https://contribute.sonatype.com/docs/standards/pull-request-ci/Recent content in Pull Request CI & Secrets on Sonatype Open Source Community HandbookHugoenhttps://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/Mon, 01 Jan 0001 00:00:00 +0000https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/<div class="alert alert-warning" role="alert"> <p><strong>DRAFT.</strong> These workflows implement the <a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/">Pull Request CI &amp; Secrets</a> standard. Every snippet has been checked to parse as YAML. They have <strong>not</strong> been linted with actionlint or zizmor, and <strong>have not been run end to end in GitHub Actions</strong>. Treat them as a design to review, not as tested code.</p> </div> <h2 id="contents">Contents<a class="td-heading-self-link" href="#contents" aria-label="Heading self-link"></a></h2> <ul> <li><a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/#how-the-pieces-fit">How the pieces fit</a></li> <li><a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/#tier-1-the-ci-workflow">Tier 1: the CI workflow</a></li> <li><a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/#tier-2-the-lifecycle-evaluation-workflow">Tier 2: the Lifecycle evaluation workflow</a></li> <li><a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/#trusted-refs-the-authoritative-evaluation">Trusted refs: the authoritative evaluation</a></li> <li><a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/#repository-configuration">Repository configuration</a></li> <li><a href="https://contribute.sonatype.com/docs/standards/pull-request-ci/reference-workflows/#why-each-part-is-the-way-it-is">Why each part is the way it is</a></li> </ul> <h2 id="how-the-pieces-fit">How the pieces fit<a class="td-heading-self-link" href="#how-the-pieces-fit" aria-label="Heading self-link"></a></h2> <table> <thead> <tr> <th>File</th> <th>Trigger</th> <th>Has secrets?</th> <th>Runs PR code?</th> <th>Job</th> </tr> </thead> <tbody> <tr> <td><code>.github/workflows/ci.yaml</code></td> <td><code>pull_request</code>, <code>push</code> to <code>main</code></td> <td>No</td> <td>Yes</td> <td>Build, test, and produce the scan input</td> </tr> <tr> <td><code>.github/workflows/lifecycle-evaluate.yaml</code></td> <td><code>workflow_run</code> of <code>CI</code></td> <td>Yes</td> <td><strong>No</strong></td> <td>Evaluate the scan input and report</td> </tr> <tr> <td><code>.github/workflows/lifecycle-release.yaml</code></td> <td><code>push</code> to <code>main</code> or release tags</td> <td>Yes</td> <td>Only reviewed, merged code</td> <td>Authoritative evaluation</td> </tr> </tbody> </table> <p>The name of the first workflow (<code>CI</code>) is referenced by the second, so the two must agree.</p>