feat: CI - Introduced workflow condition that prevents accidental workflow runs in a forks main branch #6502
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
microsoft-github-policy-service
bot
added
Needs: Triage 🔍
AlexanderSehr
commented
Jan 14, 2026
avm-organizer
bot
added
the
Needs: Core Team 🧞
5 tasks
eriqua
added
Type: CI 🚀
yffok
pushed a commit
to yffok/bicep-registry-modules
that referenced
this pull request
Jan 15, 2026
…kflow runs in a forks main branch (Azure#6502) ## Description The workflow is configured in a way that it will trigger on any changes in Upstream's (i.e., `Azure/bicep-registry-modules`) `main` branch if they may have an impact on the module or its validation. However, while in a fork, the workflow will stop right after initiation thanks to the condition: ```yml # Only run if not canceled and not in a fork, unless triggered by a workflow_dispatch event if: ${{ !cancelled() && !(github.repository != 'Azure/bicep-registry-modules' && github.event_name != 'workflow_dispatch') }} ``` This condition ensures that you don't accidently trigger a large amount of module workflows when e.g., merging changes from upstream into your fork. Due to the nature of triggers it's unfortunately not possible to not trigger them outright. ## Pipeline Reference <!-- Insert your Pipeline Status Badge below --> | Pipeline | | -------- | [](https://github.com/Azure/bicep-registry-modules/actions/workflows/avm.res.compute.gallery.yml) ## Type of Change <!-- Use the checkboxes [x] on the options that are relevant. --> - Azure Verified Module updates: - [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`: - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`. - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`. - [ ] Update to documentation - [x] Update to CI Environment or utilities (Non-module affecting changes)
AlexanderSehr
added a commit
that referenced
this pull request
Jan 15, 2026
…e' condition is implemented (#6503) ## Description Adds a test that ensures that the conditions - `!cancelled()` - `!(github.repository != 'Azure/bicep-registry-modules' && github.event_name != 'workflow_dispatch')` exist as a condition for the `job_initialize_pipeline` pipeline step. Related to - #6502 - Azure/Azure-Verified-Modules#2551 Output for passing test ``` [+] [analysis-services/server] GitHub workflow [avm.res.analysis-services.server.yml]. Should have the expected push trigger path filters. 59ms (58ms|1ms) [+] [analysis-services/server] GitHub workflow [avm.res.analysis-services.server.yml]. Should have a condition to run only automatically on changes in upstream main. 80ms (79ms|1ms) [+] [analysis-services/server] GitHub workflow [avm.res.analysis-services.server.yml]. Should only have the expected push trigger path filters. 64ms (62ms|2ms) ``` Output for failed test ``` [+] [web/site] GitHub workflow [avm.res.web.site.yml]. Should have the expected push trigger path filters. 4ms (2ms|2ms) [-] [web/site] GitHub workflow [avm.res.web.site.yml]. Should have a condition to run only automatically on changes in upstream main. 27ms (25ms|2ms) Expected 0, because the number of missing conditions of the `job_initialize_pipeline` step should be 0, but got [!cancelled(), !(github.repository != 'Azure/bicep-registry-modules' && github.event_name != 'workflow_dispatch')]., but got 2. at $missingConditions.Count | Should -Be 0 -Because ('the number of missing conditions of the `job_initialize_pipeline` step should be 0, but got [{0}].' -f ($missingConditions -join ', ')), C:\dev\ip\bicep-registry-modules\Upstream-Azure\utilities\pipelines\staticValidation\compliance\module.tests.ps1:617 at <ScriptBlock>, C:\dev\ip\bicep-registry-modules\Upstream-Azure\utilities\pipelines\staticValidation\compliance\module.tests.ps1:617 [+] [web/site] GitHub workflow [avm.res.web.site.yml]. Should only have the expected push trigger path filters. 3ms (2ms|1ms) ``` ## Pipeline Reference <!-- Insert your Pipeline Status Badge below --> | Pipeline | | -------- | [](https://github.com/Azure/bicep-registry-modules/actions/workflows/avm.res.analysis-services.server.yml) (should pass) [](https://github.com/Azure/bicep-registry-modules/actions/workflows/avm.res.web.site.yml) (should fail) ## Type of Change <!-- Use the checkboxes [x] on the options that are relevant. --> - Azure Verified Module updates: - [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`: - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`. - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`. - [ ] Update to documentation - [x] Update to CI Environment or utilities (Non-module affecting changes) --------- Co-authored-by: Erika Gressi <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
](https://github.com/Azure/bicep-registry-modules/actions/workflows/avm.res.compute.gallery.yml){kind=link}
](https://github.com/Azure/bicep-registry-modules/actions/workflows/avm.res.analysis-services.server.yml){kind=link}
](https://github.com/Azure/bicep-registry-modules/actions/workflows/avm.res.web.site.yml){kind=link}
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
The workflow is configured in a way that it will trigger on any changes in Upstream's (i.e.,
Azure/bicep-registry-modules)mainbranch if they may have an impact on the module or its validation. However, while in a fork, the workflow will stop right after initiation thanks to the condition:This condition ensures that you don't accidently trigger a large amount of module workflows when e.g., merging changes from upstream into your fork. Due to the nature of triggers it's unfortunately not possible to not trigger them outright.
Pipeline Reference
Type of Change
version.json:version.json.version.json.