Skip to content

ci: restrict workflows to run only on main repo #2347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −24
Open

ci: restrict workflows to run only on main repo #2347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/k8s-bm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:

build-and-deploy:
needs: [check-changes]
if: needs.check-changes.outputs.changes == 'true'
if: needs.check-changes.outputs.changes == 'true' && github.repository_owner == 'sustainable-computing-io'
Copy link
Collaborator

@SamYuan1990 SamYuan1990 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For pipeline developer, if they run PR on their fork, it may fail as there no self-hosted runner.
Which is fine, if he/she just adjust for example sbom or helm chart test, or say a CI developer should have the knowledge to ignore error in this case.

For some one need test kepler on their own fork with their own self hosted runner, they can just reuse this workflow without changes, which means they also help tested integration on other platform for us.

I suppose we can think twice.

Copy link
Collaborator Author

@vprashar2929 vprashar2929 Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For some one need test kepler on their own fork with their own self hosted runner, they can just reuse this workflow without changes, which means they also help tested integration on other platform for us.

Thats the trade-off. Developers with self-hosted runners need to make a one-line change. Its a reasonable ask given that the security benefits of the restriction, improved UX for the majority of contributors without self-hosted runners. Plus anyways they have to update the workflows if they are using different name/label for their self-hosted runner. For eg: https://github.com/sustainable-computing-io/kepler/blob/main/.github/workflows/k8s-bm.yaml#L34

runs-on: self-hosted
steps:
# NOTE: In case of self-hosted runners, tools like docker, make, kubectl etc. are installed at the time of setting up the runner.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/profiling.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:

profiling:
needs: check-changes
if: needs.check-changes.outputs.changes == 'true'
if: needs.check-changes.outputs.changes == 'true' && github.repository_owner == 'sustainable-computing-io'
runs-on: self-hosted
steps:
# NOTE: In case of self-hosted runners, tools like docker, make, kubectl etc. are installed at the time of setting up the runner.
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ jobs:
uses: ./.github/workflows/scorecard.yml

publish:
if: github.repository_owner == 'sustainable-computing-io'
runs-on: ubuntu-latest
steps:
- name: Checkout source
Expand Down
30 changes: 8 additions & 22 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ on: # yamllint disable-line rule:truthy

# default permissions as read only
permissions: read-all

jobs:
build:
if: github.repository_owner == 'sustainable-computing-io'
runs-on: ubuntu-latest
env:
IMG_BASE: quay.io/sustainable_computing_io
Expand Down Expand Up @@ -45,22 +45,15 @@ jobs:
shell: bash
run: make deps

- name: Extract version
shell: bash
id: version
run: |
TAG_NAME=${{ github.ref_name }}
echo "version=$TAG_NAME" >> "$GITHUB_OUTPUT"

- name: Build Image
shell: bash
run: |
make image VERSION=${{ steps.version.outputs.version }}
make image VERSION=${{ github.ref_name }}

- name: Update Helm Chart Version
shell: bash
run: |
VERSION=${{ steps.version.outputs.version }}
VERSION=${{ github.ref_name }}
# Remove 'v' prefix from version
CHART_VERSION=${VERSION#v}
# Update Chart.yaml with the release version
Expand All @@ -71,7 +64,7 @@ jobs:
shell: bash
run: |
mkdir -p helm-releases
VERSION=${{ steps.version.outputs.version }}
VERSION=${{ github.ref_name }}
# Remove 'v' prefix from version
CHART_VERSION=${VERSION#v}
helm package manifests/helm/kepler -d helm-releases
Expand All @@ -81,7 +74,7 @@ jobs:
- name: Build Kepler binary
shell: bash
run: |
VERSION=${{ steps.version.outputs.version }}
VERSION=${{ github.ref_name }}
# Remove 'v' prefix from version
VERSION=${VERSION#v}
make build PRODUCTION=1
Expand All @@ -101,12 +94,12 @@ jobs:
- name: Push Image
shell: bash
run: |
make push VERSION=${{ steps.version.outputs.version }}
make push VERSION=${{ github.ref_name }}

- name: Push Helm Chart to OCI registry
shell: bash
run: |
VERSION=${{ steps.version.outputs.version }}
VERSION=${{ github.ref_name }}
# Remove 'v' prefix from version
CHART_VERSION=${VERSION#v}
helm push helm-releases/kepler-helm-${CHART_VERSION}.tgz oci://${{ env.IMG_BASE }}/charts
Expand All @@ -125,18 +118,11 @@ jobs:
with:
name: release-artifacts

- name: Extract version
shell: bash
id: version
run: |
TAG_NAME=${{ github.ref_name }}
echo "version=$TAG_NAME" >> "$GITHUB_OUTPUT"

- name: Create GitHub Release
uses: softprops/action-gh-release@v2
with:
tag_name: ${{ github.ref_name }}
name: release-${{ steps.version.outputs.version }}
name: release-${{ github.ref_name }}
generate_release_notes: true
draft: false
make_latest: true
Expand Down
Loading