github.com/buildkite/buildkite-gha/cmd/buildkite-gha@abcdef0123456789abcdef0123456789abcdef01 upload .github/workflows/ci.yml' "$MOCK_LOG" + ! grep -q -- '--runtime-queue' "$MOCK_LOG" + ! grep -q -- '--private-checkout' "$MOCK_LOG" } @test "rejects invalid or ambiguous source configuration without running importer" { @@ -339,7 +346,7 @@ EOF run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } [[ "$output" == *"cache '$BUILDKITE_GITHUB_ACTIONS_PLUGIN_CACHE_ROOT' is unavailable; using a temporary cache"* ]] - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'upload .github/workflows/ci.yml' "$MOCK_LOG" } @test "continues when the verified CLI archive cannot be cached" { @@ -356,7 +363,7 @@ EOF run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } [[ "$output" == *"continuing without caching"* ]] - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'upload .github/workflows/ci.yml' "$MOCK_LOG" [ ! -e "$BUILDKITE_GITHUB_ACTIONS_PLUGIN_CACHE_ROOT/v0.6.0/Linux_x86_64" ] } @@ -377,7 +384,7 @@ EOF run "$REPO/hooks/command" [ "$status" -eq 0 ] || { echo "$output"; false; } grep -Fx 'https://github.com/buildkite/buildkite-gha/releases/download/v0.6.0/buildkite-gha_Linux_x86_64.tar.gz' "$MOCK_LOG" - grep -Fx 'upload --runtime-queue hosted .github/workflows/ci.yml' "$MOCK_LOG" + grep -Fx 'upload .github/workflows/ci.yml' "$MOCK_LOG" } @test "concurrent installs converge on one valid cache" { @@ -391,7 +398,7 @@ EOF [ -f "$cached_archive" ] expected="$(awk '$2 == "buildkite-gha_Linux_x86_64.tar.gz" { print $1 }' "$TMP/checksums.txt")" [ "$(/usr/bin/sha256sum "$cached_archive" | awk '{ print $1 }')" = "$expected" ] - [ "$(grep -c '^upload --runtime-queue hosted ' "$MOCK_LOG")" -eq 2 ] + [ "$(grep -c '^upload .github/workflows/ci.yml$' "$MOCK_LOG")" -eq 2 ] } @test "propagates importer failure and never runs importer after install failure" {