From c9c7b00c3261366bc078316759bcdd244fedee4c Mon Sep 17 00:00:00 2001 From: KJGBot Date: Thu, 8 Oct 2026 16:05:28 -0700 Subject: [PATCH] ci: harden trunk gating - CI gates also require the head repo to be this repository and the base to be main (a fork branch named trunk, or trunk into another branch, no longer runs CI). - Trunk guard runs via pull_request_target (loaded from the base branch, so a PR cannot edit it to pass), re-runs on base edits, and checks head repo. - Workflows that only react to a PR closing are no longer gated. --- .github/workflows/ci.yml | 2 +- .github/workflows/contract.yml | 2 +- .github/workflows/trunk-guard.yml | 15 ++++++++++----- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4ec4bd18..57da0cc4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ permissions: jobs: build-and-test: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Build & Test runs-on: ubuntu-latest steps: diff --git a/.github/workflows/contract.yml b/.github/workflows/contract.yml index d23b6d83..6634c6b1 100644 --- a/.github/workflows/contract.yml +++ b/.github/workflows/contract.yml @@ -7,7 +7,7 @@ on: jobs: contract: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml index 2ddb4975..fbe379e4 100644 --- a/.github/workflows/trunk-guard.yml +++ b/.github/workflows/trunk-guard.yml @@ -1,17 +1,22 @@ name: Trunk guard -# Only the `trunk` branch may merge into main. Feature branches merge into -# `trunk` (via the merge train); CI runs only on the trunk -> main PR. +# Only this repository's `trunk` branch may merge into main. Feature branches +# merge into `trunk`; CI runs only on the trunk -> main PR. +# pull_request_target loads this workflow from the base branch, so a PR cannot +# edit the guard to pass itself. It never checks out PR code. on: - pull_request: + pull_request_target: branches: [main] + types: [opened, synchronize, reopened, edited] + +permissions: {} jobs: only-trunk-merges-to-main: - if: github.head_ref != 'trunk' + if: github.head_ref != 'trunk' || github.event.pull_request.head.repo.full_name != github.repository runs-on: ubuntu-latest timeout-minutes: 1 steps: - run: | - echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'." + echo "::error::Only this repository's 'trunk' branch may merge into main. Retarget this PR to 'trunk'." exit 1