From ef5ecfc061907a752895a73fca688c7d750aa7c0 Mon Sep 17 00:00:00 2001 From: KJGBot Date: Thu, 8 Oct 2026 16:03:31 -0700 Subject: [PATCH] ci: harden trunk gating - CI gates also require the head repo to be this repository and the base to be main (a fork branch named trunk, or trunk into another branch, no longer runs CI). - Trunk guard runs via pull_request_target (loaded from the base branch, so a PR cannot edit it to pass), re-runs on base edits, and checks head repo. - Workflows that only react to a PR closing are no longer gated. --- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/contract.yml | 2 +- .github/workflows/relayfile-evals.yml | 2 +- .github/workflows/trunk-guard.yml | 15 ++++++++++----- 4 files changed, 20 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2c67ed0a..b37e2703 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ env: jobs: go-test: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Go Test runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,7 +37,7 @@ jobs: run: go test ./... go-build: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Go Build runs-on: ubuntu-latest needs: go-test @@ -68,7 +68,7 @@ jobs: if-no-files-found: error sdk-typecheck: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: SDK Typecheck runs-on: ubuntu-latest timeout-minutes: 15 @@ -111,7 +111,7 @@ jobs: run: npm run test:bundle:bun --workspace=packages/sdk/typescript client-typecheck: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Client Typecheck runs-on: ubuntu-latest timeout-minutes: 15 @@ -144,7 +144,7 @@ jobs: run: npm run test --workspace=@relayfile/client e2e: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: E2E runs-on: ubuntu-latest needs: go-build @@ -184,7 +184,7 @@ jobs: npx tsx scripts/e2e.ts --ci backend-conformance: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Backend Conformance (Go oracle) runs-on: ubuntu-latest timeout-minutes: 25 @@ -225,7 +225,7 @@ jobs: retention-days: 14 release-tooling: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Release Tooling runs-on: ubuntu-latest timeout-minutes: 10 @@ -249,7 +249,7 @@ jobs: run: npm run test:release workers-typecheck: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Workers Typecheck runs-on: ubuntu-latest timeout-minutes: 15 diff --git a/.github/workflows/contract.yml b/.github/workflows/contract.yml index 31423a9f..d1438ea0 100644 --- a/.github/workflows/contract.yml +++ b/.github/workflows/contract.yml @@ -8,7 +8,7 @@ on: jobs: contract: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') runs-on: ubuntu-latest steps: - name: Checkout diff --git a/.github/workflows/relayfile-evals.yml b/.github/workflows/relayfile-evals.yml index 649ee8be..72081f42 100644 --- a/.github/workflows/relayfile-evals.yml +++ b/.github/workflows/relayfile-evals.yml @@ -52,7 +52,7 @@ env: jobs: evals: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Provider-backed evals runs-on: ubuntu-latest diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml index 2ddb4975..fbe379e4 100644 --- a/.github/workflows/trunk-guard.yml +++ b/.github/workflows/trunk-guard.yml @@ -1,17 +1,22 @@ name: Trunk guard -# Only the `trunk` branch may merge into main. Feature branches merge into -# `trunk` (via the merge train); CI runs only on the trunk -> main PR. +# Only this repository's `trunk` branch may merge into main. Feature branches +# merge into `trunk`; CI runs only on the trunk -> main PR. +# pull_request_target loads this workflow from the base branch, so a PR cannot +# edit the guard to pass itself. It never checks out PR code. on: - pull_request: + pull_request_target: branches: [main] + types: [opened, synchronize, reopened, edited] + +permissions: {} jobs: only-trunk-merges-to-main: - if: github.head_ref != 'trunk' + if: github.head_ref != 'trunk' || github.event.pull_request.head.repo.full_name != github.repository runs-on: ubuntu-latest timeout-minutes: 1 steps: - run: | - echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'." + echo "::error::Only this repository's 'trunk' branch may merge into main. Retarget this PR to 'trunk'." exit 1