Skip to content

CI: make the Windows build a real gate #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Kevofehr merged 1 commit into from
Jul 29, 2026
Merged

CI: make the Windows build a real gate #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 13 additions & 13 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,15 +79,16 @@ jobs:
# ${{ github.workspace }}/anvil/ <- this repo
# ${{ github.workspace }}/PicoGK/ <- the PicoGK fork ANVIL builds against
#
# KNOWN LIMITATION (why continue-on-error is set):
# The PicoGK build dependency currently lives in a PRIVATE repository, so this
# job cannot check it out with the default GITHUB_TOKEN and will be skipped
# with a notice. Two ways to make it green:
# 1. Publish the PicoGK fork (preferred - it also unblocks contributors,
# who otherwise cannot build ANVIL at all), then delete the
# `continue-on-error` line and the `token:` line below; or
# 2. Add a repo secret PICOGK_TOKEN (a fine-grained PAT with read access to
# the fork) and delete only the `continue-on-error` line.
# The PicoGK fork is PUBLIC, so the default GITHUB_TOKEN checks it out and this
# job is a real gate rather than an advisory one. That also means a fork PR and
# a Dependabot PR build exactly like a push to main, since neither of those is
# handed repo secrets and neither needs any.
#
# `ref` MUST be the full 40-character commit SHA. actions/checkout only treats
# a ref as a commit when it is full length; anything shorter is resolved as a
# branch or tag name, so a short SHA fetches `refs/heads/<short>*`, matches
# nothing and fails the step with a bare "exit code 1".
#
# Upstream leap71/PicoGK is NOT a drop-in substitute: it keeps its sources at
# the repository root rather than under src/, and ships no prebuilt win-x64
# native DLLs, so the ProjectReference path above does not resolve against it.
Expand All @@ -99,7 +100,6 @@ jobs:
build:
name: build (windows, .NET 9)
runs-on: windows-latest
continue-on-error: true # remove once the PicoGK dependency is reachable (see above)
steps:
- name: Checkout ANVIL
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
Expand All @@ -113,14 +113,14 @@ jobs:
with:
repository: Kevofehr/PicoGK
# Pinned to the exact commit the ANVIL worker is developed against.
ref: 3725be3
# Full SHA, never a short one - see the note above.
ref: 3725be3aa88af97b12a4a531a4a93be0d8e1eeb6
path: PicoGK
token: ${{ secrets.PICOGK_TOKEN || github.token }}

- name: Report a missing PicoGK checkout
if: steps.picogk.outcome != 'success'
run: |
echo "::notice title=PicoGK unavailable::The PicoGK build dependency could not be checked out (the repository is private). Publish the fork or set the PICOGK_TOKEN secret. Skipping the build."
echo "::error title=PicoGK unavailable::Could not check out Kevofehr/PicoGK at the pinned commit. Confirm the repository is still public and that the pinned ref is a full 40-character SHA that exists there."
exit 1

- name: Setup .NET 9
Expand Down
Loading