Repository navigation
ci(#1975): move functional, behaviour and vouch workflows off pull_request_target - #1976
Merged
Merged
Conversation
GitHub blocks pull_request_target by default on public repos from 2026-12-02. This is the codeable part of moving the functional, behaviour and vouch workflows off it; the .github/workflows/ edits (pull_request triggers, new ok-to-test.yml, scheduled vouch-check.yml) are left for the maintainer: the code agent cannot push .github/workflows/. - check-e2e-authorization.sh + action: port fullsend's /ok-to-test command mode (EVENT_NAME=issue_comment). The comment is read from the API by id, must be on the PR and by the commenter, the commenter needs admin/maintain/write, and the first line must name the full 40-char head sha. New inputs event_name, commenter_login, comment_id; new output head_sha; reasons ok_to_test, untrusted_commenter, missing_sha, stale_ok_to_test, error. Gate comment text points at /ok-to-test <full sha of the latest push>. - check-rollup-result.sh: pull_request and issue_comment replace pull_request_target; the labeled-event mirroring is removed; a skipped detect on a PR event fails with a message naming /ok-to-test <sha>. - vouch-sweep.sh: scheduled vouch gate ported from fullsend, reading VOUCHED.td from fullsend-ai/fullsend's vouched branch as today. Replaces vouch-check-test.sh in make script-test. - workflow-triggers-test.sh: yq guard that fails when any workflow but the allowlisted fullsend.yaml declares pull_request_target under on:. - CONTRIBUTING.md, eval/README.md: document /ok-to-test <sha>. workflow-triggers-test.sh fails until the maintainer moves functional-tests.yml, behaviour-tests.yml and vouch-check.yml off pull_request_target; that is the guard working as intended. Note: pre-commit could not fetch hook repos in the sandbox (TLS error); hooks were run directly at their pinned versions (pre-commit-hooks 6.0.0, shellcheck-py 0.10.0.1, lint-release-cases) and passed. gitleaks ran via scan-secrets. make lint could not run (no uvx); skillsaw 0.18.0 --strict was run directly and passed. Related to #1975
Member
|
/fs-fix-stop |
|
Fix agent disabled for this PR. Remove the |
…quest_target GitHub blocks pull_request_target by default on public repos from 2026-12-02. Same-repo PRs now run Functional Tests and Behaviour Tests on pull_request behind gh-aw's same-repo guard. Fork PRs run only after a writer comments `/ok-to-test <sha>`: ok-to-test.yml authorizes that exact sha, creates functional-tests-complete and behaviour check runs on it, calls both suites through workflow_call and completes the checks from their results. Vouch Check runs vouch-sweep.sh on a 10-minute schedule. merge_group, push and fullsend release.yml calls are unchanged. Assisted-by: Claude Signed-off-by: Wayne Sun <gsun@redhat.com>
|
🤖 Review · Commit: This review was superseded by a newer commit. Check the current pull request HEAD's review status before merging. |
|
🤖 Finished Review · Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.35 This review was superseded by a newer commit. Check the current pull request HEAD's review status before merging. |
A called functional-tests-complete job that finished its steps in seconds was marked cancelled at its 1-minute limit, and ok-to-test.yml now reads its result. The comments now say what pull_request actually trusts: a fork PR controls the workflow file, checkout does not enforce /ok-to-test, and the roll-up is not a required check. Assisted-by: Claude Signed-off-by: Wayne Sun <gsun@redhat.com>
waynesun09
changed the title
|
🤖 Finished Review · ✅ Success · Started 7:40 PM UTC · Completed 7:51 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $2.60 |
|
Risk Assessment: moderate (2/5) DetailsModerate risk reflects extensive CI workflow and protected path modifications by an established bot author, balanced by solid test coverage, moderate historical churn across modified files, and complete alignment with linked issue acceptance criteria. |
ReviewFindingsMedium
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
waynesun09
approved these changes
Nov 12, 2026
waynesun09
left a comment
waynesun09
left a comment
Member
There was a problem hiding this comment.
Approving. This ports fullsend#9246 to agents ahead of GitHub's 2026-12-02 pull_request_target default block. Functional and behaviour tests run on pull_request with the same-repo guard, forks need /ok-to-test from a writer, vouch-check runs on a schedule, and a guard test rejects pull_request_target. Validated in a temp repo, and CI is green.
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1975.
GitHub blocks
pull_request_targetby default on public repos from 2026-12-02 (next brownout 2026-11-16). This PR moves Functional Tests, Behaviour Tests and Vouch Check off it, with the same design as fullsend-ai/fullsend#9246.What changes for contributors
pull_request, gated as before (write access or trusted bot)/ok-to-test <full 40-char sha>. The checksfunctional-tests-completeandbehaviourthen land on that sha. A new push needs a new comment.ok-to-testlabel no longer starts a run./ok-to-test, because forkpull_requestruns get no secrets.merge_group, push tomain, the nightly and fullsend'srelease.ymlcall are unchanged. The required checks (script-test,test,commit-lint,skillsaw) come frompull_requestworkflows already.Changes
functional-tests.yml,behaviour-tests.ymlpull_requestwith gh-aw's same-repo guard (head.repo.id == repository_id); newworkflow_callinputspr_number/head_sha(optional infunctional-tests.yml, sorelease.ymlis unaffected); separate*-ok-to-test-<pr>concurrency groups; aresultoutputok-to-test.yml(new)issue_comment→authorize(commenter role + exact sha) → calls both suites →reportcompletes the check runs. Onlyauthorizeandreportholdchecks: write/pull-requests: writevouch-check.ymlschedule+workflow_dispatch(dry_run), runs.github/scripts/vouch-sweep.sh.github/scripts/check-e2e-authorization.sh, the action/ok-to-test <sha>mode: comment read by id; reasonsok_to_test,untrusted_commenter,missing_sha,stale_ok_to_test.github/scripts/check-rollup-result.shpull_request/issue_comment; a fork failure names the/ok-to-test <sha>to post.github/scripts/workflow-triggers-test.sh(new)pull_request_target; onlyfullsend.yamlis allowlisted (it moves in fullsend-ai/fullsend#9230)CONTRIBUTING.md,eval/README.md/ok-to-testinstructionsgh-aw reference (
mainat62ddc3a8): same-repo guard inpkg/workflow/expression_builder.goL377-385; role-gated slash commands inpkg/workflow/command.goandrole_checks.goL152; writes kept out of jobs that run PR code (architecture.mdxL145). Links are in #1975.Validation
Real runs in
nonflux/tmp-1975-ok-to-test, a copy of this tree with the suite steps stubbed to "check out, print HEAD" (no secrets there):pull_request:gate,detect,functional-tests,functional-tests-complete,behaviourall passgate/detect/behaviourskipped;functional-tests-completefails withcomment '/ok-to-test 7bc7d45446f2fd76419d745901917b8a7af046d1' on the PR/ok-to-test 7bc7d45reason=missing_sha/ok-to-test <other sha>reason=stale_ok_to_test, gate comment updated/ok-to-test 7bc7d454…ran on 7bc7d45446f2fd76419d745901917b8a7af046d1;functional-tests-completeandbehavioursuccess on that sha (app 15368)dry_run#2: waynesun09 has write access; skippingOn this PR, the
pull_requestruns of both workflows ran in this repo with real secrets. The stray cancelledpull_request_targetruns come frommain's old workflow sharing the concurrency group, and stop after merge.Script tests:
check-e2e-authorization-test.sh,check-rollup-result-test.sh(24),vouch-sweep-test.sh,workflow-triggers-test.shpass;actionlintclean.After merge
Comment
/ok-to-test <sha>on one real fork PR to confirm the path with real secrets;issue_commentworkflows only run from the default branch, so this cannot run before merge.