Allow additional reusable workflows and actions in the `pip-tools` repo

[webknjaz]

Important

This configuration request hard-blocks jazzband/pip-tools#2274

@jezdez I'm starting to integrate reusable bits of CI/CD automations that I've built and I'm hosting elsewhere.

Could you add these entries to the allowlist in the repo settings?

• codecov/codecov-action@*
• irongut/CodeCoverageSummary@*
• re-actors/cache-python-deps@* (or just re-actors/* re-actors/**@** re-actors/*)
• re-actors/checkout-python-sdist@* (or just re-actors/* re-actors/**@** re-actors/*)
• test-summary/action@*
• tox-dev/workflow@* tox-dev/workflow/**@* tox-dev/workflow/**@** tox-dev/workflow/*

Ref: jazzband/pip-tools#2274

[jezdez]

Done.

[webknjaz]

@jezdez apparently, I made a mistake in one of the patterns and this needs to be fixed.

Could you change the last one to tox-dev/workflow/**@*? You can close+reopen my PR to validate that it works.

[jezdez]

Done

[webknjaz]

Looks like the re-actors/* pattern doesn't match for some reason:

The actions re-actors/cache-python-deps@release/v1, re-actors/checkout-python-sdist@release/v2, and re-actors/alls-green@afee1c1eac2a506084c274e9c02c8e0687b48d9e are not allowed in jazzband/pip-tools because all actions must be from a repository owned by jazzband, created by GitHub, verified in the GitHub Marketplace, or match one of the patterns: codecov/codecov-action@*, deadsnakes/action@*, irongut/CodeCoverageSummary@*, pypa/gh-action-pypi-publish@*
re-actors/*, release-drafter/release-drafter@*, test-summary/action@*, tox-dev/workflow/**@*.

(https://github.com/jazzband/pip-tools/actions/runs/19736489579)

I'll double-check the wildcard matching docs and post a possible solution.

[webknjaz]

The hint in a random repo's settings looks as follows:

Action examples: octo-org/octo-repo@*, !octo-org/octo-repo@v2
Reusable workflow examples: octo-org/octo-repo/.github/workflows/build.yml@main
Entire organization or repository examples: octo-org/*, octo-org/octo-repo/*

And it also links to https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#allowing-select-actions-and-reusable-workflows-to-run

[webknjaz]

The doc suggests that re-actors/* should work but it doesn't. I think this might be because of the slash in the refs. Globs usually require double asterisks to overcome that.

@jezdez let's try re-actors/**@** — this should cover all the cases. And could you also replace tox-dev/workflow/**@* with tox-dev/workflow/**@** as this may happen there too.

[jezdez]

I can't debug things like this on short notice, can you please review this on your own first and then let me know what works?

[webknjaz]

🤦‍♂️ I couldn't see it at first because of how the error message was rendered with a line break. But I copied this configuration it into another repo and it didn't make sense to me.

But eventually, I noticed that there's a comma misssing between pypa/gh-action-pypi-publish@* and re-actors/* — that's what's causing the problem. The list of patterns is comma-separated and GH must be parsing this as a single item pypa/gh-action-pypi-publish@* re-actors/*, which understandably doesn't work.

@jezdez so here's the final entry that the repo should have, with all the commas where they are supposed to be + simplified wildcards that are confirmed to function properly:

codecov/codecov-action@*,
deadsnakes/action@*,
fregante/setup-git-user@*,
irongut/CodeCoverageSummary@*,
pypa/gh-action-pypi-publish@*,
re-actors/*,
test-summary/action@*,
tox-dev/workflow/*,

I left out release-drafter/release-drafter@* because we stopped using it some time ago. You could technically also delete pypa/gh-action-pypi-publish@* from there if you set the ☑️ Allow actions by Marketplace verified creators checkbox — we've verified it on the PyPA side a while back.