ci(integration): fix fork-lane checkout opt-in and per-event concurrency - #62
Merged
Merged
Conversation
mislavivanda
force-pushed
the
ci/integration-fork-lane-fixes
branch
from
September 17, 2026 12:46
acee4d6 to
aed8a28
Compare
aprojic
previously approved these changes
Sep 17, 2026
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review completed against the latest diff
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
Three fixes hardening + unwedging fork-PR live tests (first hit by PR #61): 1. checkout@v4 now refuses fork-code checkout in pull_request_target workflows by default. Opt in explicitly on the five suite jobs - safe here because the integration-tests environment approval is a required manual review gate, the head SHA is pinned at event time, and the workflow file always comes from main. 2. Key the concurrency group by event name. Both pull_request and pull_request_target fire for every fork PR and shared one group, so the newer queued run cancelled the older one - always killing the fork lane, the only lane that reports integration-success for fork PRs. Exactly one lane executes suites per PR, so per-lane serialization loses nothing. 3. persist-credentials: false on the suite checkouts - the approved fork code has no need for the (read-only) GITHUB_TOKEN that checkout would otherwise leave in .git/config. Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
mislavivanda
force-pushed
the
ci/integration-fork-lane-fixes
branch
from
September 17, 2026 12:55
aed8a28 to
ecce5c0
Compare
aprojic
self-requested a review
September 17, 2026 13:15
aprojic
approved these changes
Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Fork PR #61 exposed two issues in the
integration.ymlfork lane:actions/checkout@v4now refuses fork-code checkout inpull_request_targetworkflows unless explicitly opted in. The approved run for fix(pi-extension): guard before_agent_start against undefined systemPrompt #61 failed at the checkout step with:The opt-in is safe in this workflow specifically because the compensating controls GitHub's guidance calls for are already in place: the
integration-testsenvironment approval is a required manual review gate in front of every suite job, the head SHA is pinned at event time (later pushes spawn a new run needing fresh approval), and the workflow file always comes from main (a fork cannot alter the pipeline). The flag is conditional — inert in the same-repopull_requestlane.Both
pull_requestandpull_request_targetfire for every fork PR and shared one concurrency group (integration-<PR>). GitHub keeps only the newest queued run per group, so the sibling lane cancelled the fork lane 2s after creation ("Canceling since a higher priority waiting request for integration-61 exists") — killing the only lane that reports the requiredintegration-successcheck for fork PRs, wedging the PR at 'Expected'. Keying the group by event name gives each lane its own queue. Exactly one lane executes suites for any given PR (thedecide()IS_FORK gate), so per-lane serialization loses nothing and live runs stay serialized per PR.Rollout note
Re-runs reuse the original workflow snapshot, so after this merges, wedged fork PRs (#61) need a fresh event — close/reopen — to pick up the fixed workflow.
Summary by cubic
Fixes the fork PR integration workflow so fork lanes no longer fail at checkout, get cancelled by the sibling
pull_requestlane, or leave the read-onlyGITHUB_TOKENin.git/config.pull_request_targetviaallow-unsafe-pr-checkout; safe because manual approval gates the job and the workflow file comes from main.persist-credentialson suite checkouts since the approved fork code never needs to push or pull.Rollout note: Re-runs reuse the original workflow snapshot, so wedged fork PRs need a fresh event (close/reopen) to pick up the fixed workflow.
Written for commit ecce5c0. Summary will update on new commits.