From 3ed7986fa3cce732b4274577e5cf2e3de05f99ea Mon Sep 17 00:00:00 2001 From: Emmanuel Lobo <76094069+UnschooledGamer@users.noreply.github.com> Date: Tue, 28 Jul 2026 21:45:32 +0530 Subject: [PATCH 1/5] Refactor conditions for preview release triggers --- .github/workflows/on-demand-preview-releases-PR.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/on-demand-preview-releases-PR.yml b/.github/workflows/on-demand-preview-releases-PR.yml index 5a584d40d..2b49b17ee 100644 --- a/.github/workflows/on-demand-preview-releases-PR.yml +++ b/.github/workflows/on-demand-preview-releases-PR.yml @@ -23,14 +23,11 @@ jobs: contents: read pull-requests: write issues: write - if: | - github.event.pull_request.draft == false - && (github.repository_owner == 'Acode-Foundation' - && (!contains(github.event.pull_request.labels.*.name, 'DO NOT PREVIEW RELEASE') - && (contains(github.event.pull_request.labels.*.name, 'Bypass check - PREVIEW RELEASE') - || contains(github.event.pull_request.labels.*.name, 'CI: RUN ON-DEMAND PREVIEW RELEASES') - )) - ) + if: >- + github.event.pull_request.draft == false && + github.repository_owner == 'Acode-Foundation' && + (github.event.action == 'labeled' && github.event.label.name == 'CI: RUN ON-DEMAND PREVIEW RELEASES' || + github.event.action == 'synchronize' && github.event.label.name == 'Bypass check - PREVIEW RELEASE') runs-on: ubuntu-latest From 3b8de2a0c506c4daf8d4699f5573794b03cc437f Mon Sep 17 00:00:00 2001 From: Emmanuel Lobo <76094069+UnschooledGamer@users.noreply.github.com> Date: Tue, 28 Jul 2026 21:51:38 +0530 Subject: [PATCH 2/5] Refactor conditions for on-demand preview releases --- .github/workflows/on-demand-preview-releases-PR.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/on-demand-preview-releases-PR.yml b/.github/workflows/on-demand-preview-releases-PR.yml index 2b49b17ee..bd046648e 100644 --- a/.github/workflows/on-demand-preview-releases-PR.yml +++ b/.github/workflows/on-demand-preview-releases-PR.yml @@ -25,9 +25,11 @@ jobs: issues: write if: >- github.event.pull_request.draft == false && - github.repository_owner == 'Acode-Foundation' && - (github.event.action == 'labeled' && github.event.label.name == 'CI: RUN ON-DEMAND PREVIEW RELEASES' || + github.repository_owner == 'Acode-Foundation' && + (!contains(github.event.pull_request.labels.*.name, 'DO NOT PREVIEW RELEASE') && + (github.event.action == 'labeled' && github.event.label.name == 'CI: RUN ON-DEMAND PREVIEW RELEASES' || github.event.action == 'synchronize' && github.event.label.name == 'Bypass check - PREVIEW RELEASE') + ) runs-on: ubuntu-latest From 562ed42a90422aa25107e0fa1fc94913cc823dc3 Mon Sep 17 00:00:00 2001 From: Emmanuel Lobo <76094069+UnschooledGamer@users.noreply.github.com> Date: Tue, 28 Jul 2026 22:00:55 +0530 Subject: [PATCH 3/5] Update nightly-build.yml with additional comments --- .github/workflows/nightly-build.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 4bc73c2ed..b7812b434 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -1,5 +1,7 @@ # Implement to use environment secrets someday, At the moment GH Actions doesn't support those in reusable workflows (ref: https://github.com/actions/runner/issues/1490) # at least that's what I found. +# This workflow executes PR Code when triggered from PR via workflow_call, +# MUST approve the PR code BEFORE triggering this workflow. name: Nightly Build @@ -101,6 +103,7 @@ jobs: fetch-depth: 0 # Required for tags persist-credentials: false ref: ${{ (inputs.is_PR && inputs.PR_NUMBER) && github.event.pull_request.head.sha || '' }} + allow-unsafe-pr-checkout: ${{ !!(inputs.is_PR && inputs.PR_NUMBER && github.event.pull_request.head.sha) }} - name: Setup Java uses: actions/setup-java@v5 @@ -204,4 +207,4 @@ jobs: echo "| Normal APK Artifact Name | ${{ steps.meta.outputs.normal_artifact_name }} |" >> $GITHUB_STEP_SUMMARY echo "| F-Droid APK Artifact Name | ${{ steps.meta.outputs.fdroid_artifact_name || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY echo "| Normal APK Artifact SHA256 | ${{ steps.sha256.outputs.normal_apk_sha256 }} |" >> $GITHUB_STEP_SUMMARY - echo "| F-Droid APK Artifact SHA256 | ${{ steps.sha256.outputs.fdroid_apk_sha256 || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY \ No newline at end of file + echo "| F-Droid APK Artifact SHA256 | ${{ steps.sha256.outputs.fdroid_apk_sha256 || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY From 9e5ae91658b53b4e559e7ae3b5c3d95465fda137 Mon Sep 17 00:00:00 2001 From: Emmanuel Lobo <76094069+UnschooledGamer@users.noreply.github.com> Date: Tue, 28 Jul 2026 22:06:19 +0530 Subject: [PATCH 4/5] Clarify PR workflow execution and approval process Added comments to clarify workflow execution and approval requirements. --- .github/workflows/on-demand-preview-releases-PR.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/on-demand-preview-releases-PR.yml b/.github/workflows/on-demand-preview-releases-PR.yml index bd046648e..b961e0508 100644 --- a/.github/workflows/on-demand-preview-releases-PR.yml +++ b/.github/workflows/on-demand-preview-releases-PR.yml @@ -1,6 +1,9 @@ name: On Demand Preview Releases for PR # avoids paths like .md, and anything in .github folder on: + # This workflow executes PR Code by checkout later + # MUST approve the PR Code BEFORE using this workflow on PRs. + # Uses this trigger to keep up-to-date execution of the workflow (triggers from Default Branch) pull_request_target: paths-ignore: - '!*.md' From 66b0cb3c8b687159b9d351a2f0cc3fe702dac4b3 Mon Sep 17 00:00:00 2001 From: Emmanuel Lobo <76094069+UnschooledGamer@users.noreply.github.com> Date: Tue, 28 Jul 2026 22:14:18 +0530 Subject: [PATCH 5/5] Update .github/workflows/on-demand-preview-releases-PR.yml Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- .github/workflows/on-demand-preview-releases-PR.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/on-demand-preview-releases-PR.yml b/.github/workflows/on-demand-preview-releases-PR.yml index b961e0508..8254116d6 100644 --- a/.github/workflows/on-demand-preview-releases-PR.yml +++ b/.github/workflows/on-demand-preview-releases-PR.yml @@ -31,7 +31,7 @@ jobs: github.repository_owner == 'Acode-Foundation' && (!contains(github.event.pull_request.labels.*.name, 'DO NOT PREVIEW RELEASE') && (github.event.action == 'labeled' && github.event.label.name == 'CI: RUN ON-DEMAND PREVIEW RELEASES' || - github.event.action == 'synchronize' && github.event.label.name == 'Bypass check - PREVIEW RELEASE') + github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'Bypass check - PREVIEW RELEASE')) ) runs-on: ubuntu-latest