From 3983353247f08cdc704775efa1fef791f174a75a Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 18:35:52 +0200 Subject: [PATCH 1/8] correct the ways assignees have to be formatted --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 435932d..303003a 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,7 @@ The label to set on the new issue. ### assignees -optional +optional. A comma-separated list of users. Any assignees to set on the new issue: @@ -106,7 +106,7 @@ Any assignees to set on the new issue: - uses: scientific-python/issue-from-pytest-log-action@f94477e45ef40e4403d7585ba639a9a3bcc53d43 # v1.3.0 with: log-path: pytest-log.jsonl - assignees: ["user1", "user2"] + assignees: user1,user2 ``` Note that assignees must have the commit bit on the repository. From bb560861917cd39d29def3f7f872e7aa239b7861 Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 18:36:04 +0200 Subject: [PATCH 2/8] make the note more visible --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 303003a..ab1a803 100644 --- a/README.md +++ b/README.md @@ -109,4 +109,5 @@ Any assignees to set on the new issue: assignees: user1,user2 ``` -Note that assignees must have the commit bit on the repository. +> [!IMPORTANT] +> Note that assignees must have the commit bit on the repository. From e6d16f70a3efa48b17711a9c889c4f1c32870e7f Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 18:38:00 +0200 Subject: [PATCH 3/8] note about the file not necessarily having to exist --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index ab1a803..f4b8a74 100644 --- a/README.md +++ b/README.md @@ -68,6 +68,10 @@ required. Use `log-path` to specify where the output of `pytest-reportlog` is. +> [!NOTE] +> If the log file is missing (for example, because the workflow failed before `pytest` was run), the +> action will still open / update, but the issue will contain no details about the exact failure. + ### issue title optional. Default: `⚠️ Nightly upstream-dev CI failed ⚠️` From c5cfcdb9c582b90f65ece5745a3fb66f09d51556 Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 18:38:43 +0200 Subject: [PATCH 4/8] change the markup to important --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f4b8a74..fe469c6 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ How this works: To use the `issue-from-pytest-log` action in workflows, simply add a new step: -> [!WARNING] +> [!IMPORTANT] > The action won't run properly unless the `issues: write` permission is requested as shown below. ```yaml From 030a767b8679bae27d2d0f4a1f0d9ac36bae45cc Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 18:52:49 +0200 Subject: [PATCH 5/8] split the steps by the permissions needed --- README.md | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index fe469c6..59a8d32 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,8 @@ To use the `issue-from-pytest-log` action in workflows, simply add a new step: > The action won't run properly unless the `issues: write` permission is requested as shown below. ```yaml +permissions: {} + jobs: my-job: ... @@ -25,9 +27,6 @@ jobs: fail-fast: false ... - permissions: - issues: write - ... - uses: actions/setup-python@v4 @@ -45,16 +44,36 @@ jobs: - run: | pytest --report-log pytest-log.jsonl - ... + - uses: actions/upload-artifact@... + with: + name: log file + path: pytest-log-jsonl + + create-issue: + needs: my-job + runs-on: ubuntu-latest + + permissions: + issues: write + + steps: + - uses: actions/download-artifact@... + with: + name: log file + path: logs/ - uses: scientific-python/issue-from-pytest-log-action@f94477e45ef40e4403d7585ba639a9a3bcc53d43 # v1.3.0 if: | failure() && ... with: - log-path: pytest-log.jsonl + log-path: logs/pytest-log.jsonl ``` +> [!TIP] +> The above shows how to split the execution of tests from a task with elevated permissions (opening +> / updating an issue). This is good practice to reduce the risks of supply-chain attacks. + See [this repository](https://github.com/keewis/reportlog-test/issues) for example issues. For more realistic examples, see - `xarray` ([workflow](https://github.com/pydata/xarray/blob/main/.github/workflows/upstream-dev-ci.yaml), [example issue](https://github.com/pydata/xarray/issues/6197)) From 7ed1ba8f9d139029b44d2072f6ca06c65272bd78 Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 18:56:30 +0200 Subject: [PATCH 6/8] reflow --- README.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 59a8d32..a742118 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,8 @@ How this works: To use the `issue-from-pytest-log` action in workflows, simply add a new step: > [!IMPORTANT] -> The action won't run properly unless the `issues: write` permission is requested as shown below. +> The action won't run properly unless the `issues: write` permission is requested as +> shown below. ```yaml permissions: {} @@ -71,8 +72,9 @@ jobs: ``` > [!TIP] -> The above shows how to split the execution of tests from a task with elevated permissions (opening -> / updating an issue). This is good practice to reduce the risks of supply-chain attacks. +> The above shows how to split the execution of tests from a task with elevated +> permissions (opening / updating an issue). This is good practice to reduce the risks of +> supply-chain attacks. See [this repository](https://github.com/keewis/reportlog-test/issues) for example issues. For more realistic examples, see @@ -88,8 +90,9 @@ required. Use `log-path` to specify where the output of `pytest-reportlog` is. > [!NOTE] -> If the log file is missing (for example, because the workflow failed before `pytest` was run), the -> action will still open / update, but the issue will contain no details about the exact failure. +> If the log file is missing (for example, because the workflow failed before `pytest` was +> run), the action will still open / update, but the issue will contain no details about +> the exact failure. ### issue title From c1fa9167d1e4b9d07e7e7d4642e8f724d47aae69 Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sat, 27 Jun 2026 19:02:40 +0200 Subject: [PATCH 7/8] reword --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a742118..8bfa770 100644 --- a/README.md +++ b/README.md @@ -91,8 +91,8 @@ Use `log-path` to specify where the output of `pytest-reportlog` is. > [!NOTE] > If the log file is missing (for example, because the workflow failed before `pytest` was -> run), the action will still open / update, but the issue will contain no details about -> the exact failure. +> run), the action will still open / update, but the issue won't contain details about the +> exact failure. ### issue title From b32dbdcbc5e6b88b8fe7205a72ff9e38e97db36d Mon Sep 17 00:00:00 2001 From: Justus Magin Date: Sun, 28 Jun 2026 20:18:28 +0200 Subject: [PATCH 8/8] reword the tip about permissions --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 8bfa770..051ee97 100644 --- a/README.md +++ b/README.md @@ -72,9 +72,9 @@ jobs: ``` > [!TIP] -> The above shows how to split the execution of tests from a task with elevated -> permissions (opening / updating an issue). This is good practice to reduce the risks of -> supply-chain attacks. +> In the example above, the action is in a separate job from the test run to avoid giving +> untrusted code (typically nightly dependencies) access to a token that can modify the +> repository. This is good practice to reduce the risk of supply-chain attacks. See [this repository](https://github.com/keewis/reportlog-test/issues) for example issues. For more realistic examples, see