Enable workflows to run on forks #1742

Author: ales-otf

.github/workflows/require-clean-merges.yml

@@ -34,6 +34,14 @@ jobs:
           else
             echo "MERGE_BRANCHES=devnet-ready devnet testnet main" >> $GITHUB_ENV
           fi
+          
+      - name: Add Fork Remote and Fetch PR Branch
+        if: github.event.pull_request.head.repo.fork == true
+        run: |
+          PR_BRANCH="${{ github.event.pull_request.head.ref }}"
+          PR_FORK="${{ github.event.pull_request.head.repo.clone_url }}"
+          git remote add fork $PR_FORK
+          git fetch --no-tags --prune fork $PR_BRANCH
 
       - name: Check Merge Cleanliness
         run: |
@@ -42,25 +50,33 @@ jobs:
           echo "Fetching all branches..."
           git fetch --all --prune
 
+          if [[ "${{github.event.pull_request.head.repo.fork}}" == "true" ]]; then
+            PR_BRANCH_REF="fork/$PR_BRANCH"
+            echo "Using fork reference: $PR_BRANCH_REF"
+          else
+            PR_BRANCH_REF="origin/$PR_BRANCH"
+            echo "Using origin reference: $PR_BRANCH_REF"
+          fi
+
           echo "Checking out PR branch: $PR_BRANCH"
-          git checkout $PR_BRANCH
-          git reset --hard origin/$PR_BRANCH
+          git checkout $PR_BRANCH_REF
+          git reset --hard $PR_BRANCH_REF
 
           # Configure a temporary Git identity to allow merging
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Actions"
 
           for branch in $MERGE_BRANCHES; do
-            echo "Checking merge from $branch into $PR_BRANCH..."
+            echo "Checking merge from $branch into $PR_BRANCH_REF..."
             
             # Ensure PR branch is up to date
-            git reset --hard origin/$PR_BRANCH
+            git reset --hard $PR_BRANCH_REF
 
             # Merge without committing to check for conflicts
             if git merge --no-commit --no-ff origin/$branch; then
-              echo "✅ Merge from $branch into $PR_BRANCH is clean."
+              echo "✅ Merge from $branch into $PR_BRANCH_REF is clean."
             else
-              echo "❌ Merge conflict detected when merging $branch into $PR_BRANCH"
+              echo "❌ Merge conflict detected when merging $branch into $PR_BRANCH_REF"
               exit 1
             fi
             

.github/workflows/run-benchmarks.yml

@@ -24,18 +24,20 @@ jobs:
         if: ${{ env.SKIP_BENCHMARKS != '1' }}
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
 
       - name: Install GitHub CLI
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        # We disallow skipping benchmarks for PRs from forks to avoid exposing secrets
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y gh
           echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
 
       - name: Check skip label
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           labels=$(gh pr view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
           if echo "$labels" | grep -q "skip-validate-benchmarks"; then
@@ -50,7 +52,7 @@ jobs:
           sudo apt-get install -y clang curl libssl-dev llvm libudev-dev protobuf-compiler
 
       - name: Check skip label
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           labels=$(gh pr view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
           if echo "$labels" | grep -q "skip-validate-benchmarks"; then
@@ -66,7 +68,7 @@ jobs:
           toolchain: stable
 
       - name: Check skip label
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           labels=$(gh pr view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
           if echo "$labels" | grep -q "skip-validate-benchmarks"; then
@@ -81,7 +83,7 @@ jobs:
           key: bench-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Check skip label
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           labels=$(gh pr view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
           if echo "$labels" | grep -q "skip-validate-benchmarks"; then
@@ -95,7 +97,7 @@ jobs:
           cargo build --profile production -p node-subtensor --features runtime-benchmarks
 
       - name: Check skip label
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           labels=$(gh pr view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
           if echo "$labels" | grep -q "skip-validate-benchmarks"; then
@@ -110,7 +112,7 @@ jobs:
           ./scripts/benchmark_action.sh
 
       - name: Check skip label after run
-        if: ${{ env.SKIP_BENCHMARKS != '1' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && env.SKIP_BENCHMARKS != '1' }}
         run: |
           labels=$(gh pr view ${{ github.event.pull_request.number }} --json labels --jq '.labels[].name')
           if echo "$labels" | grep -q "skip-validate-benchmarks"; then