MQL Mimic: Change to PR CI, detect changes #828
Conversation
cameron-dunn-sublime
force-pushed
the
cd.pr-based-ci
branch
from
7de80dd to
45bb429
Compare
cameron-dunn-sublime
force-pushed
the
cd.pr-based-ci
branch
from
098facd to
8208499
Compare
cameron-dunn-sublime
force-pushed
the
cd.pr-based-ci
branch
from
2ece166 to
a7afd9d
Compare
cameron-dunn-sublime
force-pushed
the
cd.pr-based-ci
branch
from
6ca67c8 to
d8a1693
Compare
cameron-dunn-sublime
force-pushed
the
cd.pr-based-ci
branch
from
7467890 to
5a8ae96
Compare
cameron-dunn-sublime
force-pushed
the
cd.pr-based-ci
branch
from
5c41f15 to
8145085
Compare
| - name: "Trigger MQL Mimic Tests" | ||
| env: | ||
| trigger_url: '${{ secrets.MQL_MOCK_TRIGGER }}' | ||
| branch: ${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }} |
There was a problem hiding this comment.
On main/etc github.ref will include "refs/heads/". I decided to just handle that downstream.
This reverts commit dc4dbf3.
cameron-dunn-sublime
changed the title
| @@ -30,6 +30,7 @@ jobs: | |||
| with: | |||
| ref: ${{ github.head_ref }} | |||
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |||
| depth: 0 | |||
There was a problem hiding this comment.
This is what's recommended for change detection. It takes 1 second to checkout, so I don't think this is worth even testing the alternatives (which are some higher number, or maybe API based detection but it's unclear if that's compatible with pull_request_target workflows)
| rule_id=$(yq '.id' $file) | ||
|
|
||
| echo "$file has rule ID $rule_id" | ||
| altered_rule_ids=$(echo "$rule_id"" ""$altered_rule_ids") |
There was a problem hiding this comment.
This is so cursed "$rule_id"" ""$altered_rule_ids" but I don't know what else I expect from bash.
There was a problem hiding this comment.
Haha "$rule_id $altered_rule_ids" should work too but I'll extra "` wrap often in case I'm forgetting some expansion that's going to happen.
The other side of these changes isn't finished out, but this part appears to be working as needed:
Once the other pieces are in place, we'll only run MQL mimic tests for detection rules touched in a PR. The endpoint will always be hit, but the workflow on the other side will succeed pretty quickly (it doesn't need to setup the platform or pull its large source).
e2abbf6 shows this running on push (as it will on
main)#829 shows it working as it will on a PR.