[NEW-CI] - Github PR build jobs

[fp...@apache.org]

Hi all,

I migrated some jobs to the new CI (https://ci-builds.apache.org) and I
want to configure some github PR jobs.

I followed this guide:

https://cwiki.apache.org/confluence/display/INFRA/Kicking+off+a+build+in+Jenkins+with+a+GitHub+PR

but I think there is some missing features or configuration like:

- updating the github webhook url with the new CI

- I can't see the "Build pull requests to the repository" in the Build
triggers list

Is there a sample project with PR jobs on the new CI?

regards,

-- 
François
fpapon@apache.org

Re: [NEW-CI] - Github PR build jobs

[Gavin McDonald <gm...@apache.org>]

Hi,

On Wed, Aug 5, 2020 at 1:17 PM Vladimir Sitnikov <
sitnikov.vladimir@gmail.com> wrote:

> Matt>You can configure PRs to only build for trusted users or require
>
> Is it enforced?
> It should be forbidden to configure PR from non-trusted users.
>
>
This has been the case for several months now, only PRs by Committers or by
folks in a
whitelist, can trigger builds.



> Vladimir
>


-- 

*Gavin McDonald*
Systems Administrator
ASF Infrastructure Team

Re: [NEW-CI] - Github PR build jobs

[Vladimir Sitnikov <si...@gmail.com>]

Matt>You can configure PRs to only build for trusted users or require

Is it enforced?
It should be forbidden to configure PR from non-trusted users.

Vladimir

Re: [NEW-CI] - Github PR build jobs

[Matt Sicker <bo...@gmail.com>]

You can configure PRs to only build for trusted users or require
approval from a trusted user to build the job. Take a look at the
build strategies when you're setting up your SCM info for the job or
pipeline.

On Tue, 4 Aug 2020 at 04:03, Vladimir Sitnikov
<si...@gmail.com> wrote:
>
> Are the new ci-... machines/workers isolated/hermetic?
> What if malicious code is submitted as a GitHub pull request?
>
> Vladimir



-- 
Matt Sicker <bo...@gmail.com>

Re: [NEW-CI] - Github PR build jobs

[Vladimir Sitnikov <si...@gmail.com>]

Are the new ci-... machines/workers isolated/hermetic?
What if malicious code is submitted as a GitHub pull request?

Vladimir

Re: [NEW-CI] - Github PR build jobs

[Andor Molnar <an...@apache.org>]

Hi Francois,

Apache ZooKeeper project already has a working job which is essentially a multibranch pipeline driven by Jenkinsfile. You can find it here:

https://ci-hadoop.apache.org/view/ZooKeeper/job/ZooKeeper%20PreCommit%20GitHub%20PR/

We’re waiting for INFRA to provide a GitHub account/app in order to report build status back to GitHub. Currently we have a dummy account which is useful for branch/PR discovery, but doesn’t have permission to set build status.

Andor



> On 2020. Aug 4., at 10:13, fpapon@apache.org wrote:
> 
> Hi all,
> 
> I migrated some jobs to the new CI (https://ci-builds.apache.org) and I
> want to configure some github PR jobs.
> 
> I followed this guide:
> 
> https://cwiki.apache.org/confluence/display/INFRA/Kicking+off+a+build+in+Jenkins+with+a+GitHub+PR
> 
> but I think there is some missing features or configuration like:
> 
> - updating the github webhook url with the new CI
> 
> - I can't see the "Build pull requests to the repository" in the Build
> triggers list
> 
> Is there a sample project with PR jobs on the new CI?
> 
> regards,
> 
> -- 
> François
> fpapon@apache.org
> 
>