Skip to content

chore: update build-release.yaml #517

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hf-security-analysis wants to merge 1 commit into from
Closed

chore: update build-release.yaml #517

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 21 additions & 5 deletions .github/workflows/build-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,24 +42,40 @@ jobs:
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
if KERNEL=$(python3 .github/workflows/validate-kernel-pr.py "release" "$PR_TITLE"); then
echo "kernel=$KERNEL" >> $GITHUB_OUTPUT
echo "skip=false" >> $GITHUB_OUTPUT
# Validate kernel output matches expected pattern (alphanumeric, hyphens, underscores, slashes only)
if echo "$KERNEL" | grep -qE '^[a-zA-Z0-9_/-]+$'; then
Copy link
Copy Markdown
Member

@danieldk danieldk Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The kernel name is already validated in validate-kernel-pr.py, so we will never get here if the kernel has an invalid name.

echo "kernel=$KERNEL" >> $GITHUB_OUTPUT
echo "skip=false" >> $GITHUB_OUTPUT
else
echo "Invalid kernel name format: $KERNEL" >&2
echo "skip=true" >> $GITHUB_OUTPUT
fi
else
echo "skip=true" >> $GITHUB_OUTPUT
fi
- name: Build and upload kernel
if: steps.validate.outputs.skip == 'false'
env:
HF_TOKEN: ${{ secrets.HF_TOKEN }}
KERNEL: ${{ steps.validate.outputs.kernel }}
run: |
KERNEL="${{ steps.validate.outputs.kernel }}"
# Re-validate kernel name format
Copy link
Copy Markdown
Member

@danieldk danieldk Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We never get here if the kernel name is invalid, since the step would be skipped. Useless validation?

if ! echo "$KERNEL" | grep -qE '^[a-zA-Z0-9_/-]+$'; then
echo "Invalid kernel name format" >&2
exit 1
fi
( cd "$KERNEL" && nix run -L .#build-and-upload )
- name: Upload v1 kernels to main
if: steps.validate.outputs.skip == 'false'
env:
HF_TOKEN: ${{ secrets.HF_TOKEN }}
KERNEL: ${{ steps.validate.outputs.kernel }}
run: |
KERNEL="${{ steps.validate.outputs.kernel }}"
# Re-validate kernel name format
if ! echo "$KERNEL" | grep -qE '^[a-zA-Z0-9_/-]+$'; then
echo "Invalid kernel name format" >&2
exit 1
fi
cd "$KERNEL"

# Check if build.toml exists and has version = 1
Expand All @@ -69,4 +85,4 @@ jobs:
nix build -L
nix run -L .#kernels -- upload --repo-id kernels-community/$KERNEL --branch main result
fi
fi
fi
Loading