From 2472dddccde114d15b14d2f57986a47f67f7906a Mon Sep 17 00:00:00 2001 From: Adan Date: Wed, 12 Aug 2026 06:17:11 +0000 Subject: [PATCH] Run the Actions fallback only for fork PRs Branches within the repo are verified before the push and already carry a greentree/full status, so re-running cold CI on them defeats the point of the pre-push gate. Fork PRs are untrusted and can't have been attested, so they still run in the ephemeral runner. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1e3c19f..31da582 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,16 +1,19 @@ name: ci -# greentree's CI is `greentree serve` on a warm machine, which verifies -# every pushed commit and posts greentree/ statuses. This workflow -# is the cold-isolation fallback for pull requests (fork code should not -# run on the warm runner). It installs greentree from the checkout and -# runs the same `full` check the serve loop runs. +# The cold-isolation fallback, for pull requests from FORKS only. Code from +# a fork is untrusted and cannot have been attested in a workspace, so it +# runs here in an ephemeral runner. Branches within this repo are verified +# before the push and carry a greentree/full status already, so this job +# skips them rather than re-running cold CI (which the pre-push gate exists +# to avoid). It installs greentree from the checkout and runs the same +# `full` check. on: pull_request: jobs: check: + if: github.event.pull_request.head.repo.fork == true strategy: matrix: os: [ubuntu-latest, macos-latest]