Make proxy request read timeout configurable #14869
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # These set of workflows run on every push to the main branch | |
| name: PR Checks | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| spellcheck: | |
| name: Spellcheck | |
| uses: ./.github/workflows/spellcheck.yml | |
| license-headers: | |
| name: License Headers | |
| uses: ./.github/workflows/license-headers.yml | |
| linting: | |
| name: Linting | |
| uses: ./.github/workflows/lint.yml | |
| # Security Scan is not called from here: security-scan.yml has its own | |
| # `pull_request` trigger, so calling it as well ran every scan twice per PR. | |
| tests: | |
| name: Tests | |
| uses: ./.github/workflows/test.yml | |
| # Named rather than inherited: this job runs the Go test suite, and so | |
| # executes repository code and its dependency tree. It has no business | |
| # holding the release signing keys. | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| docs: | |
| name: Docs | |
| uses: ./.github/workflows/verify-docgen.yml | |
| codegen: | |
| name: Codegen | |
| uses: ./.github/workflows/verify-gen.yml | |
| # Tier 2: Expensive integration tests - only run after all fast checks pass | |
| helm-charts: | |
| name: Helm Charts | |
| uses: ./.github/workflows/helm-charts-test.yml | |
| e2e-tests: | |
| name: E2E Tests | |
| needs: [linting, tests, docs, codegen] | |
| uses: ./.github/workflows/e2e-tests.yml | |
| operator-ci: | |
| name: Operator CI | |
| needs: [linting, tests, docs, codegen] | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/operator-ci.yml | |
| skills-build: | |
| name: Build Skills | |
| needs: [linting, tests, codegen] | |
| # Build-only, and deliberately calls a workflow that publishes nothing: | |
| # this executes code from the pull request, so it must not hold the | |
| # packages:write or id-token:write that skills-publish.yml uses to sign | |
| # and push a release. | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/skills-build.yml | |
| # Deliberately no skills-keyless-signing-e2e job here. It needs | |
| # id-token: write to mint an ambient OIDC token, and it builds and runs | |
| # repository code to use it — which on a pull request is code from the | |
| # pull request. Even though the certificate it produces cannot impersonate | |
| # the release signer (a different workflow path means a different SAN, and | |
| # lock provenance pins that path), the job's environment carries | |
| # ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN, from which that code could mint a | |
| # token for *any* audience and exfiltrate it. Any external trust policy | |
| # matching this repository without pinning the ref would accept it. The | |
| # job runs post-merge from run-on-main.yml instead, where the code is | |
| # trusted; it was already non-blocking, so it never gated a merge anyway. | |
| # To exercise it on a branch, dispatch the "Main build" workflow there. |