From 5addf6d8e55e89c70be429155f1a11208d83f0ab Mon Sep 17 00:00:00 2001 From: Anderson Nogueira Date: Tue, 21 Jul 2026 13:18:02 +0000 Subject: [PATCH] PS-11078 [9.7]: Skip orphan-sweep runs on forks - Job-level repository guard on both jobs so forks with Actions enabled stop inheriting the hourly cron, which fails without the canonical repo's secrets and OIDC trust and emails the fork owner every hour. --- .github/workflows/orphan-sweep.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/orphan-sweep.yml b/.github/workflows/orphan-sweep.yml index 8d68a746304b..76a97e4d8731 100644 --- a/.github/workflows/orphan-sweep.yml +++ b/.github/workflows/orphan-sweep.yml @@ -2,6 +2,10 @@ # GHA runners. Companion to builds.yml; catches orphans from control-plane # crashes, cancelled workflows, and probe-step leaks. # +# Runs only in percona/percona-server: forks that enable Actions would +# otherwise inherit the hourly cron and fail every run (no secrets, and +# the AWS OIDC trust rejects fork subjects), spamming the fork owner. +# # PS-11179 (2026-05-28): EC2 sweep added for the AWS fallback path. name: orphan-sweep @@ -30,6 +34,7 @@ concurrency: jobs: sweep: + if: github.repository == 'percona/percona-server' runs-on: ubuntu-latest permissions: {} env: @@ -143,6 +148,7 @@ jobs: # OIDC -> STS via the same AWS_ROLE_ARN used by builds.yml. Region pinned # to eu-central-1 (matches create-runner-aws). sweep-ec2: + if: github.repository == 'percona/percona-server' runs-on: ubuntu-latest permissions: contents: read