-
Notifications
You must be signed in to change notification settings - Fork 217
ci: restrict workflows to run only on main repo #2347
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
ci: restrict workflows to run only on main repo #2347
Conversation
|
📊 Profiling reports are ready to be viewed
💻 CPU Comparison with base Kepler💾 Memory Comparison with base Kepler (Inuse)💾 Memory Comparison with base Kepler (Alloc)⬇️ Download the Profiling artifacts from the Actions Summary page 📦 Artifact name: 🔧 Or use GitHub CLI to download artifacts: gh run download 19027109088 -n profile-artifacts-2347 |
Prevent workflows from running on forks by adding repository owner checks to workflows that publish artifacts or use self-hosted runners. - Add check to `push.yaml` to prevent image publishing on forks - Add check to `release.yaml` to prevent release creation on forks - Add check to `k8s-bm.yaml` to prevent self-hosted runner usage on forks - Add check to `profiling.yaml` to prevent self-hosted runner usage on forks - Removed `Extract version` step from `release.yaml` since it is redundant and just copying `github.ref_name` to a step variable output without any transformation or processing This ensures fork contributors don't need to manually disable workflows and prevents unnecessary runs on forks. Signed-off-by: vprashar2929 <[email protected]>
d8cb73e to
f855c38
Compare
|
📊 Profiling reports are ready to be viewed
💻 CPU Comparison with base Kepler💾 Memory Comparison with base Kepler (Inuse)💾 Memory Comparison with base Kepler (Alloc)⬇️ Download the Profiling artifacts from the Actions Summary page 📦 Artifact name: 🔧 Or use GitHub CLI to download artifacts: gh run download 19030559999 -n profile-artifacts-2347 |
| build-and-deploy: | ||
| needs: [check-changes] | ||
| if: needs.check-changes.outputs.changes == 'true' | ||
| if: needs.check-changes.outputs.changes == 'true' && github.repository_owner == 'sustainable-computing-io' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For pipeline developer, if they run PR on their fork, it may fail as there no self-hosted runner.
Which is fine, if he/she just adjust for example sbom or helm chart test, or say a CI developer should have the knowledge to ignore error in this case.
For some one need test kepler on their own fork with their own self hosted runner, they can just reuse this workflow without changes, which means they also help tested integration on other platform for us.
I suppose we can think twice.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For some one need test kepler on their own fork with their own self hosted runner, they can just reuse this workflow without changes, which means they also help tested integration on other platform for us.
Thats the trade-off. Developers with self-hosted runners need to make a one-line change. Its a reasonable ask given that the security benefits of the restriction, improved UX for the majority of contributors without self-hosted runners. Plus anyways they have to update the workflows if they are using different name/label for their self-hosted runner. For eg: https://github.com/sustainable-computing-io/kepler/blob/main/.github/workflows/k8s-bm.yaml#L34
Prevent workflows from running on forks by adding repository owner checks to workflows that publish artifacts or use self-hosted runners.
push.yamlto prevent image publishing on forksrelease.yamlto prevent release creation on forksk8s-bm.yamlto prevent self-hosted runner usage on forksprofiling.yamlto prevent self-hosted runner usage on forksExtract versionstep fromrelease.yamlsince it isredundant and just copying
github.ref_nameto a step variableoutput without any transformation or processing
This ensures fork contributors don't need to manually disable workflows and prevents unnecessary runs on forks.