From 712b427a9c510d7f83a9806a3ae86035e08d4219 Mon Sep 17 00:00:00 2001 From: bherbruck Date: Sat, 17 Oct 2026 19:37:10 -0400 Subject: [PATCH] CI: a fork PR's Select checks and ci jobs run on the untrusted runners too (#2252) Every fork run waited in GitHub's shared queue just to start. The gate and summary jobs now run on the isolated runners as well; the local output stays false for forks so later jobs never pick the trusted pool. Co-authored-by: Claude Opus 5.5 --- .github/workflows/ci.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3d510dc3..918ba34c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,7 +72,7 @@ jobs: changes: name: Select checks # Trusted runs (see the top of this file) use the self-hosted runners. - runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'self-hosted-light' || 'ubuntu-24.04' }} + runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'self-hosted-light' || ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) && 'self-hosted-untrusted' || 'ubuntu-24.04') }} permissions: contents: read # To ask whether the merge queue already tested a commit pushed to main. @@ -85,7 +85,9 @@ jobs: packages: ${{ steps.paths.outputs.packages }} oracle: ${{ steps.paths.outputs.oracle }} # Whether the other Linux jobs use the self-hosted runners too. - local: ${{ runner.environment == 'self-hosted' }} + # Trusted self-hosted runs only: a fork PR's checks run on the untrusted pool and must never + # route the jobs after them to the trusted runners. + local: ${{ runner.environment == 'self-hosted' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -582,7 +584,7 @@ jobs: ci: needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup] if: always() - runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-light' || 'ubuntu-24.04' }} + runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-light' || ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) && 'self-hosted-untrusted' || 'ubuntu-24.04') }} steps: - name: Verify required checks env: