Fix running tests on PRs from forks#5100
Conversation
andrewnester
requested review from
denik,
pietern,
shreyas-goenka and
simonfaltum
andrewnester
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
andrewnester
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Waiting for approvalBased on git history, these people are best suited to review:
Eligible reviewers: Suggestions based on git history. See OWNERS for ownership rules. |
andrewnester
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
andrewnester
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
| # Protected runner groups and JFrog OIDC auth are not available for fork PRs. | ||
| # Each job mirrors its non-fork counterpart but uses a single OS and is-fork: 'true'. | ||
|
|
||
| test-fork: |
There was a problem hiding this comment.
question - Can we reuse the same jobs as regular bit parametrize runner?
Ideally we would not have to maintain separate jobs, especially given that they are hard to test.
|
|
||
| # Fork PR variants: run on ubuntu-latest with public Go/Python proxies. | ||
| # Protected runner groups and JFrog OIDC auth are not available for fork PRs. | ||
| # Each job mirrors its non-fork counterpart but uses a single OS and is-fork: 'true'. |
There was a problem hiding this comment.
single OS
what single OS? why?
| - go.sum | ||
| schedule: | ||
| - cron: '0 6 * * *' # Daily — prevents 7-day GitHub cache eviction | ||
| workflow_dispatch: |
There was a problem hiding this comment.
Does this workflow require an approval from us? Claude flagged that historically there have been arbitary code execution vectors via things like this (e.g. if you use cgo, and then use compile time macros)
There was a problem hiding this comment.
This is triggered on main barcnh only so can't be executed from PR code
| steps: | ||
| - name: Detect fork PR | ||
| id: check | ||
| run: | |
There was a problem hiding this comment.
maybe can be simplied? Claude recommended:
env:
IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
run: echo "is_fork=${IS_FORK:-false}" >> "$GITHUB_OUTPUT"
3 participants
Changes
Fix running tests on PRs from forks
Why
Problem
PRs from forks fail CI entirely. Two root causes:
Solution
Pre-warm the Go module download cache from a privileged workflow on main, then restore it in fork PR workflows using Go's file:// proxy in offline mode - no JFrog credentials required.