From 351f0f3293fab36d9f66de8549cfff183f1bbccf Mon Sep 17 00:00:00 2001 From: kjgbot Date: Fri, 9 Oct 2026 17:29:26 -0700 Subject: [PATCH 1/7] Revert "ci(fleet-e2e): update stale branch note for trunk gating" This reverts commit 6ef6f86c1cb35504db1c353789de4243bc71ed8d. --- .github/workflows/fleet-e2e.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/fleet-e2e.yml b/.github/workflows/fleet-e2e.yml index f2dfe93c5f..54e08bcd62 100644 --- a/.github/workflows/fleet-e2e.yml +++ b/.github/workflows/fleet-e2e.yml @@ -9,9 +9,10 @@ name: Fleet E2E # engine build), which rust-cache amortises on warm runs. The 20-minute job # timeout is a cold-build ceiling, not the matrix runtime. -# NOTE on branches: CI runs only on this repository's `trunk` -> `main` PR and -# on pushes to `main` (see the job `if:`). Feature branches, including -# `feat/fleet-*`, merge into `trunk` without CI. +# NOTE on branches: the fleet stack is developed on `feat/fleet-*` branches that +# merge into each other before `main`, so the trigger must include them — gating +# on `[main]` alone leaves this job inert for the entire feature stack (it would +# only run after something reaches main). Update to `[main]` once the stack lands. on: push: branches: [main] From b821ff94513094c177b88c72738dd498e4f52174 Mon Sep 17 00:00:00 2001 From: kjgbot Date: Fri, 9 Oct 2026 17:29:26 -0700 Subject: [PATCH 2/7] Revert "ci: harden trunk gating" This reverts commit 9024ae34e5f405da530005f8814d041fee7f0077. --- .github/workflows/cancel-on-merge.yml | 4 +++- .github/workflows/codegen-models.yml | 2 +- .github/workflows/e2e-tests.yml | 2 +- .github/workflows/fleet-e2e.yml | 2 +- .github/workflows/large-files.yml | 2 +- .github/workflows/node-compat.yml | 6 +++--- .github/workflows/package-validation.yml | 8 ++++---- .github/workflows/prettier-fmt-fix.yml | 2 +- .github/workflows/relay-evals.yml | 2 +- .github/workflows/relayflow-pr-proof-broker.yml | 2 +- .github/workflows/rust-ci.yml | 14 +++++++------- .github/workflows/rust-fmt-fix.yml | 2 +- .github/workflows/security.yml | 12 ++++++------ .github/workflows/stress-tests.yml | 6 +++--- .../workflows/targeted-feature-verification.yml | 4 ++-- .github/workflows/test-build.yml | 6 +++--- .github/workflows/test-install.yml | 12 ++++++------ .github/workflows/test.yml | 12 ++++++------ .github/workflows/trunk-guard.yml | 15 +++++---------- 19 files changed, 56 insertions(+), 59 deletions(-) diff --git a/.github/workflows/cancel-on-merge.yml b/.github/workflows/cancel-on-merge.yml index a18c65315a..592ab6cad5 100644 --- a/.github/workflows/cancel-on-merge.yml +++ b/.github/workflows/cancel-on-merge.yml @@ -6,7 +6,9 @@ on: jobs: cancel: - if: github.event.pull_request.merged == true + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && + (github.event.pull_request.merged == true) runs-on: ubuntu-latest steps: - name: Cancel running workflows for this PR diff --git a/.github/workflows/codegen-models.yml b/.github/workflows/codegen-models.yml index 72f21434cb..4261bb366e 100644 --- a/.github/workflows/codegen-models.yml +++ b/.github/workflows/codegen-models.yml @@ -12,7 +12,7 @@ on: jobs: codegen: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' runs-on: ubuntu-latest permissions: contents: write diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 6adfe08250..a6b6842589 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -35,7 +35,7 @@ env: jobs: e2e-test: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: E2E Integration Test runs-on: ${{ matrix.os }} strategy: diff --git a/.github/workflows/fleet-e2e.yml b/.github/workflows/fleet-e2e.yml index 54e08bcd62..df4f591cd1 100644 --- a/.github/workflows/fleet-e2e.yml +++ b/.github/workflows/fleet-e2e.yml @@ -54,7 +54,7 @@ env: jobs: fleet-e2e: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Two-node fleet matrix runs-on: ubuntu-latest timeout-minutes: 20 diff --git a/.github/workflows/large-files.yml b/.github/workflows/large-files.yml index 306839141b..b4e35abb9d 100644 --- a/.github/workflows/large-files.yml +++ b/.github/workflows/large-files.yml @@ -2,7 +2,7 @@ name: Large File Check on: [pull_request] jobs: check: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/node-compat.yml b/.github/workflows/node-compat.yml index cf365c1f21..b49a24880c 100644 --- a/.github/workflows/node-compat.yml +++ b/.github/workflows/node-compat.yml @@ -18,13 +18,13 @@ concurrency: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml install-test: name: Install Test (Node ${{ matrix.node-version }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest strategy: @@ -87,7 +87,7 @@ jobs: name: Fresh Install (Node ${{ matrix.node-version }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/package-validation.yml b/.github/workflows/package-validation.yml index 48f2414850..1e7a9adf14 100644 --- a/.github/workflows/package-validation.yml +++ b/.github/workflows/package-validation.yml @@ -21,13 +21,13 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml validate: name: Build & Validate needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest env: @@ -203,7 +203,7 @@ jobs: name: Publish Fresh Install Build needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest env: @@ -253,7 +253,7 @@ jobs: # provisioning an undeletable workspace; other same-repository PRs and # main pushes must reuse the CI workspace. if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) runs-on: macos-latest env: diff --git a/.github/workflows/prettier-fmt-fix.yml b/.github/workflows/prettier-fmt-fix.yml index baa274e8ec..763587d187 100644 --- a/.github/workflows/prettier-fmt-fix.yml +++ b/.github/workflows/prettier-fmt-fix.yml @@ -39,7 +39,7 @@ jobs: runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) permissions: contents: write diff --git a/.github/workflows/relay-evals.yml b/.github/workflows/relay-evals.yml index c646a2d136..48066368a4 100644 --- a/.github/workflows/relay-evals.yml +++ b/.github/workflows/relay-evals.yml @@ -38,7 +38,7 @@ env: jobs: evals: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Offline evals runs-on: ubuntu-latest diff --git a/.github/workflows/relayflow-pr-proof-broker.yml b/.github/workflows/relayflow-pr-proof-broker.yml index 3b3000b6e8..d90146aa95 100644 --- a/.github/workflows/relayflow-pr-proof-broker.yml +++ b/.github/workflows/relayflow-pr-proof-broker.yml @@ -31,7 +31,7 @@ jobs: build: name: ${{ github.event_name == 'pull_request' && 'Validate PR-head Linux broker' || 'Build exact Linux broker' }} if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) runs-on: ubuntu-latest timeout-minutes: 30 diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 21eb358cf3..662b275a7b 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -17,14 +17,14 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml rust-test: name: Rust Tests (${{ matrix.os }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -46,7 +46,7 @@ jobs: name: Relay PTY Synchronization Tests (windows-latest) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.rust_changed == 'true') runs-on: windows-latest timeout-minutes: 10 @@ -68,7 +68,7 @@ jobs: name: Cross-compile check (${{ matrix.target }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -104,7 +104,7 @@ jobs: name: Clippy (${{ matrix.os }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -125,7 +125,7 @@ jobs: name: Format needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.rust_changed == 'true') runs-on: ubuntu-latest steps: @@ -139,7 +139,7 @@ jobs: name: SDK TypeScript Check needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: diff --git a/.github/workflows/rust-fmt-fix.yml b/.github/workflows/rust-fmt-fix.yml index 1df1a6ab78..614ecc44a6 100644 --- a/.github/workflows/rust-fmt-fix.yml +++ b/.github/workflows/rust-fmt-fix.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) permissions: contents: write diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 89d55e1c7c..083b90b5cd 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,7 +21,7 @@ concurrency: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml # NPM audit for known vulnerabilities @@ -29,7 +29,7 @@ jobs: name: NPM Audit needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest @@ -61,7 +61,7 @@ jobs: name: Dependency Review runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (github.event_name == 'pull_request') # This job requires the dependency graph to be enabled in repo settings # Make it non-blocking until that's configured @@ -83,7 +83,7 @@ jobs: name: CodeQL Analysis needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest permissions: @@ -111,7 +111,7 @@ jobs: # Secret scanning (check for accidentally committed secrets) secrets-scan: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Secret Scanning runs-on: ubuntu-latest # Make non-blocking - review findings manually @@ -144,7 +144,7 @@ jobs: name: License Compliance needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest diff --git a/.github/workflows/stress-tests.yml b/.github/workflows/stress-tests.yml index ccaaa351d1..035fe1c114 100644 --- a/.github/workflows/stress-tests.yml +++ b/.github/workflows/stress-tests.yml @@ -29,7 +29,7 @@ concurrency: jobs: stress-test-orchestrator: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Orchestrator Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -79,7 +79,7 @@ jobs: fi stress-test-orchestrator-integration: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Orchestrator Integration Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -164,7 +164,7 @@ jobs: needs: [stress-test-orchestrator, stress-test-orchestrator-integration] runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (always()) steps: diff --git a/.github/workflows/targeted-feature-verification.yml b/.github/workflows/targeted-feature-verification.yml index 429a8d8489..52aa4f1026 100644 --- a/.github/workflows/targeted-feature-verification.yml +++ b/.github/workflows/targeted-feature-verification.yml @@ -35,7 +35,7 @@ concurrency: jobs: select: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Select Flows v2 shards runs-on: ubuntu-24.04 timeout-minutes: 15 @@ -94,7 +94,7 @@ jobs: retention-days: 14 targeted: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Flows v2 shard ${{ matrix.shard }} needs: select runs-on: ubuntu-24.04 diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml index 4a15760e00..19ea0e52a7 100644 --- a/.github/workflows/test-build.yml +++ b/.github/workflows/test-build.yml @@ -21,7 +21,7 @@ env: jobs: test-build-script: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test build-bun.sh runs-on: ${{ matrix.os }} strategy: @@ -109,7 +109,7 @@ jobs: done test-build-edge-cases: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test edge cases runs-on: ubuntu-latest @@ -158,7 +158,7 @@ jobs: needs: [test-build-script, test-build-edge-cases] runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (always()) steps: diff --git a/.github/workflows/test-install.yml b/.github/workflows/test-install.yml index 47ab6edb4a..de387c77df 100644 --- a/.github/workflows/test-install.yml +++ b/.github/workflows/test-install.yml @@ -26,7 +26,7 @@ env: jobs: test-install: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test on ${{ matrix.os }} (${{ matrix.node }}) runs-on: ${{ matrix.os }} strategy: @@ -183,7 +183,7 @@ jobs: # Test fallback when gunzip is not available test-no-gunzip: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test without gunzip runs-on: ubuntu-latest @@ -228,7 +228,7 @@ jobs: ' test-install-alpine: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test on Alpine Linux runs-on: ubuntu-latest @@ -268,7 +268,7 @@ jobs: ' test-install-fedora: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test on Fedora runs-on: ubuntu-latest @@ -304,7 +304,7 @@ jobs: # Test script syntax and edge cases test-script-quality: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Script Quality Checks runs-on: ubuntu-latest @@ -352,7 +352,7 @@ jobs: needs: [test-install, test-install-alpine, test-install-fedora, test-no-gunzip, test-script-quality] runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (always()) steps: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 785c27a46b..3ec1dda0cf 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,13 +21,13 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml test: needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -65,7 +65,7 @@ jobs: name: Windows credential ACL validation needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: windows-latest steps: @@ -98,7 +98,7 @@ jobs: name: Coverage (upload) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: @@ -128,7 +128,7 @@ jobs: lint: needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: @@ -157,7 +157,7 @@ jobs: name: Swift SDK Tests needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && (needs.changes.outputs.sdk_swift_changed == 'true') runs-on: macos-latest defaults: diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml index fbe379e4bf..2ddb49758d 100644 --- a/.github/workflows/trunk-guard.yml +++ b/.github/workflows/trunk-guard.yml @@ -1,22 +1,17 @@ name: Trunk guard -# Only this repository's `trunk` branch may merge into main. Feature branches -# merge into `trunk`; CI runs only on the trunk -> main PR. -# pull_request_target loads this workflow from the base branch, so a PR cannot -# edit the guard to pass itself. It never checks out PR code. +# Only the `trunk` branch may merge into main. Feature branches merge into +# `trunk` (via the merge train); CI runs only on the trunk -> main PR. on: - pull_request_target: + pull_request: branches: [main] - types: [opened, synchronize, reopened, edited] - -permissions: {} jobs: only-trunk-merges-to-main: - if: github.head_ref != 'trunk' || github.event.pull_request.head.repo.full_name != github.repository + if: github.head_ref != 'trunk' runs-on: ubuntu-latest timeout-minutes: 1 steps: - run: | - echo "::error::Only this repository's 'trunk' branch may merge into main. Retarget this PR to 'trunk'." + echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'." exit 1 From fbbff5da59b3d422220d36dd1ff81c7809ff84c2 Mon Sep 17 00:00:00 2001 From: kjgbot Date: Fri, 9 Oct 2026 17:29:26 -0700 Subject: [PATCH 3/7] Revert "ci: run CI only for trunk PRs and main pushes" This reverts commit 649a3c91004e4f3056fc10c7ad51d99f5ba5c8fd. --- .github/workflows/cancel-on-merge.yml | 4 +-- .github/workflows/codegen-models.yml | 4 +-- .github/workflows/e2e-tests.yml | 1 - .github/workflows/fleet-e2e.yml | 3 +-- .github/workflows/large-files.yml | 1 - .github/workflows/node-compat.yml | 9 ++----- .github/workflows/package-validation.yml | 14 ++++------- .github/workflows/prettier-fmt-fix.yml | 4 +-- .github/workflows/relay-evals.yml | 1 - .../workflows/relayflow-pr-proof-broker.yml | 4 +-- .github/workflows/rust-ci.yml | 25 +++++-------------- .github/workflows/rust-fmt-fix.yml | 4 +-- .github/workflows/security.yml | 18 +++---------- .github/workflows/stress-tests.yml | 6 +---- .../targeted-feature-verification.yml | 2 -- .github/workflows/test-build.yml | 7 +----- .github/workflows/test-install.yml | 10 +------- .github/workflows/test.yml | 21 ++++------------ .github/workflows/trunk-guard.yml | 17 ------------- 19 files changed, 33 insertions(+), 122 deletions(-) delete mode 100644 .github/workflows/trunk-guard.yml diff --git a/.github/workflows/cancel-on-merge.yml b/.github/workflows/cancel-on-merge.yml index 592ab6cad5..a18c65315a 100644 --- a/.github/workflows/cancel-on-merge.yml +++ b/.github/workflows/cancel-on-merge.yml @@ -6,9 +6,7 @@ on: jobs: cancel: - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (github.event.pull_request.merged == true) + if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - name: Cancel running workflows for this PR diff --git a/.github/workflows/codegen-models.yml b/.github/workflows/codegen-models.yml index 4261bb366e..b8c27c4672 100644 --- a/.github/workflows/codegen-models.yml +++ b/.github/workflows/codegen-models.yml @@ -5,14 +5,14 @@ on: paths: - 'packages/utils/cli-registry.yaml' branches: - [main] + - main + - 'feature/**' pull_request: paths: - 'packages/utils/cli-registry.yaml' jobs: codegen: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' runs-on: ubuntu-latest permissions: contents: write diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index a6b6842589..188accab94 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -35,7 +35,6 @@ env: jobs: e2e-test: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: E2E Integration Test runs-on: ${{ matrix.os }} strategy: diff --git a/.github/workflows/fleet-e2e.yml b/.github/workflows/fleet-e2e.yml index df4f591cd1..21e7221a36 100644 --- a/.github/workflows/fleet-e2e.yml +++ b/.github/workflows/fleet-e2e.yml @@ -15,7 +15,7 @@ name: Fleet E2E # only run after something reaches main). Update to `[main]` once the stack lands. on: push: - branches: [main] + branches: [main, 'feat/fleet-**'] paths: - 'packages/fleet/**' - 'packages/cli/**' @@ -54,7 +54,6 @@ env: jobs: fleet-e2e: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Two-node fleet matrix runs-on: ubuntu-latest timeout-minutes: 20 diff --git a/.github/workflows/large-files.yml b/.github/workflows/large-files.yml index b4e35abb9d..ee6e2afb01 100644 --- a/.github/workflows/large-files.yml +++ b/.github/workflows/large-files.yml @@ -2,7 +2,6 @@ name: Large File Check on: [pull_request] jobs: check: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/node-compat.yml b/.github/workflows/node-compat.yml index b49a24880c..4bc54e16c7 100644 --- a/.github/workflows/node-compat.yml +++ b/.github/workflows/node-compat.yml @@ -18,14 +18,11 @@ concurrency: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml install-test: name: Install Test (Node ${{ matrix.node-version }}) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest strategy: matrix: @@ -86,9 +83,7 @@ jobs: fresh-install: name: Fresh Install (Node ${{ matrix.node-version }}) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest strategy: matrix: diff --git a/.github/workflows/package-validation.yml b/.github/workflows/package-validation.yml index 1e7a9adf14..71fb731758 100644 --- a/.github/workflows/package-validation.yml +++ b/.github/workflows/package-validation.yml @@ -21,14 +21,11 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml validate: name: Build & Validate needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest env: NPM_CONFIG_FUND: false @@ -202,9 +199,7 @@ jobs: publish-fresh-install-build: name: Publish Fresh Install Build needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest env: NPM_CONFIG_FUND: false @@ -253,8 +248,9 @@ jobs: # provisioning an undeletable workspace; other same-repository PRs and # main pushes must reuse the CI workspace. if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) + needs.changes.outputs.node_changed == 'true' && + github.actor != 'dependabot[bot]' && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) runs-on: macos-latest env: NPM_CONFIG_FUND: false diff --git a/.github/workflows/prettier-fmt-fix.yml b/.github/workflows/prettier-fmt-fix.yml index 763587d187..4f85827b3c 100644 --- a/.github/workflows/prettier-fmt-fix.yml +++ b/.github/workflows/prettier-fmt-fix.yml @@ -38,9 +38,7 @@ jobs: name: Auto-format Prettier files runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository permissions: contents: write steps: diff --git a/.github/workflows/relay-evals.yml b/.github/workflows/relay-evals.yml index 48066368a4..dc3ea0f592 100644 --- a/.github/workflows/relay-evals.yml +++ b/.github/workflows/relay-evals.yml @@ -38,7 +38,6 @@ env: jobs: evals: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Offline evals runs-on: ubuntu-latest diff --git a/.github/workflows/relayflow-pr-proof-broker.yml b/.github/workflows/relayflow-pr-proof-broker.yml index d90146aa95..6c152d9baa 100644 --- a/.github/workflows/relayflow-pr-proof-broker.yml +++ b/.github/workflows/relayflow-pr-proof-broker.yml @@ -31,8 +31,8 @@ jobs: build: name: ${{ github.event_name == 'pull_request' && 'Validate PR-head Linux broker' || 'Build exact Linux broker' }} if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) + github.event_name != 'pull_request_target' || + github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest timeout-minutes: 30 steps: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 662b275a7b..bf8833d3e9 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -17,15 +17,12 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml rust-test: name: Rust Tests (${{ matrix.os }}) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.rust_changed == 'true') + if: needs.changes.outputs.rust_changed == 'true' runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -45,9 +42,7 @@ jobs: relay-pty-windows-test: name: Relay PTY Synchronization Tests (windows-latest) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.rust_changed == 'true') + if: needs.changes.outputs.rust_changed == 'true' runs-on: windows-latest timeout-minutes: 10 steps: @@ -67,9 +62,7 @@ jobs: rust-cross-compile: name: Cross-compile check (${{ matrix.target }}) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.rust_changed == 'true') + if: needs.changes.outputs.rust_changed == 'true' runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -103,9 +96,7 @@ jobs: rust-clippy: name: Clippy (${{ matrix.os }}) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.rust_changed == 'true') + if: needs.changes.outputs.rust_changed == 'true' runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -124,9 +115,7 @@ jobs: rust-fmt: name: Format needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.rust_changed == 'true') + if: needs.changes.outputs.rust_changed == 'true' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -138,9 +127,7 @@ jobs: sdk-check: name: SDK TypeScript Check needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/rust-fmt-fix.yml b/.github/workflows/rust-fmt-fix.yml index 614ecc44a6..70472298f0 100644 --- a/.github/workflows/rust-fmt-fix.yml +++ b/.github/workflows/rust-fmt-fix.yml @@ -20,9 +20,7 @@ jobs: name: Auto-format Rust code runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository permissions: contents: write steps: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 083b90b5cd..13e4df2794 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,16 +21,13 @@ concurrency: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml # NPM audit for known vulnerabilities npm-audit: name: NPM Audit needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest steps: @@ -60,9 +57,7 @@ jobs: dependency-review: name: Dependency Review runs-on: ubuntu-latest - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (github.event_name == 'pull_request') + if: github.event_name == 'pull_request' # This job requires the dependency graph to be enabled in repo settings # Make it non-blocking until that's configured continue-on-error: true @@ -82,9 +77,7 @@ jobs: codeql: name: CodeQL Analysis needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest permissions: security-events: write @@ -111,7 +104,6 @@ jobs: # Secret scanning (check for accidentally committed secrets) secrets-scan: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Secret Scanning runs-on: ubuntu-latest # Make non-blocking - review findings manually @@ -143,9 +135,7 @@ jobs: license-check: name: License Compliance needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest steps: diff --git a/.github/workflows/stress-tests.yml b/.github/workflows/stress-tests.yml index 035fe1c114..323dbbf0a2 100644 --- a/.github/workflows/stress-tests.yml +++ b/.github/workflows/stress-tests.yml @@ -29,7 +29,6 @@ concurrency: jobs: stress-test-orchestrator: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Orchestrator Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -79,7 +78,6 @@ jobs: fi stress-test-orchestrator-integration: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Orchestrator Integration Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -163,9 +161,7 @@ jobs: name: Stress Test Summary needs: [stress-test-orchestrator, stress-test-orchestrator-integration] runs-on: ubuntu-latest - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (always()) + if: always() steps: - name: Download all artifacts diff --git a/.github/workflows/targeted-feature-verification.yml b/.github/workflows/targeted-feature-verification.yml index 52aa4f1026..3e9fc7f724 100644 --- a/.github/workflows/targeted-feature-verification.yml +++ b/.github/workflows/targeted-feature-verification.yml @@ -35,7 +35,6 @@ concurrency: jobs: select: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Select Flows v2 shards runs-on: ubuntu-24.04 timeout-minutes: 15 @@ -94,7 +93,6 @@ jobs: retention-days: 14 targeted: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Flows v2 shard ${{ matrix.shard }} needs: select runs-on: ubuntu-24.04 diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml index 19ea0e52a7..abc1a1918f 100644 --- a/.github/workflows/test-build.yml +++ b/.github/workflows/test-build.yml @@ -2,7 +2,6 @@ name: Test Build Scripts on: push: - branches: [main] paths: - 'scripts/build-bun.sh' - 'scripts/sign-macos-binary.sh' @@ -21,7 +20,6 @@ env: jobs: test-build-script: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test build-bun.sh runs-on: ${{ matrix.os }} strategy: @@ -109,7 +107,6 @@ jobs: done test-build-edge-cases: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test edge cases runs-on: ubuntu-latest @@ -157,9 +154,7 @@ jobs: name: Summary needs: [test-build-script, test-build-edge-cases] runs-on: ubuntu-latest - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (always()) + if: always() steps: - name: Summary diff --git a/.github/workflows/test-install.yml b/.github/workflows/test-install.yml index de387c77df..0e5a2b065a 100644 --- a/.github/workflows/test-install.yml +++ b/.github/workflows/test-install.yml @@ -2,7 +2,6 @@ name: Test Install Script on: push: - branches: [main] paths: - 'install.sh' - 'install.test.sh' @@ -26,7 +25,6 @@ env: jobs: test-install: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test on ${{ matrix.os }} (${{ matrix.node }}) runs-on: ${{ matrix.os }} strategy: @@ -183,7 +181,6 @@ jobs: # Test fallback when gunzip is not available test-no-gunzip: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test without gunzip runs-on: ubuntu-latest @@ -228,7 +225,6 @@ jobs: ' test-install-alpine: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test on Alpine Linux runs-on: ubuntu-latest @@ -268,7 +264,6 @@ jobs: ' test-install-fedora: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Test on Fedora runs-on: ubuntu-latest @@ -304,7 +299,6 @@ jobs: # Test script syntax and edge cases test-script-quality: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' name: Script Quality Checks runs-on: ubuntu-latest @@ -351,9 +345,7 @@ jobs: name: Test Summary needs: [test-install, test-install-alpine, test-install-fedora, test-no-gunzip, test-script-quality] runs-on: ubuntu-latest - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (always()) + if: always() steps: - name: Summary diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3ec1dda0cf..88db5acb99 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,14 +21,11 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' uses: ./.github/workflows/detect-changes.yml test: needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ${{ matrix.os }} strategy: matrix: @@ -64,9 +61,7 @@ jobs: windows-credential-acl: name: Windows credential ACL validation needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: windows-latest steps: - name: Checkout repository @@ -97,9 +92,7 @@ jobs: coverage: name: Coverage (upload) needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest steps: - name: Checkout repository @@ -127,9 +120,7 @@ jobs: lint: needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.node_changed == 'true') + if: needs.changes.outputs.node_changed == 'true' runs-on: ubuntu-latest steps: - name: Checkout repository @@ -156,9 +147,7 @@ jobs: swift-test: name: Swift SDK Tests needs: changes - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && - (needs.changes.outputs.sdk_swift_changed == 'true') + if: needs.changes.outputs.sdk_swift_changed == 'true' runs-on: macos-latest defaults: run: diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml deleted file mode 100644 index 2ddb49758d..0000000000 --- a/.github/workflows/trunk-guard.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Trunk guard - -# Only the `trunk` branch may merge into main. Feature branches merge into -# `trunk` (via the merge train); CI runs only on the trunk -> main PR. -on: - pull_request: - branches: [main] - -jobs: - only-trunk-merges-to-main: - if: github.head_ref != 'trunk' - runs-on: ubuntu-latest - timeout-minutes: 1 - steps: - - run: | - echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'." - exit 1 From bab65e5e4c8fed2a1830f879b64761a4ba89fde9 Mon Sep 17 00:00:00 2001 From: kjgbot Date: Fri, 9 Oct 2026 17:29:41 -0700 Subject: [PATCH 4/7] chore: drop the merge-train snippet (relay is back on per-PR CI) Co-Authored-By: Claude Opus 5.5 (1M context) --- AGENTS.md | 42 ------------------------------------------ prpm.lock | 19 +------------------ 2 files changed, 1 insertion(+), 60 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index b9bbd8cac9..d35f439507 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -314,45 +314,3 @@ Future agents can query past trajectories to learn from your decisions. - -## Merging: `trunk` + the `mergeable` label - -CI suites do **not** run automatically on feature branches. They run only on -this repository's `trunk` → `main` pull request and on pushes to `main`. The -one check that does run on a feature PR into `main` is `Trunk guard`, which -fails it on purpose; manually dispatched workflows (`workflow_dispatch`) still -run on any branch. (Repos whose default branch is not -`main`, e.g. `master`, use that branch wherever this says `main`.) A merge -agent batches ready PRs into `trunk`, gets that one PR green, and merges it. - -**When you open a PR** -1. Branch from `trunk` and open the PR with **base `trunk`**, not `main`. - A PR into `main` from any other branch fails the `Trunk guard` check. -2. No CI runs on your PR, so verify locally before calling it ready: run the - typecheck, tests and lint this repo uses, and list the exact commands and - results in the PR body. - -**When the PR is ready** -3. Add the label **`mergeable`** once all of these are true: - - The change is complete and the local checks above pass. - - Review feedback (human and bot) is addressed or answered. - - It is not a draft and does not depend on an unmerged PR. -4. Remove `mergeable` if the PR stops being ready (new work, a failing check, a - blocking question). The label is read live from GitHub on every sweep. - -**What you must not do** -- Do not merge your own PR, and never merge into or push to `trunk` or `main` - directly. -- Do not re-enable CI for feature branches or edit the `trunk` gates in - `.github/workflows/`. - -**The merge agent** sweeps open `mergeable` PRs with base `trunk` about every -10 minutes. It reads each PR's linked sessions (the `Agent Relay sessions` -block in the PR body, then the session summary) for context, merges them into -`trunk`, opens or updates the `trunk` → `main` PR, fixes CI there, merges when -green, and posts a summary. If your PR conflicts with `trunk`, it may ask you -to rebase on `trunk`; do so and keep the label. - -> Interim: the sweep worker is not deployed yet. Until it is, a human or a -> designated agent performs the merge-agent steps manually. Labelling is unchanged. - diff --git a/prpm.lock b/prpm.lock index 5f049c207d..5d02425a91 100644 --- a/prpm.lock +++ b/prpm.lock @@ -275,24 +275,7 @@ "sourceFormat": "claude", "sourceSubtype": "skill", "installedPath": ".agents/skills/writing-relayflows/SKILL.md" - }, - "@agent-relay/merge-train-snippet#agents.md:AGENTS.md": { - "version": "1.0.1", - "resolved": "https://registry.prpm.dev/api/v1/packages/%40agent-relay%2Fmerge-train-snippet/1.0.1.tar.gz", - "integrity": "sha256-b993f4fd7a737b5788f10fca8b02d6eea02c803b1d4483f6536f3cfd3f85126e", - "format": "agents.md", - "subtype": "snippet", - "sourceFormat": "generic", - "sourceSubtype": "snippet", - "installedPath": "AGENTS.md", - "snippetMetadata": { - "targetPath": "AGENTS.md", - "config": { - "target": "AGENTS.md", - "position": "append" - } - } } }, "generated": "2026-10-08T23:07:11.486Z" -} \ No newline at end of file +} From db2a791e21b559b7af7ff79eb437760a66d6d8f4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 10 Oct 2026 00:30:45 +0000 Subject: [PATCH 5/7] style: auto-format with Prettier --- AGENTS.md | 1 - 1 file changed, 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index d35f439507..032295138b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -313,4 +313,3 @@ Your trajectory helps others understand: Future agents can query past trajectories to learn from your decisions. - From 29fe87adb1dcb5618ebf3e35572e1f809c86f785 Mon Sep 17 00:00:00 2001 From: kjgbot Date: Fri, 9 Oct 2026 17:53:59 -0700 Subject: [PATCH 6/7] ci: same-repo gate and main-only push triggers instead of a plain revert Adopts the workflow tree from 94555d776 (relay#1957, by claude-relay-desktop-be28be): every job's trunk gate becomes a same-repository check, so fork PRs stay off the runners, and push triggers stay main-only, so a feature branch is tested once through its PR. Addresses the duplicate-run and same-repo-guard review threads on this PR. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/codegen-models.yml | 4 +-- .github/workflows/e2e-tests.yml | 1 + .github/workflows/fleet-e2e.yml | 10 ++++---- .github/workflows/large-files.yml | 1 + .github/workflows/node-compat.yml | 9 +++++-- .github/workflows/package-validation.yml | 14 +++++++---- .github/workflows/prettier-fmt-fix.yml | 4 ++- .github/workflows/relay-evals.yml | 1 + .../workflows/relayflow-pr-proof-broker.yml | 4 +-- .github/workflows/rust-ci.yml | 25 ++++++++++++++----- .github/workflows/rust-fmt-fix.yml | 4 ++- .github/workflows/security.yml | 18 ++++++++++--- .github/workflows/stress-tests.yml | 6 ++++- .../targeted-feature-verification.yml | 2 ++ .github/workflows/test-build.yml | 7 +++++- .github/workflows/test-install.yml | 10 +++++++- .github/workflows/test.yml | 21 ++++++++++++---- AGENTS.md | 5 ++++ 18 files changed, 110 insertions(+), 36 deletions(-) diff --git a/.github/workflows/codegen-models.yml b/.github/workflows/codegen-models.yml index b8c27c4672..544311a36a 100644 --- a/.github/workflows/codegen-models.yml +++ b/.github/workflows/codegen-models.yml @@ -5,14 +5,14 @@ on: paths: - 'packages/utils/cli-registry.yaml' branches: - - main - - 'feature/**' + [main] pull_request: paths: - 'packages/utils/cli-registry.yaml' jobs: codegen: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest permissions: contents: write diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 188accab94..2d29221067 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -35,6 +35,7 @@ env: jobs: e2e-test: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: E2E Integration Test runs-on: ${{ matrix.os }} strategy: diff --git a/.github/workflows/fleet-e2e.yml b/.github/workflows/fleet-e2e.yml index 21e7221a36..a1bd5ce346 100644 --- a/.github/workflows/fleet-e2e.yml +++ b/.github/workflows/fleet-e2e.yml @@ -9,13 +9,12 @@ name: Fleet E2E # engine build), which rust-cache amortises on warm runs. The 20-minute job # timeout is a cold-build ceiling, not the matrix runtime. -# NOTE on branches: the fleet stack is developed on `feat/fleet-*` branches that -# merge into each other before `main`, so the trigger must include them — gating -# on `[main]` alone leaves this job inert for the entire feature stack (it would -# only run after something reaches main). Update to `[main]` once the stack lands. +# NOTE on branches: CI runs on pull requests into `main` from this repository +# (see the job `if:`) and on pushes to `main`. Feature branches, including +# `feat/fleet-*`, get it through their PR, not through push runs. on: push: - branches: [main, 'feat/fleet-**'] + branches: [main] paths: - 'packages/fleet/**' - 'packages/cli/**' @@ -54,6 +53,7 @@ env: jobs: fleet-e2e: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Two-node fleet matrix runs-on: ubuntu-latest timeout-minutes: 20 diff --git a/.github/workflows/large-files.yml b/.github/workflows/large-files.yml index ee6e2afb01..2dadbf4fd2 100644 --- a/.github/workflows/large-files.yml +++ b/.github/workflows/large-files.yml @@ -2,6 +2,7 @@ name: Large File Check on: [pull_request] jobs: check: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/node-compat.yml b/.github/workflows/node-compat.yml index 4bc54e16c7..f9cff828b7 100644 --- a/.github/workflows/node-compat.yml +++ b/.github/workflows/node-compat.yml @@ -18,11 +18,14 @@ concurrency: jobs: changes: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml install-test: name: Install Test (Node ${{ matrix.node-version }}) needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest strategy: matrix: @@ -83,7 +86,9 @@ jobs: fresh-install: name: Fresh Install (Node ${{ matrix.node-version }}) needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest strategy: matrix: diff --git a/.github/workflows/package-validation.yml b/.github/workflows/package-validation.yml index 71fb731758..ef01637d78 100644 --- a/.github/workflows/package-validation.yml +++ b/.github/workflows/package-validation.yml @@ -21,11 +21,14 @@ env: jobs: changes: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml validate: name: Build & Validate needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest env: NPM_CONFIG_FUND: false @@ -199,7 +202,9 @@ jobs: publish-fresh-install-build: name: Publish Fresh Install Build needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest env: NPM_CONFIG_FUND: false @@ -248,9 +253,8 @@ jobs: # provisioning an undeletable workspace; other same-repository PRs and # main pushes must reuse the CI workspace. if: >- - needs.changes.outputs.node_changed == 'true' && - github.actor != 'dependabot[bot]' && - (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) runs-on: macos-latest env: NPM_CONFIG_FUND: false diff --git a/.github/workflows/prettier-fmt-fix.yml b/.github/workflows/prettier-fmt-fix.yml index 4f85827b3c..eda8694b53 100644 --- a/.github/workflows/prettier-fmt-fix.yml +++ b/.github/workflows/prettier-fmt-fix.yml @@ -38,7 +38,9 @@ jobs: name: Auto-format Prettier files runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. - if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) permissions: contents: write steps: diff --git a/.github/workflows/relay-evals.yml b/.github/workflows/relay-evals.yml index dc3ea0f592..986b1fe3ec 100644 --- a/.github/workflows/relay-evals.yml +++ b/.github/workflows/relay-evals.yml @@ -38,6 +38,7 @@ env: jobs: evals: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Offline evals runs-on: ubuntu-latest diff --git a/.github/workflows/relayflow-pr-proof-broker.yml b/.github/workflows/relayflow-pr-proof-broker.yml index 6c152d9baa..46038a4789 100644 --- a/.github/workflows/relayflow-pr-proof-broker.yml +++ b/.github/workflows/relayflow-pr-proof-broker.yml @@ -31,8 +31,8 @@ jobs: build: name: ${{ github.event_name == 'pull_request' && 'Validate PR-head Linux broker' || 'Build exact Linux broker' }} if: >- - github.event_name != 'pull_request_target' || - github.event.pull_request.head.repo.full_name == github.repository + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) runs-on: ubuntu-latest timeout-minutes: 30 steps: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index bf8833d3e9..eb62d9ae73 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -17,12 +17,15 @@ env: jobs: changes: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml rust-test: name: Rust Tests (${{ matrix.os }}) needs: changes - if: needs.changes.outputs.rust_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -42,7 +45,9 @@ jobs: relay-pty-windows-test: name: Relay PTY Synchronization Tests (windows-latest) needs: changes - if: needs.changes.outputs.rust_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.rust_changed == 'true') runs-on: windows-latest timeout-minutes: 10 steps: @@ -62,7 +67,9 @@ jobs: rust-cross-compile: name: Cross-compile check (${{ matrix.target }}) needs: changes - if: needs.changes.outputs.rust_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -96,7 +103,9 @@ jobs: rust-clippy: name: Clippy (${{ matrix.os }}) needs: changes - if: needs.changes.outputs.rust_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -115,7 +124,9 @@ jobs: rust-fmt: name: Format needs: changes - if: needs.changes.outputs.rust_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.rust_changed == 'true') runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -127,7 +138,9 @@ jobs: sdk-check: name: SDK TypeScript Check needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/rust-fmt-fix.yml b/.github/workflows/rust-fmt-fix.yml index 70472298f0..c0ed770571 100644 --- a/.github/workflows/rust-fmt-fix.yml +++ b/.github/workflows/rust-fmt-fix.yml @@ -20,7 +20,9 @@ jobs: name: Auto-format Rust code runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. - if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) permissions: contents: write steps: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 13e4df2794..578a31d463 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,13 +21,16 @@ concurrency: jobs: changes: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml # NPM audit for known vulnerabilities npm-audit: name: NPM Audit needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: @@ -57,7 +60,9 @@ jobs: dependency-review: name: Dependency Review runs-on: ubuntu-latest - if: github.event_name == 'pull_request' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name == 'pull_request') # This job requires the dependency graph to be enabled in repo settings # Make it non-blocking until that's configured continue-on-error: true @@ -77,7 +82,9 @@ jobs: codeql: name: CodeQL Analysis needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest permissions: security-events: write @@ -104,6 +111,7 @@ jobs: # Secret scanning (check for accidentally committed secrets) secrets-scan: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Secret Scanning runs-on: ubuntu-latest # Make non-blocking - review findings manually @@ -135,7 +143,9 @@ jobs: license-check: name: License Compliance needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: diff --git a/.github/workflows/stress-tests.yml b/.github/workflows/stress-tests.yml index 323dbbf0a2..9fdd678077 100644 --- a/.github/workflows/stress-tests.yml +++ b/.github/workflows/stress-tests.yml @@ -29,6 +29,7 @@ concurrency: jobs: stress-test-orchestrator: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Orchestrator Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -78,6 +79,7 @@ jobs: fi stress-test-orchestrator-integration: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Orchestrator Integration Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -161,7 +163,9 @@ jobs: name: Stress Test Summary needs: [stress-test-orchestrator, stress-test-orchestrator-integration] runs-on: ubuntu-latest - if: always() + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (always()) steps: - name: Download all artifacts diff --git a/.github/workflows/targeted-feature-verification.yml b/.github/workflows/targeted-feature-verification.yml index 3e9fc7f724..651f658f4d 100644 --- a/.github/workflows/targeted-feature-verification.yml +++ b/.github/workflows/targeted-feature-verification.yml @@ -35,6 +35,7 @@ concurrency: jobs: select: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Select Flows v2 shards runs-on: ubuntu-24.04 timeout-minutes: 15 @@ -93,6 +94,7 @@ jobs: retention-days: 14 targeted: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Flows v2 shard ${{ matrix.shard }} needs: select runs-on: ubuntu-24.04 diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml index abc1a1918f..ebb1ba8c7a 100644 --- a/.github/workflows/test-build.yml +++ b/.github/workflows/test-build.yml @@ -2,6 +2,7 @@ name: Test Build Scripts on: push: + branches: [main] paths: - 'scripts/build-bun.sh' - 'scripts/sign-macos-binary.sh' @@ -20,6 +21,7 @@ env: jobs: test-build-script: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Test build-bun.sh runs-on: ${{ matrix.os }} strategy: @@ -107,6 +109,7 @@ jobs: done test-build-edge-cases: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Test edge cases runs-on: ubuntu-latest @@ -154,7 +157,9 @@ jobs: name: Summary needs: [test-build-script, test-build-edge-cases] runs-on: ubuntu-latest - if: always() + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (always()) steps: - name: Summary diff --git a/.github/workflows/test-install.yml b/.github/workflows/test-install.yml index 0e5a2b065a..276dd2e0d8 100644 --- a/.github/workflows/test-install.yml +++ b/.github/workflows/test-install.yml @@ -2,6 +2,7 @@ name: Test Install Script on: push: + branches: [main] paths: - 'install.sh' - 'install.test.sh' @@ -25,6 +26,7 @@ env: jobs: test-install: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Test on ${{ matrix.os }} (${{ matrix.node }}) runs-on: ${{ matrix.os }} strategy: @@ -181,6 +183,7 @@ jobs: # Test fallback when gunzip is not available test-no-gunzip: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Test without gunzip runs-on: ubuntu-latest @@ -225,6 +228,7 @@ jobs: ' test-install-alpine: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Test on Alpine Linux runs-on: ubuntu-latest @@ -264,6 +268,7 @@ jobs: ' test-install-fedora: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Test on Fedora runs-on: ubuntu-latest @@ -299,6 +304,7 @@ jobs: # Test script syntax and edge cases test-script-quality: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Script Quality Checks runs-on: ubuntu-latest @@ -345,7 +351,9 @@ jobs: name: Test Summary needs: [test-install, test-install-alpine, test-install-fedora, test-no-gunzip, test-script-quality] runs-on: ubuntu-latest - if: always() + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (always()) steps: - name: Summary diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 88db5acb99..46f4f23137 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,11 +21,14 @@ env: jobs: changes: + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml test: needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ${{ matrix.os }} strategy: matrix: @@ -61,7 +64,9 @@ jobs: windows-credential-acl: name: Windows credential ACL validation needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: windows-latest steps: - name: Checkout repository @@ -92,7 +97,9 @@ jobs: coverage: name: Coverage (upload) needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: - name: Checkout repository @@ -120,7 +127,9 @@ jobs: lint: needs: changes - if: needs.changes.outputs.node_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: - name: Checkout repository @@ -147,7 +156,9 @@ jobs: swift-test: name: Swift SDK Tests needs: changes - if: needs.changes.outputs.sdk_swift_changed == 'true' + if: >- + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (needs.changes.outputs.sdk_swift_changed == 'true') runs-on: macos-latest defaults: run: diff --git a/AGENTS.md b/AGENTS.md index 032295138b..fc1dd632f1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -313,3 +313,8 @@ Your trajectory helps others understand: Future agents can query past trajectories to learn from your decisions. + +## Merging + +Open pull requests against `main`. CI runs on every pull request from this +repository into `main` and on pushes to `main`. From eff09eabd7d5c2774447ffabe66a820a4f0dc601 Mon Sep 17 00:00:00 2001 From: khaliqgant Date: Fri, 9 Oct 2026 18:18:24 -0700 Subject: [PATCH 7/7] ci: format with Prettier and simplify the same-repo gates - Prettier: codegen-models.yml and security.yml (the lint and auto-format checks failed; the formatter cannot push workflow files). - In workflows that never trigger on pull_request_target, the gate is `github.event_name != 'pull_request' || `. - rust-fmt-fix and prettier-fmt-fix keep their original single condition, the package-validation smoke job its original condition, and large-files (pull_request only) just the same-repo check. - Secret Scanning has no fork gate: it holds no credentials, and forks are where untrusted code arrives. - relayflow-pr-proof-broker: one clause instead of two equivalent ones. - fleet-e2e note names the feat/fleet-** PR bases; AGENTS.md drops the duplicate Merging section (Git Workflow already states the rule). Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/codegen-models.yml | 5 ++--- .github/workflows/e2e-tests.yml | 2 +- .github/workflows/fleet-e2e.yml | 8 ++++---- .github/workflows/large-files.yml | 2 +- .github/workflows/node-compat.yml | 6 +++--- .github/workflows/package-validation.yml | 10 ++++------ .github/workflows/prettier-fmt-fix.yml | 4 +--- .github/workflows/relay-evals.yml | 2 +- .github/workflows/relayflow-pr-proof-broker.yml | 4 +--- .github/workflows/rust-ci.yml | 14 +++++++------- .github/workflows/rust-fmt-fix.yml | 4 +--- .github/workflows/security.yml | 13 +++++-------- .github/workflows/stress-tests.yml | 6 +++--- .../workflows/targeted-feature-verification.yml | 4 ++-- .github/workflows/test-build.yml | 6 +++--- .github/workflows/test-install.yml | 12 ++++++------ .github/workflows/test.yml | 12 ++++++------ AGENTS.md | 5 ----- 18 files changed, 51 insertions(+), 68 deletions(-) diff --git a/.github/workflows/codegen-models.yml b/.github/workflows/codegen-models.yml index 544311a36a..ee42b5798d 100644 --- a/.github/workflows/codegen-models.yml +++ b/.github/workflows/codegen-models.yml @@ -4,15 +4,14 @@ on: push: paths: - 'packages/utils/cli-registry.yaml' - branches: - [main] + branches: [main] pull_request: paths: - 'packages/utils/cli-registry.yaml' jobs: codegen: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest permissions: contents: write diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index 2d29221067..6a457ddb99 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -35,7 +35,7 @@ env: jobs: e2e-test: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: E2E Integration Test runs-on: ${{ matrix.os }} strategy: diff --git a/.github/workflows/fleet-e2e.yml b/.github/workflows/fleet-e2e.yml index a1bd5ce346..a636fb510c 100644 --- a/.github/workflows/fleet-e2e.yml +++ b/.github/workflows/fleet-e2e.yml @@ -9,9 +9,9 @@ name: Fleet E2E # engine build), which rust-cache amortises on warm runs. The 20-minute job # timeout is a cold-build ceiling, not the matrix runtime. -# NOTE on branches: CI runs on pull requests into `main` from this repository -# (see the job `if:`) and on pushes to `main`. Feature branches, including -# `feat/fleet-*`, get it through their PR, not through push runs. +# NOTE on branches: this runs on pushes to `main` and on pull requests from this +# repository (see the job `if:`) into `main` or a `feat/fleet-**` stack base. +# Feature branches are tested through their PR, not through push runs. on: push: branches: [main] @@ -53,7 +53,7 @@ env: jobs: fleet-e2e: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Two-node fleet matrix runs-on: ubuntu-latest timeout-minutes: 20 diff --git a/.github/workflows/large-files.yml b/.github/workflows/large-files.yml index 2dadbf4fd2..816479c9bf 100644 --- a/.github/workflows/large-files.yml +++ b/.github/workflows/large-files.yml @@ -2,7 +2,7 @@ name: Large File Check on: [pull_request] jobs: check: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/node-compat.yml b/.github/workflows/node-compat.yml index f9cff828b7..6590800dcb 100644 --- a/.github/workflows/node-compat.yml +++ b/.github/workflows/node-compat.yml @@ -18,13 +18,13 @@ concurrency: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml install-test: name: Install Test (Node ${{ matrix.node-version }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest strategy: @@ -87,7 +87,7 @@ jobs: name: Fresh Install (Node ${{ matrix.node-version }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/package-validation.yml b/.github/workflows/package-validation.yml index ef01637d78..812137e754 100644 --- a/.github/workflows/package-validation.yml +++ b/.github/workflows/package-validation.yml @@ -21,13 +21,13 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml validate: name: Build & Validate needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest env: @@ -203,7 +203,7 @@ jobs: name: Publish Fresh Install Build needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest env: @@ -252,9 +252,7 @@ jobs: # secrets. Skip this live-cloud smoke there instead of falling back to # provisioning an undeletable workspace; other same-repository PRs and # main pushes must reuse the CI workspace. - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && - (needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) + if: needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) runs-on: macos-latest env: NPM_CONFIG_FUND: false diff --git a/.github/workflows/prettier-fmt-fix.yml b/.github/workflows/prettier-fmt-fix.yml index eda8694b53..4f85827b3c 100644 --- a/.github/workflows/prettier-fmt-fix.yml +++ b/.github/workflows/prettier-fmt-fix.yml @@ -38,9 +38,7 @@ jobs: name: Auto-format Prettier files runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && - (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository permissions: contents: write steps: diff --git a/.github/workflows/relay-evals.yml b/.github/workflows/relay-evals.yml index 986b1fe3ec..46ccb49868 100644 --- a/.github/workflows/relay-evals.yml +++ b/.github/workflows/relay-evals.yml @@ -38,7 +38,7 @@ env: jobs: evals: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Offline evals runs-on: ubuntu-latest diff --git a/.github/workflows/relayflow-pr-proof-broker.yml b/.github/workflows/relayflow-pr-proof-broker.yml index 46038a4789..699477e947 100644 --- a/.github/workflows/relayflow-pr-proof-broker.yml +++ b/.github/workflows/relayflow-pr-proof-broker.yml @@ -30,9 +30,7 @@ env: jobs: build: name: ${{ github.event_name == 'pull_request' && 'Validate PR-head Linux broker' || 'Build exact Linux broker' }} - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && - (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest timeout-minutes: 30 steps: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index eb62d9ae73..ba1860ce3e 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -17,14 +17,14 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml rust-test: name: Rust Tests (${{ matrix.os }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -46,7 +46,7 @@ jobs: name: Relay PTY Synchronization Tests (windows-latest) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.rust_changed == 'true') runs-on: windows-latest timeout-minutes: 10 @@ -68,7 +68,7 @@ jobs: name: Cross-compile check (${{ matrix.target }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -104,7 +104,7 @@ jobs: name: Clippy (${{ matrix.os }}) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.rust_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -125,7 +125,7 @@ jobs: name: Format needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.rust_changed == 'true') runs-on: ubuntu-latest steps: @@ -139,7 +139,7 @@ jobs: name: SDK TypeScript Check needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: diff --git a/.github/workflows/rust-fmt-fix.yml b/.github/workflows/rust-fmt-fix.yml index c0ed770571..70472298f0 100644 --- a/.github/workflows/rust-fmt-fix.yml +++ b/.github/workflows/rust-fmt-fix.yml @@ -20,9 +20,7 @@ jobs: name: Auto-format Rust code runs-on: ubuntu-latest # Only run on same-repo PRs where the bot can push back formatting commits. - if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && - (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository permissions: contents: write steps: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 578a31d463..d758d3663c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,7 +21,7 @@ concurrency: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml # NPM audit for known vulnerabilities @@ -29,10 +29,9 @@ jobs: name: NPM Audit needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest - steps: - name: Checkout code uses: actions/checkout@v4 @@ -61,7 +60,7 @@ jobs: name: Dependency Review runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name == 'pull_request') # This job requires the dependency graph to be enabled in repo settings # Make it non-blocking until that's configured @@ -83,7 +82,7 @@ jobs: name: CodeQL Analysis needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest permissions: @@ -111,7 +110,6 @@ jobs: # Secret scanning (check for accidentally committed secrets) secrets-scan: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository name: Secret Scanning runs-on: ubuntu-latest # Make non-blocking - review findings manually @@ -144,10 +142,9 @@ jobs: name: License Compliance needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest - steps: - name: Checkout code uses: actions/checkout@v4 diff --git a/.github/workflows/stress-tests.yml b/.github/workflows/stress-tests.yml index 9fdd678077..08b1791d74 100644 --- a/.github/workflows/stress-tests.yml +++ b/.github/workflows/stress-tests.yml @@ -29,7 +29,7 @@ concurrency: jobs: stress-test-orchestrator: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Orchestrator Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -79,7 +79,7 @@ jobs: fi stress-test-orchestrator-integration: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Orchestrator Integration Stress Tests runs-on: ${{ matrix.os }} strategy: @@ -164,7 +164,7 @@ jobs: needs: [stress-test-orchestrator, stress-test-orchestrator-integration] runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (always()) steps: diff --git a/.github/workflows/targeted-feature-verification.yml b/.github/workflows/targeted-feature-verification.yml index 651f658f4d..8264f4fbfd 100644 --- a/.github/workflows/targeted-feature-verification.yml +++ b/.github/workflows/targeted-feature-verification.yml @@ -35,7 +35,7 @@ concurrency: jobs: select: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Select Flows v2 shards runs-on: ubuntu-24.04 timeout-minutes: 15 @@ -94,7 +94,7 @@ jobs: retention-days: 14 targeted: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Flows v2 shard ${{ matrix.shard }} needs: select runs-on: ubuntu-24.04 diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml index ebb1ba8c7a..a267819bf9 100644 --- a/.github/workflows/test-build.yml +++ b/.github/workflows/test-build.yml @@ -21,7 +21,7 @@ env: jobs: test-build-script: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Test build-bun.sh runs-on: ${{ matrix.os }} strategy: @@ -109,7 +109,7 @@ jobs: done test-build-edge-cases: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Test edge cases runs-on: ubuntu-latest @@ -158,7 +158,7 @@ jobs: needs: [test-build-script, test-build-edge-cases] runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (always()) steps: diff --git a/.github/workflows/test-install.yml b/.github/workflows/test-install.yml index 276dd2e0d8..4837a9b17d 100644 --- a/.github/workflows/test-install.yml +++ b/.github/workflows/test-install.yml @@ -26,7 +26,7 @@ env: jobs: test-install: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Test on ${{ matrix.os }} (${{ matrix.node }}) runs-on: ${{ matrix.os }} strategy: @@ -183,7 +183,7 @@ jobs: # Test fallback when gunzip is not available test-no-gunzip: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Test without gunzip runs-on: ubuntu-latest @@ -228,7 +228,7 @@ jobs: ' test-install-alpine: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Test on Alpine Linux runs-on: ubuntu-latest @@ -268,7 +268,7 @@ jobs: ' test-install-fedora: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Test on Fedora runs-on: ubuntu-latest @@ -304,7 +304,7 @@ jobs: # Test script syntax and edge cases test-script-quality: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository name: Script Quality Checks runs-on: ubuntu-latest @@ -352,7 +352,7 @@ jobs: needs: [test-install, test-install-alpine, test-install-fedora, test-no-gunzip, test-script-quality] runs-on: ubuntu-latest if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (always()) steps: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 46f4f23137..b1dfe2de74 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,13 +21,13 @@ env: jobs: changes: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository uses: ./.github/workflows/detect-changes.yml test: needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ${{ matrix.os }} strategy: @@ -65,7 +65,7 @@ jobs: name: Windows credential ACL validation needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: windows-latest steps: @@ -98,7 +98,7 @@ jobs: name: Coverage (upload) needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: @@ -128,7 +128,7 @@ jobs: lint: needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.node_changed == 'true') runs-on: ubuntu-latest steps: @@ -157,7 +157,7 @@ jobs: name: Swift SDK Tests needs: changes if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository) && + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (needs.changes.outputs.sdk_swift_changed == 'true') runs-on: macos-latest defaults: diff --git a/AGENTS.md b/AGENTS.md index fc1dd632f1..032295138b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -313,8 +313,3 @@ Your trajectory helps others understand: Future agents can query past trajectories to learn from your decisions. - -## Merging - -Open pull requests against `main`. CI runs on every pull request from this -repository into `main` and on pushes to `main`.