piotr/openipc-builder
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases 2 Wiki Activity

ci: keep inherited workflows from billing non-canonical repos (#118)

Browse Source 
A clone of this repo pushed to a new repository -- a private mirror, an
internal re-host -- inherits .github/workflows together with its cron.
The full platform matrix then runs on that owner's Actions bill, nightly
and unattended. Forks are only partially covered: GitHub disables
scheduled workflows there, but nothing covers a fresh repository, and
nothing warns the owner.

This mirrors OpenIPC/firmware#2255, where the same inherited cron was
measured at 97 jobs and 2,146 billed minutes from a single unattended
night, and never converged: publishing failed on the mirror, so the sha
skip-gate could never engage and the matrix rebuilt in full every night.

The rule: unattended runs happen only on the canonical repo. Anywhere
else a workflow runs only if someone explicitly asked for it
(workflow_dispatch), or if it is both free and attended (pull_request on
a public repo). This is deliberately stricter than gating purely on cost
-- a public re-host's minutes are free and its cron is still skipped,
because a re-host quietly publishing nightly releases under its own name
is a worse outcome than wasted minutes.

master carries the guard on preflight; buildroot needs it and inherits
the skip. manifest gates its cron-originated workflow_run path the same
way, because a nightly whose jobs all skipped still completes and fires
workflow_run. cleanup carries it on its weekly cron. build-one is
dispatch-only and needs nothing.

The pull_request clause is unreachable here today -- no workflow in this
repo has a pull_request trigger -- and is kept on purpose: it is the
clause that lets contributor PRs run, and omitting it would mean adding
a pull_request trigger later silently skips CI on every fork. That
over-block was the first thing reviewers caught upstream.

Upstream impact is none: on OpenIPC/builder the first disjunct is true,
so every added condition is a tautology and each job's if reduces to
what it was before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Dmitry Ilyin
2026-08-13 09:57:00 +03:00
committed by GitHub
co-authored by Claude Opus 4.8
parent 94cce13948
commit 222db9e291
3 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/master.yml
+16
View File
@@ -11,6 +11,22 @@ on:
jobs:
preflight:
name: Preflight
# Guard rail for clones of this repo. A clone pushed to a new repository
# (a private mirror, an internal re-host) inherits this file along with
# its cron, and the full platform matrix then runs on that owner's Actions
# bill, nightly and unattended, publishing nightlies nobody reads. Forks
# are partially covered (GitHub disables scheduled workflows there), a
# fresh repository is not. Mirrors OpenIPC/firmware#2255.
#
# Unattended runs happen only on the canonical repo. Anywhere else a
# workflow runs only if someone explicitly asked for it, or if it is both
# free and attended. The pull_request clause is unreachable today -- this
# workflow has no pull_request trigger -- and is kept deliberately, so
# that adding one later does not silently skip CI on contributor forks.
if: >-
github.repository == 'OpenIPC/builder' ||
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'pull_request' && !github.event.repository.private)
runs-on: ubuntu-latest
outputs:
should_build: ${{ steps.gate.outputs.should_build }}