Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/workflows/codegen-models.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,14 @@ on:
push:
paths:
- 'packages/utils/cli-registry.yaml'
branches:
[main]
branches: [main]
pull_request:
paths:
- 'packages/utils/cli-registry.yaml'

jobs:
codegen:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
permissions:
contents: write
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ env:

jobs:
e2e-test:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: This lets same-repository PR code run with ANTHROPIC_API_KEY and exfiltrate it during install, build, or testing. Keep pull-request runs secretless; the existing daemon-only path already handles a missing key.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/e2e-tests.yml, line 38:

<comment>This lets same-repository PR code run with `ANTHROPIC_API_KEY` and exfiltrate it during install, build, or testing. Keep pull-request runs secretless; the existing daemon-only path already handles a missing key.</comment>

<file context>
@@ -35,7 +35,6 @@ env:
 jobs:
   e2e-test:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
     name: E2E Integration Test
     runs-on: ${{ matrix.os }}
     strategy:
</file context>

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pre-existing, not introduced here. This PR is a pure revert: every workflow file it touches is byte-identical to its state before the merge train (649a3c910^). The trunk gating only hid this on feature PRs for a day. Tracked in #1958, so the revert stays a revert.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update: still applies after 29fe87a (same-repository gate, main-only push triggers). Same-repo PRs keep the access they had before the merge train, so this stays tracked in #1958 rather than being fixed in this CI restore.

if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: E2E Integration Test
runs-on: ${{ matrix.os }}
strategy:
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/fleet-e2e.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ name: Fleet E2E
# engine build), which rust-cache amortises on warm runs. The 20-minute job
# timeout is a cold-build ceiling, not the matrix runtime.

# NOTE on branches: CI runs only on this repository's `trunk` -> `main` PR and
# on pushes to `main` (see the job `if:`). Feature branches, including
# `feat/fleet-*`, merge into `trunk` without CI.
# NOTE on branches: this runs on pushes to `main` and on pull requests from this
# repository (see the job `if:`) into `main` or a `feat/fleet-**` stack base.
# Feature branches are tested through their PR, not through push runs.
on:
push:
branches: [main]
Expand Down Expand Up @@ -53,7 +53,7 @@ env:

jobs:
fleet-e2e:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Two-node fleet matrix
runs-on: ubuntu-latest
timeout-minutes: 20
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/large-files.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Large File Check
on: [pull_request]
jobs:
check:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/node-compat.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,13 @@ concurrency:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
uses: ./.github/workflows/detect-changes.yml
install-test:
name: Install Test (Node ${{ matrix.node-version }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest
strategy:
Expand Down Expand Up @@ -87,7 +87,7 @@ jobs:
name: Fresh Install (Node ${{ matrix.node-version }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest
strategy:
Expand Down
10 changes: 4 additions & 6 deletions .github/workflows/package-validation.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ env:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
uses: ./.github/workflows/detect-changes.yml
validate:
name: Build & Validate
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest
env:
Expand Down Expand Up @@ -203,7 +203,7 @@ jobs:
name: Publish Fresh Install Build
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest
env:
Expand Down Expand Up @@ -252,9 +252,7 @@ jobs:
# secrets. Skip this live-cloud smoke there instead of falling back to
# provisioning an undeletable workspace; other same-repository PRs and
# main pushes must reuse the CI workspace.
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository))
if: needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
runs-on: macos-latest
env:
NPM_CONFIG_FUND: false
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/prettier-fmt-fix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,7 @@ jobs:
name: Auto-format Prettier files
runs-on: ubuntu-latest
# Only run on same-repo PRs where the bot can push back formatting commits.
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
permissions:
contents: write
steps:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/relay-evals.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ env:

jobs:
evals:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Offline evals
runs-on: ubuntu-latest

Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/relayflow-pr-proof-broker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,7 @@ env:
jobs:
build:
name: ${{ github.event_name == 'pull_request' && 'Validate PR-head Linux broker' || 'Build exact Linux broker' }}
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository)
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/rust-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,14 +17,14 @@ env:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
uses: ./.github/workflows/detect-changes.yml

rust-test:
name: Rust Tests (${{ matrix.os }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.rust_changed == 'true')
runs-on: ${{ matrix.os }}
strategy:
Expand All @@ -46,7 +46,7 @@ jobs:
name: Relay PTY Synchronization Tests (windows-latest)
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.rust_changed == 'true')
runs-on: windows-latest
timeout-minutes: 10
Expand All @@ -68,7 +68,7 @@ jobs:
name: Cross-compile check (${{ matrix.target }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.rust_changed == 'true')
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -104,7 +104,7 @@ jobs:
name: Clippy (${{ matrix.os }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.rust_changed == 'true')
runs-on: ${{ matrix.os }}
strategy:
Expand All @@ -125,7 +125,7 @@ jobs:
name: Format
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.rust_changed == 'true')
runs-on: ubuntu-latest
steps:
Expand All @@ -139,7 +139,7 @@ jobs:
name: SDK TypeScript Check
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest
steps:
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/rust-fmt-fix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,7 @@ jobs:
name: Auto-format Rust code
runs-on: ubuntu-latest
# Only run on same-repo PRs where the bot can push back formatting commits.
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
Comment thread
coderabbitai[bot] marked this conversation as resolved.
permissions:
contents: write
steps:
Expand Down
13 changes: 5 additions & 8 deletions .github/workflows/security.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,18 +21,17 @@ concurrency:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
uses: ./.github/workflows/detect-changes.yml

# NPM audit for known vulnerabilities
npm-audit:
name: NPM Audit
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v4
Expand Down Expand Up @@ -61,7 +60,7 @@ jobs:
name: Dependency Review
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(github.event_name == 'pull_request')
# This job requires the dependency graph to be enabled in repo settings
# Make it non-blocking until that's configured
Expand All @@ -83,7 +82,7 @@ jobs:
name: CodeQL Analysis
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest
permissions:
Expand Down Expand Up @@ -111,7 +110,6 @@ jobs:

# Secret scanning (check for accidentally committed secrets)
secrets-scan:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Secret Scanning
runs-on: ubuntu-latest
# Make non-blocking - review findings manually
Expand Down Expand Up @@ -144,10 +142,9 @@ jobs:
name: License Compliance
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(needs.changes.outputs.node_changed == 'true')
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v4
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/stress-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ concurrency:

jobs:
stress-test-orchestrator:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Orchestrator Stress Tests
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -79,7 +79,7 @@ jobs:
fi

stress-test-orchestrator-integration:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Orchestrator Integration Stress Tests
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -164,7 +164,7 @@ jobs:
needs: [stress-test-orchestrator, stress-test-orchestrator-integration]
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(always())

steps:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/targeted-feature-verification.yml
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ concurrency:

jobs:
select:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Select Flows v2 shards
runs-on: ubuntu-24.04
timeout-minutes: 15
Expand Down Expand Up @@ -94,7 +94,7 @@ jobs:
retention-days: 14

targeted:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Flows v2 shard ${{ matrix.shard }}
needs: select
runs-on: ubuntu-24.04
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ env:

jobs:
test-build-script:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Test build-bun.sh
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -109,7 +109,7 @@ jobs:
done

test-build-edge-cases:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
name: Test edge cases
runs-on: ubuntu-latest

Expand Down Expand Up @@ -158,7 +158,7 @@ jobs:
needs: [test-build-script, test-build-edge-cases]
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
(always())

steps:
Expand Down
Loading
Loading