Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114241
To: Nikita Popov <nikita.ppv@gmail.com>, Joe Watkins <krakjoe@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <1fadb99e-8880-b491-9db6-a9923c4d02d2@gmx.de>
 <CAF+90c99afneHo9FGEWTxwF3_0AW=M6FvsXiDB=HfdjEz1LVSQ@mail.gmail.com>
 <CAOwTYAsmEOeUDhwcV-7f9OzkcEYBvTtWW5xVhrs2hwpTs=U=cQ@mail.gmail.com>
 <CAF+90c_SKpNKRJw3PPexKXDDd7z=LZwMmXi3QYK+_md8BHwFtA@mail.gmail.com>
Message-ID: <9bc166f5-538d-5824-1fa1-e1a3df8bae36@gmx.de>
Date: Wed, 28 Apr 2021 17:04:23 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.0
MIME-Version: 1.0
In-Reply-To: <CAF+90c_SKpNKRJw3PPexKXDDd7z=LZwMmXi3QYK+_md8BHwFtA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Retire distributions repo in favor of something more
 suitable
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 28.04.2021 at 16:47, Nikita Popov wrote:

> On Wed, Apr 28, 2021 at 4:18 PM Joe Watkins <krakjoe@gmail.com> wrote:
>
>> That's a good point.
>>
>> I suppose the most we can do is prevent accidental committing of such
>> things.
>>
>> Appears to be two "solutions" ...
>>
>> We could distribute a pre-commit hook, which is somewhere between "not
>> bad", and "pretty awkward" if your git installation is old.
>> We could setup one of the unused boxes we have and leverage
>> api/actions/whatever and catch bad commits after they happen.
>>
>> Neither of these are perfect solutions ... and I've never tried using
>> hooks with github, but with a quick read it seems people do it - it's
>> another paragraph in the git/vcs readme on the wiki.
>>
>> Any more ideas ?
>
> I don't think the tags themselves are a problem -- for those at least we
> have an audit trail in the form of our webhook integration, which sends =
out
> emails for all tag creations/deletions, and by whom they were made. I'm =
not
> even sure if our old karma setup had any special protection for tag
> creation.
>
> Having looked a bit closer now, it looks like the same would work for
> release assets as well. There are webhooks for changes to releases, whic=
h
> also list assets and who uploaded them. That should at least make us awa=
re
> of any changes.

I think we can set up an approval workflow
(<https://dev.to/azure/using-environments-for-approval-workflows-with-gith=
ub-actions-4962>).

Christoph