Describe the bug
Pull requests from forks do not receive repository secrets. The workflow still writes an empty NETRC file and attempts certificate acquisition. The certificate command reports invalid credentials but exits successfully, so nine CADC-backed tests later fail with a missing TLS certificate on every Python version.
To reproduce
- Open a pull request from a fork.
- Let the Continuous Integration workflow finish.
- Observe that pre-commit passes and all five test jobs fail in the same nine tests.
PRs #172 through #176 show the current failure.
Expected behavior
Secret-free tests should run on every pull request. CADC-backed tests should run only in a trusted context with the repository credential. Certificate setup should stop immediately if it does not produce a valid certificate.
Proposed change
Mark the nine CADC-backed tests, exclude them on pull requests, and keep the full suite on trusted pushes to main. Validate the certificate before starting the tests and always remove credential files.
A maintainer should also decide whether the full credentialed suite must run before merge or whether the trusted main-branch run is sufficient.
Describe the bug
Pull requests from forks do not receive repository secrets. The workflow still writes an empty NETRC file and attempts certificate acquisition. The certificate command reports invalid credentials but exits successfully, so nine CADC-backed tests later fail with a missing TLS certificate on every Python version.
To reproduce
PRs #172 through #176 show the current failure.
Expected behavior
Secret-free tests should run on every pull request. CADC-backed tests should run only in a trusted context with the repository credential. Certificate setup should stop immediately if it does not produce a valid certificate.
Proposed change
Mark the nine CADC-backed tests, exclude them on pull requests, and keep the full suite on trusted pushes to main. Validate the certificate before starting the tests and always remove credential files.
A maintainer should also decide whether the full credentialed suite must run before merge or whether the trusted main-branch run is sufficient.