tak/.github/workflows/ci.yml at main · jdx/tak · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions: {}

jobs:
  trusted:
    if: ${{ github.actor == 'jdx' && (github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login == 'jdx')) }}
    permissions:
      contents: read
    uses: ./.github/workflows/ci-impl.yml
    with:
      trusted: true

  untrusted:
    if: ${{ github.actor != 'jdx' || (github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login != 'jdx')) }}
    permissions:
      contents: read
    uses: ./.github/workflows/ci-impl.yml
    with:
      trusted: false

  final:
    name: final
    if: ${{ always() && !cancelled() && needs.trusted.result != 'cancelled' && needs.untrusted.result != 'cancelled' }}
    permissions: {}
    needs: [trusted, untrusted]
    runs-on: ubuntu-latest
    timeout-minutes: 1
    steps:
      - name: Check selected workflow result
        env:
          TRUSTED_RESULT: ${{ needs.trusted.result }}
          UNTRUSTED_RESULT: ${{ needs.untrusted.result }}
        run: |
          if [[ "$TRUSTED_RESULT" == success && "$UNTRUSTED_RESULT" == skipped ]] ||
             [[ "$TRUSTED_RESULT" == skipped && "$UNTRUSTED_RESULT" == success ]]; then
            exit 0
          fi
          echo "trusted=$TRUSTED_RESULT untrusted=$UNTRUSTED_RESULT"
          exit 1