Skip to content

Commit 6c73437

Browse files
wesmcodex
wesm
and
codex
committed
ci: route trusted Linux builds to managed runners
Same-repository branches are controlled by repository collaborators and should use organization capacity, while fork pull requests remain arbitrary code. Main-branch reusable workflows make that trust decision enforceable even when a fork edits its own workflow files. Generated with Codex Co-authored-by: Codex <noreply@openai.com>
1 parent 285bfa3 commit 6c73437

7 files changed

Lines changed: 141 additions & 37 deletions

File tree

‎.github/workflows/bench-pr.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Bench Gate
2+
3+
# Fork PRs use GitHub-hosted runners. Same-repository PRs call the
4+
# main-branch workflow, whose Linux jobs can use the managed public fleet.
5+
on:
6+
pull_request:
7+
# Docs/frontend-only PRs cannot change the gated Go paths. If
8+
# this check is ever made required on branch protection, pair it
9+
# with a no-op sibling workflow on the inverse paths.
10+
paths:
11+
- "**.go"
12+
- "go.mod"
13+
- "go.sum"
14+
- "Makefile"
15+
- ".github/workflows/bench.yml"
16+
- ".github/workflows/bench-pr.yml"
17+
pull_request_target:
18+
# Docs/frontend-only PRs cannot change the gated Go paths. If
19+
# this check is ever made required on branch protection, pair it
20+
# with a no-op sibling workflow on the inverse paths.
21+
paths:
22+
- "**.go"
23+
- "go.mod"
24+
- "go.sum"
25+
- "Makefile"
26+
- ".github/workflows/bench.yml"
27+
- ".github/workflows/bench-pr.yml"
28+
29+
permissions: read-all
30+
31+
jobs:
32+
run:
33+
if: >-
34+
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) ||
35+
(github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name == github.repository)
36+
uses: kenn-io/agentsview/.github/workflows/bench.yml@main
37+
with:
38+
checkout_ref: refs/pull/${{ github.event.pull_request.number }}/merge

‎.github/workflows/bench.yml‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,13 @@ name: Bench Gate
2828
# produced still gate) rather than silently disabling the whole gate.
2929

3030
on:
31-
pull_request:
32-
# Docs/frontend-only PRs cannot change the gated Go paths. If
33-
# this check is ever made required on branch protection, pair it
34-
# with a no-op sibling workflow on the inverse paths.
35-
paths:
36-
- "**.go"
37-
- "go.mod"
38-
- "go.sum"
39-
- "Makefile"
40-
- ".github/workflows/bench.yml"
41-
31+
workflow_call:
32+
inputs:
33+
checkout_ref:
34+
description: Git ref to check out
35+
required: false
36+
type: string
37+
default: ""
4238
concurrency:
4339
group: bench-${{ github.head_ref || github.ref }}
4440
cancel-in-progress: true
@@ -49,10 +45,11 @@ permissions:
4945
jobs:
5046
bench-gate:
5147
name: Benchmark Gate
52-
runs-on: ubuntu-latest
48+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
5349
steps:
5450
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
5551
with:
52+
ref: ${{ inputs.checkout_ref || github.sha }}
5653
persist-credentials: false
5754
fetch-depth: 0
5855

‎.github/workflows/ci-pr.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: CI
2+
3+
# Fork PRs use GitHub-hosted runners. Same-repository PRs call the
4+
# main-branch workflow, whose Linux jobs can use the managed public fleet.
5+
on:
6+
pull_request:
7+
8+
pull_request_target:
9+
10+
11+
permissions: read-all
12+
13+
jobs:
14+
run:
15+
if: >-
16+
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) ||
17+
(github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name == github.repository)
18+
uses: kenn-io/agentsview/.github/workflows/ci.yml@main
19+
with:
20+
checkout_ref: refs/pull/${{ github.event.pull_request.number }}/merge

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,19 @@
11
name: CI
22

33
on:
4+
workflow_call:
5+
inputs:
6+
checkout_ref:
7+
description: Git ref to check out
8+
required: false
9+
type: string
10+
default: ""
411
push:
512
branches: [main]
613
# Run on every pull request regardless of base branch so stacked PRs that
714
# target another feature branch (not just main) still get the full test,
815
# lint, and e2e suite. The expensive desktop/tauri bundle builds are gated
916
# to main separately in desktop-artifacts.yml.
10-
pull_request:
11-
1217
concurrency:
1318
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
1419
cancel-in-progress: true
@@ -18,10 +23,11 @@ permissions:
1823

1924
jobs:
2025
lint:
21-
runs-on: ubuntu-latest
26+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
2227
steps:
2328
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2429
with:
30+
ref: ${{ inputs.checkout_ref || github.sha }}
2531
persist-credentials: false
2632

2733
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
@@ -37,10 +43,11 @@ jobs:
3743
run: make lint-ci
3844

3945
frontend:
40-
runs-on: ubuntu-latest
46+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
4147
steps:
4248
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
4349
with:
50+
ref: ${{ inputs.checkout_ref || github.sha }}
4451
persist-credentials: false
4552

4653
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -67,10 +74,11 @@ jobs:
6774
working-directory: frontend
6875

6976
frontend-node-25:
70-
runs-on: ubuntu-latest
77+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
7178
steps:
7279
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
7380
with:
81+
ref: ${{ inputs.checkout_ref || github.sha }}
7482
persist-credentials: false
7583

7684
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -86,10 +94,11 @@ jobs:
8694
working-directory: frontend
8795

8896
docs:
89-
runs-on: ubuntu-latest
97+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
9098
steps:
9199
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
92100
with:
101+
ref: ${{ inputs.checkout_ref || github.sha }}
93102
persist-credentials: false
94103

95104
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -108,10 +117,11 @@ jobs:
108117
run: make docs-check
109118

110119
scripts:
111-
runs-on: ubuntu-latest
120+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
112121
steps:
113122
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
114123
with:
124+
ref: ${{ inputs.checkout_ref || github.sha }}
115125
persist-credentials: false
116126

117127
- name: Run shell script tests
@@ -124,14 +134,15 @@ jobs:
124134
125135
test:
126136
name: Go Test (${{ matrix.os }})
127-
runs-on: ${{ matrix.os }}
137+
runs-on: ${{ contains(fromJSON('["ubuntu-latest","ubuntu-24.04","ubuntu-22.04"]'), matrix.os) && (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || matrix.os }}
128138
strategy:
129139
fail-fast: false
130140
matrix:
131141
os: [ubuntu-latest, windows-latest]
132142
steps:
133143
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
134144
with:
145+
ref: ${{ inputs.checkout_ref || github.sha }}
135146
fetch-depth: 0
136147
persist-credentials: false
137148

@@ -185,6 +196,7 @@ jobs:
185196
steps:
186197
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
187198
with:
199+
ref: ${{ inputs.checkout_ref || github.sha }}
188200
persist-credentials: false
189201

190202
- name: Prepare placeholder sidecar resource
@@ -215,10 +227,11 @@ jobs:
215227
run: cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml --lib install_downloaded_update
216228

217229
coverage:
218-
runs-on: ubuntu-latest
230+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
219231
steps:
220232
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
221233
with:
234+
ref: ${{ inputs.checkout_ref || github.sha }}
222235
fetch-depth: 0
223236
persist-credentials: false
224237

@@ -246,7 +259,7 @@ jobs:
246259
run: echo "::warning::Codecov upload failed"
247260

248261
integration:
249-
runs-on: ubuntu-latest
262+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
250263
services:
251264
postgres:
252265
image: pgvector/pgvector:pg18
@@ -264,6 +277,7 @@ jobs:
264277
steps:
265278
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
266279
with:
280+
ref: ${{ inputs.checkout_ref || github.sha }}
267281
fetch-depth: 0
268282
persist-credentials: false
269283

@@ -312,10 +326,11 @@ jobs:
312326
TEST_SSH_KEY: ${{ github.workspace }}/testdata/ssh/test_key
313327

314328
e2e:
315-
runs-on: ubuntu-latest
329+
runs-on: ${{ (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
316330
steps:
317331
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
318332
with:
333+
ref: ${{ inputs.checkout_ref || github.sha }}
319334
fetch-depth: 0
320335
persist-credentials: false
321336

‎.github/workflows/desktop-artifacts-pr.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Desktop Artifacts
2+
3+
# Fork PRs use GitHub-hosted runners. Same-repository PRs call the
4+
# main-branch workflow, whose Linux jobs can use the managed public fleet.
5+
on:
6+
pull_request:
7+
branches: [main]
8+
paths:
9+
- 'desktop/**'
10+
- 'frontend/**'
11+
- 'go.mod'
12+
- 'go.sum'
13+
- '.github/workflows/desktop-artifacts.yml'
14+
- '.github/actions/build-desktop-artifact/**'
15+
- '.github/workflows/desktop-artifacts-pr.yml'
16+
pull_request_target:
17+
branches: [main]
18+
paths:
19+
- 'desktop/**'
20+
- 'frontend/**'
21+
- 'go.mod'
22+
- 'go.sum'
23+
- '.github/workflows/desktop-artifacts.yml'
24+
- '.github/actions/build-desktop-artifact/**'
25+
- '.github/workflows/desktop-artifacts-pr.yml'
26+
27+
permissions: read-all
28+
29+
jobs:
30+
run:
31+
if: >-
32+
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) ||
33+
(github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name == github.repository)
34+
uses: kenn-io/agentsview/.github/workflows/desktop-artifacts.yml@main
35+
with:
36+
checkout_ref: refs/pull/${{ github.event.pull_request.number }}/merge

‎.github/workflows/desktop-artifacts.yml‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,15 @@
11
name: Desktop Artifacts
22

33
on:
4-
# Keep this workflow GitHub-hosted so pull requests cannot select a
5-
# persistent runner. macOS builds live in desktop-macos-main.yml.
4+
workflow_call:
5+
inputs:
6+
checkout_ref:
7+
description: Git ref to check out
8+
required: false
9+
type: string
10+
default: ""
11+
# Linux builds use the managed public fleet for main and same-repository PRs.
12+
# macOS builds live in desktop-macos-main.yml.
613
push:
714
branches: [main]
815
paths:
@@ -12,16 +19,6 @@ on:
1219
- 'go.sum'
1320
- '.github/workflows/desktop-artifacts.yml'
1421
- '.github/actions/build-desktop-artifact/**'
15-
pull_request:
16-
branches: [main]
17-
paths:
18-
- 'desktop/**'
19-
- 'frontend/**'
20-
- 'go.mod'
21-
- 'go.sum'
22-
- '.github/workflows/desktop-artifacts.yml'
23-
- '.github/actions/build-desktop-artifact/**'
24-
2522
permissions:
2623
contents: read
2724

@@ -32,7 +29,7 @@ concurrency:
3229
jobs:
3330
build:
3431
name: Desktop Build (${{ matrix.name }})
35-
runs-on: ${{ matrix.os }}
32+
runs-on: ${{ contains(fromJSON('["ubuntu-latest","ubuntu-24.04","ubuntu-22.04"]'), matrix.os) && (github.event_name == 'pull_request_target' || github.ref == 'refs/heads/main') && 'kenn-linux-x64-public' || matrix.os }}
3633
strategy:
3734
fail-fast: false
3835
matrix:
@@ -58,6 +55,7 @@ jobs:
5855
steps:
5956
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
6057
with:
58+
ref: ${{ inputs.checkout_ref || github.sha }}
6159
persist-credentials: false
6260

6361
- uses: ./.github/actions/build-desktop-artifact

‎.github/workflows/docker.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ env:
1616

1717
jobs:
1818
build-and-push:
19-
runs-on: ubuntu-latest
19+
runs-on: ${{ github.ref == 'refs/heads/main' && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
2020
steps:
2121
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2222
with:

0 commit comments

Comments
 (0)