Idea: sign pull requests' builds only for the ones a maintainer let through #378

New issue

Closed

opened 2026-11-14 06:49:40 +00:00 by gab9281 · 1 comment

gab9281 commented

2026-11-14 06:49:40 +00:00

Member

The idea

CI keeps building every pull request that is not a draft, but pr-publish.yml signs and publishes only those with the testing wanted label or whose author may push to Longshot (the rule test requests follow).

Why: once the pull request key exists, any non-draft pull request from anyone gets a signed build in Longshot's own releases. The launcher warns, and shows testing wanted first, but the signature still vouches for code nobody looked at. The code review of #353 ranked this its top risk.

Note: Forgejo answers collaborators/{user}/permission only to repo admins, so the job's token cannot ask it; the label alone, or a list of maintainers, may be what works.

Anything else

A follow-up of #337 (testing pull requests from the launcher): CI in #353, the launcher's picker in LongshotLauncher pull request 59.

### The idea CI keeps building every pull request that is not a draft, but `pr-publish.yml` signs and publishes only those with the `testing wanted` label or whose author may push to Longshot (the rule test requests follow). Why: once the pull request key exists, any non-draft pull request from anyone gets a signed build in Longshot's own releases. The launcher warns, and shows *testing wanted* first, but the signature still vouches for code nobody looked at. The code review of #353 ranked this its top risk. Note: Forgejo answers `collaborators/{user}/permission` only to repo admins, so the job's token cannot ask it; the label alone, or a list of maintainers, may be what works. ### Anything else A follow-up of #337 (testing pull requests from the launcher): CI in #353, the launcher's picker in [LongshotLauncher pull request 59](https://git.magicbean.dev/MagicBeanDev/LongshotLauncher/pulls/59).

~~gab9281 referenced this issue 2026-11-14 06:49:51 +00:00~~

Idea: install a pull request's build from the Longshot Launcher, to help test it #337

gab9281 commented

2026-11-14 06:52:29 +00:00

Author

Member

Opened by mistake: its idea is now a follow-up in the list on #337. Closing; a maintainer may delete it.

gab9281 closed this issue

2026-11-14 06:52:30 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

MagicBeanDev/Longshot#378

No description provided.

Rows
Columns