slachiewicz commented on PR #300: URL: https://github.com/apache/maven-gh-actions-shared/pull/300#issuecomment-5230893493
Evidence that this is already biting a consumer, rather than a latent risk. `apache/maven-doxia-site` sets `ff-run: false`. Every pull request opened from a branch in that repository fails — which there means every Dependabot pull request, since human ones came from forks and were therefore fine: | PR | head | `pull_request` run | |---|---|---| | #65, #66, #67 (Dependabot) | `apache:…` | **failed** | | #68, #69, #70 | fork | passed | [Run 29306636392](https://github.com/apache/maven-doxia-site/actions/runs/29306636392) shows the failure shape this change prevents: `setup-maven-version` skipped, `fail-fast-build` skipped **with its name never expanded** (`${{ inputs.ff-os }} jdk-${{ inputs.ff-jdk }}-…`), and no `verify` job in the run at all — the run dies while evaluating `verify`'s strategy, because `fromJSON('')` on the skipped job's `maven-matrix` output cannot produce a matrix. Two further notes: - `v4` carries the identical `setup-maven-version` and `verify` conditions, so the same change applies there. Happy to open it. - Consumers leaving `ff-run` at its default are unaffected, because `needs.fail-fast-build.result == 'success'` already gates them. Only the `ff-run: false` combination is exposed. apache/maven-doxia-site#72 fixes that repository at the caller instead, but the condition here is what makes the combination safe for everyone. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
