Skip to content

ci: harden trunk gating #488

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kjgbot merged 1 commit into from
Oct 8, 2026
Merged

ci: harden trunk gating #488

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ permissions:

jobs:
ci:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Lint, Build & Test
runs-on: ubuntu-latest
steps:
Expand All @@ -33,7 +33,7 @@ jobs:
- run: npm run test:container

container:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Container (${{ matrix.platform }})
runs-on: ubuntu-latest
timeout-minutes: 25
Expand Down Expand Up @@ -134,7 +134,7 @@ jobs:
run: docker rm --force --volumes relaycast-ci-${{ matrix.arch }} 2>/dev/null || true

rust-sdk:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Rust SDK
runs-on: ubuntu-latest
steps:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/container-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ permissions:

jobs:
container-integration:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
name: Build and test the real image
runs-on: ubuntu-latest
timeout-minutes: 15
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
cleanup-preview:
name: Cleanup Preview
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&

@devin-ai-integration devin-ai-integration Bot Oct 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Closed preview workers remain deployed

When a feature PR with a preview worker closes, cleanup-preview skips deletion because its head is not trunk. The worker remains deployed after the PR closes.

Learn more

Preview workers were previously deployed for same-repository feature PRs by the deploy-preview job before trunk gating removed it. The current cleanup job runs only on closed events, but the trunk-only predicate discards those events for feature PRs. The remaining predicate already restricts deletion to same-repository PRs, and a closed PR always has a closed state. This leaves previously deployed workers active unless the separate audit runs in removal mode.

Example: PR #400 deployed relaycast-pr-400 before trunk gating. Closing PR #400 from feature/search skips cleanup, leaving the worker active instead of deleting it.

Recommended fix: Gate cleanup-preview only on a closed event from the same repository. Keep the existing same-repository restriction and delete both worker names as before.

Suggested change
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
(github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) &&

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@cursor cursor Bot Oct 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Closed cleanup remains trunk-gated

Medium Severity

cleanup-preview still requires a same-repo trunk → main pull request, so closing any other PR skips teardown. This change was supposed to ungate closed-only workflows, but the job kept the trunk gate and added base_ref plus head-repo checks.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 37c3236. Configure here.

(github.event.action == 'closed' && (github.event.pull_request.merged == true || github.event.pull_request.state == 'closed') && github.event.pull_request.head.repo.full_name == github.repository)
runs-on: ubuntu-latest
env:
Expand Down
15 changes: 10 additions & 5 deletions .github/workflows/trunk-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,22 @@
name: Trunk guard

# Only the `trunk` branch may merge into main. Feature branches merge into
# `trunk` (via the merge train); CI runs only on the trunk -> main PR.
# Only this repository's `trunk` branch may merge into main. Feature branches
# merge into `trunk`; CI runs only on the trunk -> main PR.
# pull_request_target loads this workflow from the base branch, so a PR cannot
# edit the guard to pass itself. It never checks out PR code.
on:
pull_request:
pull_request_target:
branches: [main]
types: [opened, synchronize, reopened, edited]

permissions: {}

jobs:
only-trunk-merges-to-main:
if: github.head_ref != 'trunk'
if: github.head_ref != 'trunk' || github.event.pull_request.head.repo.full_name != github.repository
runs-on: ubuntu-latest
timeout-minutes: 1
steps:
- run: |
echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'."
echo "::error::Only this repository's 'trunk' branch may merge into main. Retarget this PR to 'trunk'."
exit 1
Loading