Skip to content

Commit 1d70658

Browse files
committed
ci: drop fork guard on ghcr ORAS pull -- prevented nightly on forks
build-wolfprovider.yml gated its `Login to ghcr.io` and `Download pre-built packages from ghcr.io` steps on `github.repository == 'wolfSSL/wolfProvider'`. On a fork run (aidangarske/wolfProvider firing nightly-osp.yml), that condition is false, so the .deb pull was silently skipped, the package directories stayed empty, `dpkg -i .../*.deb` was a no-op, and wolfprov's configure failed with "could not locate wolfSSL". The published .debs (ghcr.io/wolfssl/wolfprovider/debs:*) are public, so anonymous pulls work regardless of which repo's CI is running. Drop the fork guard. Login is best-effort (continue-on-error: true) -- it helps rate limits when a token is available, but anonymous pulls keep working for forks without write-scope tokens against wolfssl's namespace. Also use github.actor for the login username instead of github.repository_owner so the token's actual user is used (matters on fork runs where repository_owner is the fork owner, not the actor).
1 parent f1fbf99 commit 1d70658

1 file changed

Lines changed: 8 additions & 4 deletions

File tree

.github/workflows/build-wolfprovider.yml

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,16 +109,20 @@ jobs:
109109
rm -f "oras_${ORAS_VERSION}_linux_amd64.tar.gz"
110110
"$GITHUB_WORKSPACE/.bin/oras" version
111111
112+
# The wolfprov debs at ghcr.io/wolfssl/wolfprovider/debs:* are
113+
# public, so login is best-effort: it helps rate-limits when the
114+
# caller has a token, but anonymous pulls still work for forks.
112115
- name: Login to ghcr.io
113-
if: steps.check_artifact.outcome != 'success' && github.repository == 'wolfSSL/wolfProvider'
116+
if: steps.check_artifact.outcome != 'success'
117+
continue-on-error: true
114118
run: |
115119
echo "${{ secrets.GITHUB_TOKEN }}" | oras login \
116-
--username ${{ github.repository_owner }} \
120+
--username ${{ github.actor }} \
117121
--password-stdin ghcr.io
118122
119123
# ── Debian build: pull .deb packages from ghcr.io ──
120124
- name: Download pre-built packages from ghcr.io
121-
if: steps.check_artifact.outcome != 'success' && github.repository == 'wolfSSL/wolfProvider' && inputs.build_type == 'debian'
125+
if: steps.check_artifact.outcome != 'success' && inputs.build_type == 'debian'
122126
run: |
123127
mkdir -p ${{ env.WOLFSSL_PACKAGES_PATH }}
124128
mkdir -p ${{ env.OPENSSL_PACKAGES_PATH }}
@@ -198,7 +202,7 @@ jobs:
198202
done
199203
200204
- name: Download WIC images from ghcr.io
201-
if: steps.check_artifact.outcome != 'success' && github.repository == 'wolfSSL/wolfProvider' && inputs.build_type == 'yocto'
205+
if: steps.check_artifact.outcome != 'success' && inputs.build_type == 'yocto'
202206
run: |
203207
mkdir -p ${{ env.YOCTO_IMAGES_PATH }}
204208

0 commit comments

Comments
 (0)