ci: report test results inline instead of via a separate workflow - #2017
ci: report test results inline instead of via a separate workflow#2017edusperoni merged 1 commit into
Conversation
Sorry, something went wrong.
The workflow_run-based Test Report workflow existed only because fork PRs get a read-only GITHUB_TOKEN, so the test job could not post a check run. But the JUnit XML it renders is produced by the untrusted PR run itself, so the resulting check carries no integrity, and the report workflow held the repo's only write-scoped token that processes untrusted input. Replace it with mikepenz/action-junit-report in annotate_only mode directly in the test jobs: it reports through workflow commands and the step summary, which work with a read-only token, including from fork PRs. The results artifact upload stays for debugging.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 400172dd-ff1a-4e17-bad5-4de64204da82 📥 CommitsReviewing files that changed from the base of the PR and between e4c72eb and d883acc. 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review. 📝 Walkthrough WalkthroughThe Pull Request and NPM Release test jobs now generate Android JUnit report annotations and summaries. The separate Test Report workflow was deleted. ChangesAndroid test reporting
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to d883a This change moves test reporting inline while preserving the test job’s existing pass/fail gate, with no actionable merge-blocking risk remaining after normal checks and review. Suggested reviewers: nathanwalker Poem 🚥 Pre-merge checks | ✅ 5 ✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands. |
Sorry, something went wrong.
Add an inline mikepenz/action-junit-report step (annotate_only + detailed_summary) to the test jobs of pull_request.yml and npm_release.yml, mirroring NativeScript/android#2017. annotate_only reports via workflow commands and the step summary, so it works with a read-only token — fork PRs included. The xcparse extraction moves out of Validate Test Results into its own !cancelled() step so a red test run still gets its junit report when the xcresult carries the attachments. junit-cli-report-viewer stays as the full per-test log and verify-junit-xml remains the gate. Also set explicit least-privilege permissions (contents: read) on pull_request.yml, the one workflow without a permissions block.
What
Replaces the workflow_run-based Test Report workflow with an inline mikepenz/action-junit-report step (pinned to v6.4.2) in the test jobs of both pull_request.yml and npm_release.yml, and deletes test_report.yml.
Why
The separate workflow existed only because fork PRs get a read-only GITHUB_TOKEN, so the test job itself could not post a check run — workflow_run was the standard workaround to get a checks: write token. But the security value of that split is essentially nil here:
Meanwhile it was the one workflow in the repo holding a write-scoped token that processes untrusted input.
How the replacement works
annotate_only: true makes the reporter use workflow commands (inline annotations on the run / Files changed view) instead of the Checks API, and detailed_summary: true writes the per-test table to the run's step summary. Both work with a read-only token, so the report now works identically for fork PRs, with zero write permissions anywhere.
The android-unit-test-results artifact upload is kept for debugging red runs.
What changes for reviewers
The "Android Runtime Tests" check run disappears from the PR checks list (it could never be a trusted/required check anyway). The report now lives on the workflow run's summary page, and failures annotate the run directly. The real gate remains the Test job's own exit code from runtestsAndVerifyResults.
Validation
This PR itself exercises the new step: the Test job on this run should end with a "Test report summary" step that writes the results table to the job summary. Note the summary step runs the PR's copy of pull_request.yml, so it validates live here; the npm_release.yml change is identical.
Summary by CodeRabbit
Tests
Chores