Bind trusted runner routing to canonical PR revisions - #1271
Merged
Conversation
Require the canonical repository identity before selecting the managed Linux fleet so fork-local events cannot request an unavailable organization label. Pass the immutable pull request event SHA into the main-pinned reusable workflows so checks and checkout target the same revision.
roborev: Combined Review (
|
The managed Linux runner deliberately has a lean base image, so desktop builds cannot rely on the hosted image's preinstalled Rust toolchain. Install stable Rust explicitly in the shared composite action.\n\nThe EPYC node also exposes far more logical CPUs than a runner pod requests, causing Playwright to launch 34 workers and overload the browser tests. Bound CI to eight workers so concurrency reflects the pod allocation while retaining parallel coverage.
roborev: Combined Review (
|
The same-size rewrite fixture can complete within one overlayfs change-time tick, making its before and after signatures identical even though native change-time support is working. Retry the fixture until the filesystem exposes a new tick so coverage jobs test the intended signature contract instead of the runner filesystem's effective timestamp resolution.
Let the main-pinned reusable workflows derive checkout directly from the caller event instead of accepting a ref from the pull request-controlled dispatcher. This removes the remaining caller-controlled input at the runner trust boundary and keeps each check tied to the revision GitHub associated with the run.
Tauri collapses linuxdeploy failures to a generic bundling error in normal mode, hiding the plugin or dependency that actually failed. Keep verbose bundler output enabled for desktop artifacts so the managed Linux image can be diagnosed from the workflow log without privileged host access.
roborev: Combined Review (
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trusted Linux jobs should select the managed runner only when the workflow is executing in the canonical repository. Fork-local events must remain on GitHub-hosted labels even when their branch and repository identities match each other.
The PR dispatchers call main-pinned reusable workflows without runner, trust, or checkout inputs. Those workflows independently derive trust from the canonical head and base repository identities, while checkout uses the immutable SHA GitHub associated with the caller event.
The managed image is intentionally lean, so the desktop composite explicitly installs a commit-pinned stable Rust toolchain instead of relying on hosted-image defaults. Playwright CI is bounded to eight workers because the host exposes more logical CPUs than each runner pod requests.
The coverage fixture now waits for the filesystem to expose a new change-time tick before asserting same-size rewrite detection, avoiding false failures on fast overlay filesystems without weakening the signature assertion.