diff --git a/docs/contributing/images/architecture-app-mobile-diagram.png b/docs/_static_/images/architecture-app-mobile-diagram.png similarity index 100% rename from docs/contributing/images/architecture-app-mobile-diagram.png rename to docs/_static_/images/architecture-app-mobile-diagram.png diff --git a/docs/contributing/images/architecture-workspace-chart.png b/docs/_static_/images/architecture-workspace-chart.png similarity index 100% rename from docs/contributing/images/architecture-workspace-chart.png rename to docs/_static_/images/architecture-workspace-chart.png diff --git a/docs/_static_/images/ci-copy-fork-branch.png b/docs/_static_/images/ci-copy-fork-branch.png new file mode 100644 index 000000000..8d401229a Binary files /dev/null and b/docs/_static_/images/ci-copy-fork-branch.png differ diff --git a/docs/_static_/images/ci-tests-running.png b/docs/_static_/images/ci-tests-running.png new file mode 100644 index 000000000..25e465fd0 Binary files /dev/null and b/docs/_static_/images/ci-tests-running.png differ diff --git a/docs/contributing/architecture.md b/docs/contributing/architecture.md index 1ce06f142..72f05466a 100644 --- a/docs/contributing/architecture.md +++ b/docs/contributing/architecture.md @@ -10,7 +10,7 @@ There are three main parties: 2. The Electron app with Reactotron's UI, which subscribes to app updates 3. The app client that we are debugging, which sends commands with information about the app to the server -Diagram of the Reactotron Electron app, reactotron-core-server, and the app client +Diagram of the Reactotron Electron app, reactotron-core-server, and the app client Websockets are used to sends "commands", which are JSON objects with information about the app we are debugging. The payloads are sent to the server, which then publishes them to all subscribers (like the Electron app). @@ -18,7 +18,7 @@ Websockets are used to sends "commands", which are JSON objects with information This repository is broken into different workspaces: -Diagram of the Reactotron electron app and client, and which workspaces they correspond to. +Diagram of the Reactotron electron app and client, and which workspaces they correspond to. ### Reactotron app diff --git a/docs/contributing/running-scripts-from-untrusted-forks.md b/docs/contributing/running-scripts-from-untrusted-forks.md new file mode 100644 index 000000000..e3212bdce --- /dev/null +++ b/docs/contributing/running-scripts-from-untrusted-forks.md @@ -0,0 +1,48 @@ +--- +name: Running Tests on Untrusted Forks +sidebar_position: 99 +--- + +# Running CI Scripts on Untrusted Forks + +Untrusted forks could contain malicious code to mine cryptocurrency, steal secrets, or otherwise harm the CI server. + +For PRs from untrusted forks, to run the CI scripts, we need to: + +1. Review the code to ensure that it is safe to run on the CI server. +2. If the code is safe, run the `ci:trust` script to push the commits to a branch on the main repository, where the CI scripts can be run. +3. Once the tests have run, the status of the PR will be updated automatically (because the commits are the same). + + +## How to run the CI scripts on untrusted forks: + +1. Copy the name of the branch from the PR. + ci-copy-fork-branch +2. From your local clone of the main repository, run the `ci:trust` script. + ```bash + yarn ci:trust + ``` +3. The branch will be pushed and the tests will run + ci-tests-running + + +## What does ci:trust do? + +The `ci:trust` script does the following: + +1. Adds and fetches the untrusted fork as a temporary remote in your local repository. +2. Pushes the specific branch from the untrusted fork to a designated temporary branch in your original repository. +3. Pushing to a local branch triggers the continuous integration (CI) tests on the commits of the branch. +4. Because the commits are the same, the status of the PR will be updated automatically. + + +### Notes +1. The ci:trust script will only work if you have write access to the main repository. This prevents malicious users from running the script on the main repository. +2. The ci:trust script pushes the commits to a branch called `temp-branch-to-test-fork`. + +::: warning + +The `temp-branch-to-test-fork` branch will be deleted and recreated if it already exists. This allows the script to +clean up its own temporary branches. + +:::