[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: RFS: Security patch for GitHub CLI client gh





On 31/12/24 1:31 am, Santiago Vila wrote:
El 30/12/24 a las 19:24, Otto Kekäläinen escribió:
You bypassed now both code reviews and uploaded despite failing CI.

As far as I know, there's no hard-bound team policy to upload only when the pipeline passes.
There also have been recent changes made to the go team pipeline
so I'm unsure if we made it a team policy as well so quickly?

In your policy draft I nowhere see that you can't upload w/o the CI.

In this particular case, the package built fine on buildd -- so what exactly is the issue here?

For the record: I only see failed pipelines here:

https://salsa.debian.org/go-team/packages/gh/-/pipelines?page=1&scope=all

so it's not as if this package suddenly had switched from passing to not-passing.

I have been a member of go team for 6 years, and am in top 10 committers statwise (see http://blends.debian.net/liststats/) and I'd have done the same as Santiago for the package had I been more active and responsive than Santiago.

Before we consider a pipeline a criteria to upload or not, we would maybe have
to review the ones that fail so that they stop failing.

Agreed.

If we are going to make this a hard requirement, we must ensure the CI is in compliance with what builds fine on buildd.


Thanks.


-n


Reply to: