From 222db9e2916607c8a07f85fb0be37729d8e3b78f Mon Sep 17 00:00:00 2001
From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com>
Date: Thu, 13 Aug 2026 09:57:00 +0300
Subject: [PATCH] ci: keep inherited workflows from billing non-canonical repos
 (#118)

A clone of this repo pushed to a new repository -- a private mirror, an
internal re-host -- inherits .github/workflows together with its cron.
The full platform matrix then runs on that owner's Actions bill, nightly
and unattended. Forks are only partially covered: GitHub disables
scheduled workflows there, but nothing covers a fresh repository, and
nothing warns the owner.

This mirrors OpenIPC/firmware#2255, where the same inherited cron was
measured at 97 jobs and 2,146 billed minutes from a single unattended
night, and never converged: publishing failed on the mirror, so the sha
skip-gate could never engage and the matrix rebuilt in full every night.

The rule: unattended runs happen only on the canonical repo. Anywhere
else a workflow runs only if someone explicitly asked for it
(workflow_dispatch), or if it is both free and attended (pull_request on
a public repo). This is deliberately stricter than gating purely on cost
-- a public re-host's minutes are free and its cron is still skipped,
because a re-host quietly publishing nightly releases under its own name
is a worse outcome than wasted minutes.

master carries the guard on preflight; buildroot needs it and inherits
the skip. manifest gates its cron-originated workflow_run path the same
way, because a nightly whose jobs all skipped still completes and fires
workflow_run. cleanup carries it on its weekly cron. build-one is
dispatch-only and needs nothing.

The pull_request clause is unreachable here today -- no workflow in this
repo has a pull_request trigger -- and is kept on purpose: it is the
clause that lets contributor PRs run, and omitting it would mean adding
a pull_request trigger later silently skips CI on every fork. That
over-block was the first thing reviewers caught upstream.

Upstream impact is none: on OpenIPC/builder the first disjunct is true,
so every added condition is a tautology and each job's if reduces to
what it was before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/cleanup.yml  |  3 +++
 .github/workflows/manifest.yml | 11 +++++++++--
 .github/workflows/master.yml   | 16 ++++++++++++++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index 89944d0..dd2d57f 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -15,6 +15,9 @@ concurrency:
 jobs:
   prune:
     name: Prune old nightly releases
+    # Canonical repo only on the weekly cron -- see master.yml's preflight.
+    # Dispatch runs are unaffected.
+    if: github.event_name != 'schedule' || github.repository == 'OpenIPC/builder'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/manifest.yml b/.github/workflows/manifest.yml
index 58e3e57..723e4f1 100644
--- a/.github/workflows/manifest.yml
+++ b/.github/workflows/manifest.yml
@@ -19,9 +19,16 @@ jobs:
     # transient toolchain 502) should not deny manifest updates for the
     # platforms that did upload artifacts. enrich_manifest.py reads
     # whatever assets actually exist on the release.
+    #
+    # First clause: on a mirror the nightly's jobs skip, but the run still
+    # completes and fires workflow_run, so gate the cron-originated path on
+    # the canonical repo too -- see master.yml's preflight. Dispatch-driven
+    # manifest regeneration is untouched anywhere.
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      contains(fromJSON('["success", "failure"]'), github.event.workflow_run.conclusion)
+      (github.event.workflow_run.event != 'schedule' ||
+       github.repository == 'OpenIPC/builder') &&
+      (github.event_name == 'workflow_dispatch' ||
+       contains(fromJSON('["success", "failure"]'), github.event.workflow_run.conclusion))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout master (for the script)
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 4f394b4..c8b86cb 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -11,6 +11,22 @@ on:
 jobs:
   preflight:
     name: Preflight
+    # Guard rail for clones of this repo. A clone pushed to a new repository
+    # (a private mirror, an internal re-host) inherits this file along with
+    # its cron, and the full platform matrix then runs on that owner's Actions
+    # bill, nightly and unattended, publishing nightlies nobody reads. Forks
+    # are partially covered (GitHub disables scheduled workflows there), a
+    # fresh repository is not. Mirrors OpenIPC/firmware#2255.
+    #
+    # Unattended runs happen only on the canonical repo. Anywhere else a
+    # workflow runs only if someone explicitly asked for it, or if it is both
+    # free and attended. The pull_request clause is unreachable today -- this
+    # workflow has no pull_request trigger -- and is kept deliberately, so
+    # that adding one later does not silently skip CI on contributor forks.
+    if: >-
+      github.repository == 'OpenIPC/builder' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && !github.event.repository.private)
     runs-on: ubuntu-latest
     outputs:
       should_build: ${{ steps.gate.outputs.should_build }}