Skip to content

ci: restore per-PR CI on main (drop the trunk gate) #1957

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
khaliqgant wants to merge 4 commits into from
Closed

ci: restore per-PR CI on main (drop the trunk gate) #1957

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
49169fb
Revert "ci(fleet-e2e): update stale branch note for trunk gating"
khaliqgant Oct 10, 2026
0709d98
Revert "ci: harden trunk gating"
khaliqgant Oct 10, 2026
b2547e2
Revert "ci: run CI only for trunk PRs and main pushes"
khaliqgant Oct 10, 2026
6be62f5
style: auto-format with Prettier
github-actions[bot] Oct 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/codegen-models.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,14 @@ on:
paths:
- 'packages/utils/cli-registry.yaml'
branches:
[main]
- main
- 'feature/**'

@devin-ai-integration devin-ai-integration Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Generated models leave PR checks failed

For a feature/** PR missing generated models, codegen commits the fix after PR checks start. The bot's GITHUB_TOKEN push triggers no replacement PR checks, leaving the corrected PR with failed checks.

Learn more

The workflow has both a push job that commits generated models and a pull-request job that fails if those models are missing. GitHub starts the PR job for the original head while the push job generates and commits a fix on the feature branch. The PR job checks the original merge commit, so it fails. GitHub does not create new workflow runs for a push made with the default GITHUB_TOKEN; the corrected branch therefore has no fresh PR validation.

Example: A contributor pushes a registry edit on feature/new-cli without updating models.py. The push job adds models.py, but the already-started PR job fails against the old head. No new PR run starts for the bot commit.

Recommended fix: Do not auto-commit generated files on feature branches using GITHUB_TOKEN; require the contributor to commit them so normal PR checks rerun. Alternatively arrange an explicitly authorized revalidation trigger for bot commits and verify that branch protection sees checks on the resulting head.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@khaliqgant khaliqgant Oct 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the rebuilt branch: rather than reverting, this now keeps main's main-only push trigger for codegen-models (no feature/** push), so a codegen commit never lands mid-PR without fresh checks.

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Keep feature branches out of this auto-commit push trigger, or use an explicitly authorized revalidation trigger; GITHUB_TOKEN commits will not start replacement PR checks.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/codegen-models.yml, line 9:

<comment>Keep feature branches out of this auto-commit push trigger, or use an explicitly authorized revalidation trigger; `GITHUB_TOKEN` commits will not start replacement PR checks.</comment>

<file context>
@@ -5,14 +5,14 @@ on:
     branches:
-      [main]
+      - main
+      - 'feature/**'
   pull_request:
     paths:
</file context>
Suggested change
- 'feature/**'
# Feature PRs must commit generated models; avoid bot pushes that cannot retrigger CI.

@khaliqgant khaliqgant Oct 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed together with the Devin comment: codegen-models pushes are main-only.

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Removing the if gate lets every same-repository PR and branch run this job with contents: write, including the PR's own npm run codegen:models script. Keep the same-repository check on the pull_request path, for example github.event.pull_request.head.repo.full_name == github.repository, if per-PR CI should stay limited to repo-owned branches.

(Based on your team's feedback about restricting PR CI to same-repository trunk-to-main PRs.)

View Feedback

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/codegen-models.yml, line 9:

<comment>Removing the `if` gate lets every same-repository PR and branch run this job with `contents: write`, including the PR's own `npm run codegen:models` script. Keep the same-repository check on the `pull_request` path, for example `github.event.pull_request.head.repo.full_name == github.repository`, if per-PR CI should stay limited to repo-owned branches.

(Based on your team's feedback about restricting PR CI to same-repository trunk-to-main PRs.) </comment>

<file context>
@@ -5,14 +5,14 @@ on:
     branches:
-      [main]
+      - main
+      - 'feature/**'
   pull_request:
     paths:
</file context>

pull_request:
paths:
- 'packages/utils/cli-registry.yaml'

jobs:
codegen:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
runs-on: ubuntu-latest
permissions:
contents: write
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/e2e-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ env:

jobs:
e2e-test:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: E2E Integration Test
runs-on: ${{ matrix.os }}
strategy:
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/fleet-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,13 @@ name: Fleet E2E
# engine build), which rust-cache amortises on warm runs. The 20-minute job
# timeout is a cold-build ceiling, not the matrix runtime.

# NOTE on branches: CI runs only on this repository's `trunk` -> `main` PR and
# on pushes to `main` (see the job `if:`). Feature branches, including
# `feat/fleet-*`, merge into `trunk` without CI.
# NOTE on branches: the fleet stack is developed on `feat/fleet-*` branches that
# merge into each other before `main`, so the trigger must include them — gating
# on `[main]` alone leaves this job inert for the entire feature stack (it would
# only run after something reaches main). Update to `[main]` once the stack lands.
on:
push:
branches: [main]
branches: [main, 'feat/fleet-**']

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The new push trigger on feat/fleet-** duplicates every fleet build on branches that already have a PR, because the pull_request trigger also fires. Drop feat/fleet-** from push and keep it only on pull_request, or state why both are needed. This also conflicts with the AGENTS.md rule against feature-branch CI push runs.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/fleet-e2e.yml, line 18:

<comment>The new `push` trigger on `feat/fleet-**` duplicates every fleet build on branches that already have a PR, because the `pull_request` trigger also fires. Drop `feat/fleet-**` from `push` and keep it only on `pull_request`, or state why both are needed. This also conflicts with the AGENTS.md rule against feature-branch CI push runs.</comment>

<file context>
@@ -9,12 +9,13 @@ name: Fleet E2E
 on:
   push:
-    branches: [main]
+    branches: [main, 'feat/fleet-**']
     paths:
       - 'packages/fleet/**'
</file context>
Suggested change
branches: [main, 'feat/fleet-**']
branches: [main]

@khaliqgant khaliqgant Oct 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: fleet-e2e's push trigger stays [main]; feat/fleet-** is not restored.

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Removing the job if: lets pull requests from forks and from any head branch run this heavy 20-minute build. Restore a same-repository check, such as github.event.pull_request.head.repo.full_name == github.repository, if fork PRs should not consume runner time. This matches the repo's same-repository PR gate policy.

(Based on your team's feedback about restricting PR CI to same-repository PRs.)

View Feedback

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/fleet-e2e.yml, line 18:

<comment>Removing the job `if:` lets pull requests from forks and from any head branch run this heavy 20-minute build. Restore a same-repository check, such as `github.event.pull_request.head.repo.full_name == github.repository`, if fork PRs should not consume runner time. This matches the repo's same-repository PR gate policy.

(Based on your team's feedback about restricting PR CI to same-repository PRs.) </comment>

<file context>
@@ -9,12 +9,13 @@ name: Fleet E2E
 on:
   push:
-    branches: [main]
+    branches: [main, 'feat/fleet-**']
     paths:
       - 'packages/fleet/**'
</file context>

@khaliqgant khaliqgant Oct 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: the trunk gate is replaced by a same-repository check rather than removed, so fork PRs still do not run fleet-e2e (or the other heavy jobs).

paths:
- 'packages/fleet/**'
- 'packages/cli/**'
Expand Down Expand Up @@ -53,7 +54,6 @@ env:

jobs:
fleet-e2e:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Two-node fleet matrix
runs-on: ubuntu-latest
timeout-minutes: 20
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/large-files.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ name: Large File Check
on: [pull_request]
jobs:
check:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand Down
9 changes: 2 additions & 7 deletions .github/workflows/node-compat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,14 +18,11 @@ concurrency:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
uses: ./.github/workflows/detect-changes.yml
install-test:
name: Install Test (Node ${{ matrix.node-version }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Dropping the same-repository check lets fork PRs into main run the full install/build/test matrix. Fork code runs npm ci and its build scripts on hosted runners. Secrets stay unavailable under pull_request, so the impact is mainly runner usage and untrusted code execution. If per-PR CI on forks is not intended, keep the head.repo.full_name == github.repository condition for pull_request events in both jobs.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/node-compat.yml, line 25:

<comment>Dropping the same-repository check lets fork PRs into `main` run the full install/build/test matrix. Fork code runs `npm ci` and its build scripts on hosted runners. Secrets stay unavailable under `pull_request`, so the impact is mainly runner usage and untrusted code execution. If per-PR CI on forks is not intended, keep the `head.repo.full_name == github.repository` condition for `pull_request` events in both jobs.</comment>

<file context>
@@ -18,14 +18,11 @@ concurrency:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (needs.changes.outputs.node_changed == 'true')
+    if: needs.changes.outputs.node_changed == 'true'
     runs-on: ubuntu-latest
     strategy:
</file context>
Suggested change
if: needs.changes.outputs.node_changed == 'true'
if: needs.changes.outputs.node_changed == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)

runs-on: ubuntu-latest
strategy:
matrix:
Expand Down Expand Up @@ -86,9 +83,7 @@ jobs:
fresh-install:
name: Fresh Install (Node ${{ matrix.node-version }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'
runs-on: ubuntu-latest
strategy:
matrix:
Expand Down
14 changes: 5 additions & 9 deletions .github/workflows/package-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,11 @@ env:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
uses: ./.github/workflows/detect-changes.yml
validate:
name: Build & Validate
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: needs.changes.outputs.node_changed is only populated if the changes caller job maps the reusable workflow outputs. Add an outputs: block to changes that forwards node_changed from detect-changes.yml. Otherwise these if: gates evaluate false and the validate jobs are silently skipped. This pattern is repo-wide, so verify it on a run.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/package-validation.yml, line 28:

<comment>`needs.changes.outputs.node_changed` is only populated if the `changes` caller job maps the reusable workflow outputs. Add an `outputs:` block to `changes` that forwards `node_changed` from `detect-changes.yml`. Otherwise these `if:` gates evaluate false and the validate jobs are silently skipped. This pattern is repo-wide, so verify it on a run.</comment>

<file context>
@@ -21,14 +21,11 @@ env:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (needs.changes.outputs.node_changed == 'true')
+    if: needs.changes.outputs.node_changed == 'true'
     runs-on: ubuntu-latest
     env:
</file context>

@khaliqgant khaliqgant Oct 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not an issue: changes calls the reusable detect-changes.yml, whose on.workflow_call.outputs declares rust_changed and node_changed (mapped from its job outputs). A job that calls a reusable workflow exposes those outputs directly; it has no outputs: block of its own.

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This drops the only head-branch restriction on validate, publish-fresh-install-build, and standalone-macos-smoke, so every same-repo feature branch now runs the full build and the live-cloud macOS smoke. That conflicts with the team rule that PR CI is limited to same-repo trunk→main PRs and with the AGENTS.md prohibition on re-enabling feature-branch CI. If the restore is intended, record that exception explicitly and confirm the macOS runner and cloud-workspace cost is acceptable.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/package-validation.yml, line 28:

<comment>This drops the only head-branch restriction on `validate`, `publish-fresh-install-build`, and `standalone-macos-smoke`, so every same-repo feature branch now runs the full build and the live-cloud macOS smoke. That conflicts with the team rule that PR CI is limited to same-repo `trunk`→`main` PRs and with the AGENTS.md prohibition on re-enabling feature-branch CI. If the restore is intended, record that exception explicitly and confirm the macOS runner and cloud-workspace cost is acceptable.</comment>

<file context>
@@ -21,14 +21,11 @@ env:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (needs.changes.outputs.node_changed == 'true')
+    if: needs.changes.outputs.node_changed == 'true'
     runs-on: ubuntu-latest
     env:
</file context>

runs-on: ubuntu-latest
env:
NPM_CONFIG_FUND: false
Expand Down Expand Up @@ -202,9 +199,7 @@ jobs:
publish-fresh-install-build:
name: Publish Fresh Install Build
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'
runs-on: ubuntu-latest
env:
NPM_CONFIG_FUND: false
Expand Down Expand Up @@ -253,8 +248,9 @@ jobs:
# provisioning an undeletable workspace; other same-repository PRs and
# main pushes must reuse the CI workspace.
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository))
needs.changes.outputs.node_changed == 'true' &&
github.actor != 'dependabot[bot]' &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
runs-on: macos-latest
env:
NPM_CONFIG_FUND: false
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/prettier-fmt-fix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,7 @@ jobs:
name: Auto-format Prettier files
runs-on: ubuntu-latest
# Only run on same-repo PRs where the bot can push back formatting commits.
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
permissions:
contents: write
steps:
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/relay-evals.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,6 @@ env:

jobs:
evals:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Offline evals
runs-on: ubuntu-latest

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/relayflow-pr-proof-broker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,8 @@ jobs:
build:
name: ${{ github.event_name == 'pull_request' && 'Validate PR-head Linux broker' || 'Build exact Linux broker' }}
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository)
github.event_name != 'pull_request_target' ||
github.event.pull_request.head.repo.full_name == github.repository

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This runs the broker build for same-repository pull_request_target PRs targeting any branch, because the trigger has no branches filter. Keep github.base_ref == 'main' in this clause so PRs to other branches do not trigger the build.

(Based on your team's feedback about requiring the main base for relayflow-pr-proof-broker pull requests.)

View Feedback

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/relayflow-pr-proof-broker.yml, line 35:

<comment>This runs the broker build for same-repository `pull_request_target` PRs targeting any branch, because the trigger has no `branches` filter. Keep `github.base_ref == 'main'` in this clause so PRs to other branches do not trigger the build.

(Based on your team's feedback about requiring the main base for relayflow-pr-proof-broker pull requests.) </comment>

<file context>
@@ -31,8 +31,8 @@ jobs:
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository)
+      github.event_name != 'pull_request_target' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 30
</file context>

runs-on: ubuntu-latest
timeout-minutes: 30
steps:
Expand Down
25 changes: 6 additions & 19 deletions .github/workflows/rust-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,12 @@ env:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
uses: ./.github/workflows/detect-changes.yml

rust-test:
name: Rust Tests (${{ matrix.os }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.rust_changed == 'true')
if: needs.changes.outputs.rust_changed == 'true'

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Removing the same-repo trunk→main gate lets fork PRs and PRs to any base run the macOS and Windows matrix. If restoring per-PR CI for all PRs is intended, state that explicitly; otherwise keep the fork exclusion, e.g. github.event.pull_request.head.repo.full_name == github.repository.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/rust-ci.yml, line 25:

<comment>Removing the same-repo `trunk`→`main` gate lets fork PRs and PRs to any base run the macOS and Windows matrix. If restoring per-PR CI for all PRs is intended, state that explicitly; otherwise keep the fork exclusion, e.g. `github.event.pull_request.head.repo.full_name == github.repository`.</comment>

<file context>
@@ -17,15 +17,12 @@ env:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (needs.changes.outputs.rust_changed == 'true')
+    if: needs.changes.outputs.rust_changed == 'true'
     runs-on: ${{ matrix.os }}
     strategy:
</file context>
Suggested change
if: needs.changes.outputs.rust_changed == 'true'
if: >-
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
needs.changes.outputs.rust_changed == 'true'

runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
Expand All @@ -45,9 +42,7 @@ jobs:
relay-pty-windows-test:
name: Relay PTY Synchronization Tests (windows-latest)
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.rust_changed == 'true')
if: needs.changes.outputs.rust_changed == 'true'
runs-on: windows-latest
timeout-minutes: 10
steps:
Expand All @@ -67,9 +62,7 @@ jobs:
rust-cross-compile:
name: Cross-compile check (${{ matrix.target }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.rust_changed == 'true')
if: needs.changes.outputs.rust_changed == 'true'
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
Expand Down Expand Up @@ -103,9 +96,7 @@ jobs:
rust-clippy:
name: Clippy (${{ matrix.os }})
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.rust_changed == 'true')
if: needs.changes.outputs.rust_changed == 'true'
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
Expand All @@ -124,9 +115,7 @@ jobs:
rust-fmt:
name: Format
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.rust_changed == 'true')
if: needs.changes.outputs.rust_changed == 'true'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand All @@ -138,9 +127,7 @@ jobs:
sdk-check:
name: SDK TypeScript Check
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/rust-fmt-fix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,7 @@ jobs:
name: Auto-format Rust code
runs-on: ubuntu-latest
# Only run on same-repo PRs where the bot can push back formatting commits.
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: This gate now also matches Dependabot PRs, which get a read-only GITHUB_TOKEN, so the push step fails when formatting is needed. Exclude Dependabot as package-validation.yml already does.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/rust-fmt-fix.yml, line 23:

<comment>This gate now also matches Dependabot PRs, which get a read-only `GITHUB_TOKEN`, so the push step fails when formatting is needed. Exclude Dependabot as `package-validation.yml` already does.</comment>

<file context>
@@ -20,9 +20,7 @@ jobs:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write
</file context>
Suggested change
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'

permissions:
contents: write
steps:
Expand Down
18 changes: 4 additions & 14 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,16 +21,13 @@ concurrency:

jobs:
changes:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
uses: ./.github/workflows/detect-changes.yml

# NPM audit for known vulnerabilities
npm-audit:
name: NPM Audit
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'
runs-on: ubuntu-latest

steps:
Expand Down Expand Up @@ -60,9 +57,7 @@ jobs:
dependency-review:
name: Dependency Review
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event_name == 'pull_request')
if: github.event_name == 'pull_request'

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2:

(Based on your team's feedback about trunk-gated PR CI limited to same-repository PRs.)

Dropping the gates also drops the github.event.pull_request.head.repo.full_name == github.repository check, which the description does not mention; it says only branch-name conditions are relaxed. With these edits, fork PRs targeting main run npm ci, CodeQL autobuild, and gitleaks on GitHub-hosted runners. Restore the same-repository check on the pull_request jobs, or state this scope change in the PR description.

View Feedback

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/security.yml, line 60:

<comment>

(Based on your team's feedback about trunk-gated PR CI limited to same-repository PRs.) 

Dropping the gates also drops the `github.event.pull_request.head.repo.full_name == github.repository` check, which the description does not mention; it says only branch-name conditions are relaxed. With these edits, fork PRs targeting `main` run npm ci, CodeQL autobuild, and gitleaks on GitHub-hosted runners. Restore the same-repository check on the `pull_request` jobs, or state this scope change in the PR description.</comment>

<file context>
@@ -60,9 +57,7 @@ jobs:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (github.event_name == 'pull_request')
+    if: github.event_name == 'pull_request'
     # This job requires the dependency graph to be enabled in repo settings
     # Make it non-blocking until that's configured
</file context>

# This job requires the dependency graph to be enabled in repo settings
# Make it non-blocking until that's configured
continue-on-error: true
Expand All @@ -82,9 +77,7 @@ jobs:
codeql:
name: CodeQL Analysis
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'
runs-on: ubuntu-latest
permissions:
security-events: write
Expand All @@ -111,7 +104,6 @@ jobs:

# Secret scanning (check for accidentally committed secrets)
secrets-scan:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Secret Scanning
runs-on: ubuntu-latest
# Make non-blocking - review findings manually
Expand Down Expand Up @@ -143,9 +135,7 @@ jobs:
license-check:
name: License Compliance
needs: changes
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(needs.changes.outputs.node_changed == 'true')
if: needs.changes.outputs.node_changed == 'true'
runs-on: ubuntu-latest

steps:
Expand Down
6 changes: 1 addition & 5 deletions .github/workflows/stress-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ concurrency:

jobs:
stress-test-orchestrator:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Orchestrator Stress Tests
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -79,7 +78,6 @@ jobs:
fi

stress-test-orchestrator-integration:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Orchestrator Integration Stress Tests
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -163,9 +161,7 @@ jobs:
name: Stress Test Summary
needs: [stress-test-orchestrator, stress-test-orchestrator-integration]
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(always())
if: always()

@cubic-dev-ai cubic-dev-ai Bot Oct 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This removes the trunk-to-main gate, so stress tests now run on every PR to main from any head branch, including forks, on macOS and Linux runners. The repo policy (AGENTS.md, CLAUDE.md) limits PR CI to same-repo trunk→main PRs, so confirm this reversal is intended before merging. If the policy still holds, restore the gate on the summary job as well as the two test jobs.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/stress-tests.yml, line 164:

<comment>This removes the trunk-to-main gate, so stress tests now run on every PR to `main` from any head branch, including forks, on macOS and Linux runners. The repo policy (AGENTS.md, CLAUDE.md) limits PR CI to same-repo `trunk`→`main` PRs, so confirm this reversal is intended before merging. If the policy still holds, restore the gate on the summary job as well as the two test jobs.</comment>

<file context>
@@ -163,9 +161,7 @@ jobs:
-    if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
-      (always())
+    if: always()
 
     steps:
</file context>


steps:
- name: Download all artifacts
Expand Down
2 changes: 0 additions & 2 deletions .github/workflows/targeted-feature-verification.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ concurrency:

jobs:
select:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Select Flows v2 shards
runs-on: ubuntu-24.04
timeout-minutes: 15
Expand Down Expand Up @@ -94,7 +93,6 @@ jobs:
retention-days: 14

targeted:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Flows v2 shard ${{ matrix.shard }}
needs: select
runs-on: ubuntu-24.04
Expand Down
7 changes: 1 addition & 6 deletions .github/workflows/test-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ name: Test Build Scripts

on:
push:
branches: [main]
paths:
- 'scripts/build-bun.sh'
- 'scripts/sign-macos-binary.sh'
Expand All @@ -21,7 +20,6 @@ env:

jobs:
test-build-script:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Test build-bun.sh
runs-on: ${{ matrix.os }}
strategy:
Expand Down Expand Up @@ -109,7 +107,6 @@ jobs:
done

test-build-edge-cases:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Test edge cases
runs-on: ubuntu-latest

Expand Down Expand Up @@ -157,9 +154,7 @@ jobs:
name: Summary
needs: [test-build-script, test-build-edge-cases]
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(always())
if: always()

steps:
- name: Summary
Expand Down
Loading
Loading