From 272a68e6a8c5b6e643ab64548c709243ca4436de Mon Sep 17 00:00:00 2001 From: kazuki nakai Date: Sat, 25 Jul 2026 07:14:14 +0900 Subject: [PATCH 1/2] ci: route private required gates to org pool --- .github/workflows/org-quality-gate.yml | 4 +++- tests/test_workflow_wiring.py | 8 ++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml index 45e53e9..2a47266 100644 --- a/.github/workflows/org-quality-gate.yml +++ b/.github/workflows/org-quality-gate.yml @@ -18,5 +18,7 @@ jobs: uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@ce8723bb24baea6546a3b77e1327f94fcc1c4064 with: source-ref: ce8723bb24baea6546a3b77e1327f94fcc1c4064 - linux-runs-on: ${{ github.repository == 'agiletec-inc/agiletec' && 'agiletec-ci-runner' || github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }} + # Every private repository uses the isolated organization-required pool. + # Repository-specific routing would create an exception in the org gate. + linux-runs-on: ${{ github.event.repository.private && 'org-required-ci' || 'ubuntu-latest' }} swift-runs-on: macos-latest diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py index 72fe5cc..561461e 100644 --- a/tests/test_workflow_wiring.py +++ b/tests/test_workflow_wiring.py @@ -48,11 +48,11 @@ def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None: self.assertRegex(source, r"(?m)^\s*actions:\s*read\s*$") self.assertRegex(source, r"(?m)^\s*checks:\s*read\s*$") - def test_agiletec_uses_dedicated_fast_runner_and_other_private_repos_use_shared_light(self) -> None: + def test_private_repositories_use_the_organization_required_runner(self) -> None: source = ORG_CALLER.read_text() - self.assertIn("org-shared-ci-light", source) - self.assertIn("github.repository == 'agiletec-inc/agiletec'", source) - self.assertIn("'agiletec-ci-runner'", source) + self.assertIn("'org-required-ci'", source) + self.assertNotIn("github.repository", source) + self.assertNotIn("agiletec-ci-runner", source) def test_ci_discovers_all_contract_test_modules(self) -> None: source = CI.read_text() From de299ff7afa338cf3f926354fdc2b74b0f3034c8 Mon Sep 17 00:00:00 2001 From: kazuki nakai Date: Sat, 25 Jul 2026 07:15:59 +0900 Subject: [PATCH 2/2] ci: pin required gate after duplicate skip --- .github/workflows/org-quality-gate.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml index 2a47266..0942433 100644 --- a/.github/workflows/org-quality-gate.yml +++ b/.github/workflows/org-quality-gate.yml @@ -15,9 +15,9 @@ permissions: jobs: quality-gate: name: quality-gate - uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@ce8723bb24baea6546a3b77e1327f94fcc1c4064 + uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@1941747f4149058807fc3e10d69412508027b9bd with: - source-ref: ce8723bb24baea6546a3b77e1327f94fcc1c4064 + source-ref: 1941747f4149058807fc3e10d69412508027b9bd # Every private repository uses the isolated organization-required pool. # Repository-specific routing would create an exception in the org gate. linux-runs-on: ${{ github.event.repository.private && 'org-required-ci' || 'ubuntu-latest' }}