Skip to content

ci: skip upstream release-channel checks in forks #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MrCodeLabs merged 1 commit into from
Oct 23, 2026
Merged

ci: skip upstream release-channel checks in forks #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions .github/CI.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Pull request CI

The local workflow `workflows/pr-build-test.yml` restores and builds the application and runs the
existing regression suites on GitHub-hosted Windows 2025. Publication is separately authorized;
these local definitions have not run on GitHub. Logs and test results are retained for seven days.
existing regression suites on GitHub-hosted Windows 2025. The fork's PR #8 run passed on
20 October 2026. Logs and test results are retained for seven days.
Official checkout, setup-dotnet, and upload-artifact actions are pinned to immutable commit hashes.

It uses only `pull_request`, `contents: read`, and checkout with persisted credentials disabled.
Expand All @@ -14,3 +14,22 @@ The engine console runner runs on both net48 and net10.0. The speed-test console
net48 with local fixtures only, without --worker or --internet. They use dotnet run because they
are executable regression suites. Isolated WPF checks are distinct from interactive UI automation.
The build SDK is .NET 10; the application and desktop runner continue targeting net48.

## Release-channel verification

`workflows/release-sync.yml` checks the upstream publisher's GitHub release, Chocolatey and
WinGet channels. Its `verify` job runs only in `SteveTheKiller/KillerScan`, for both scheduled
and manual invocations. Development forks intentionally skip this job, even if they have
their own releases: the configured marketplace identifiers belong to the upstream publisher.
This does not disable `pr-build-test.yml` or change any publishing workflow.

On 23 October 2026, investigation found eleven scheduled failures in the fork after the
upstream sync: the fork has no published releases, so `/releases/latest` returned HTTP 404.
The script previously continued to an empty release tag and obscured the original error.
The job guard prevents the inapplicable fork check; failed release API calls now stop with
an explicit metadata-fetch error. Missing releases in the publisher's repository remain failures.

Validation: actionlint and PowerShell syntax checks, plus isolated release-lookup cases
(latest, explicit version, API failure and invalid tag). The patched workflow must reach
the fork's default branch before scheduled runs use the guard. Old failed runs remain in
history; rerunning their old revisions does not test this fix. No package was published.
6 changes: 5 additions & 1 deletion .github/workflows/release-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ permissions:

jobs:
verify:
# These package IDs belong to the upstream publisher, not development forks.
if: github.repository == 'SteveTheKiller/KillerScan'
runs-on: ubuntu-latest
env:
APP_NAME: KillerScan
Expand Down Expand Up @@ -44,7 +46,9 @@ jobs:
} else {
"repos/$repository/releases/latest"
}
$release = gh api $releasePath | ConvertFrom-Json
$releaseJson = gh api $releasePath
if ($LASTEXITCODE -ne 0) { throw "Could not fetch release metadata from $releasePath (gh exit $LASTEXITCODE)." }
$release = $releaseJson | ConvertFrom-Json
$tag = [string]$release.tag_name
$version = $tag -replace '^v', ''
if ($version -notmatch '^\d+\.\d+\.\d+$') { throw "Invalid release tag: $tag" }
Expand Down
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
- Per-tab scan options for neighbor cache, explicit ARP, ICMP, TCP discovery, DNS, mDNS, SSDP, port scanning and individual HTTP/TLS/SSH/SNMP/NetBIOS fingerprints. Profiles save the choices; scan, quick and deep paths enforce them in the engine. CLI `/skip` and PowerShell `-Skip` provide the same choices. Existing profiles and API calls keep their defaults.

### Fixed
- Release Sync skips development forks because the checked marketplace channels belong to the upstream publisher; release API failures report the metadata lookup error instead of an empty tag (23 October 2026).
- The shortcuts card shows shadows at its edges when more content is out of view.

## [1.8.3] - 2026-10-19
Expand Down
Loading