Skip to content

feat: add contributor CI workflow for fork-friendly testing #192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abtreece wants to merge 13 commits into
base: main
Choose a base branch
from
Open

feat: add contributor CI workflow for fork-friendly testing #192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
488f22e
feat: add contributor CI workflow for fork-friendly testing
abtreece Apr 25, 2026
a84e39d
refactor(ci): extract build_distribution_entries helper
abtreece May 22, 2026
78a3352
fix(ci): make latest_ruby_package_version independent of YAML order
abtreece May 22, 2026
b7efdb2
fix(ci): skip contributor workflow for same-repo PRs
abtreece May 22, 2026
78e9a3b
fix(ci): add timeout-minutes to contributor lint and build_images jobs
abtreece May 22, 2026
c942fbd
refactor(ci): parallelize contributor builds via matrix jobs
abtreece May 22, 2026
03b77ed
chore(ci): pin action SHAs in contributor and label-guard workflows
abtreece May 22, 2026
1806c20
fix(ci): gate check_workflow_uptodate with ok-to-test and check out P…
abtreece May 22, 2026
c461ee0
docs(ci): document pull_request/pull_request_target invariant in work…
abtreece May 22, 2026
5017b96
chore(ci): align contributor and label-guard action pins with repo ve…
abtreece Sep 24, 2026
194a5e9
Pass correct Git commit from ci-cd-main to all sub-workflows
FooBarWidget Oct 20, 2026
737bd03
Do not trigger production release from pull requests
FooBarWidget Oct 20, 2026
d3d9dbd
Fix checking out forks, fix checkout race condition
FooBarWidget Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
127 changes: 125 additions & 2 deletions .github/workflows/ci-cd-build-packages-1.yml
View file
Open in desktop

Large diffs are not rendered by default.

127 changes: 125 additions & 2 deletions .github/workflows/ci-cd-build-packages-2.yml
View file
Open in desktop

Large diffs are not rendered by default.

127 changes: 125 additions & 2 deletions .github/workflows/ci-cd-build-packages-3.yml
View file
Open in desktop

Large diffs are not rendered by default.

52 changes: 50 additions & 2 deletions .github/workflows/ci-cd-build-packages-4.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,18 @@ name: 'CI/CD: build packages [4]'
on:
workflow_call:
inputs:
git_commit:
type: string
required: false
allow_unsafe_pr_checkout:
type: boolean
required: false
ci_artifacts_run_number:
required: true
type: string
necessary_jobs:
required: true
necessary_jobs:
type: string
required: true

env:
CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
Expand All @@ -40,6 +46,9 @@ jobs:
packages: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -112,6 +121,9 @@ jobs:


- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -211,6 +223,9 @@ jobs:
&& contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -310,6 +325,9 @@ jobs:


- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -409,6 +427,9 @@ jobs:
&& contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -508,6 +529,9 @@ jobs:


- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -607,6 +631,9 @@ jobs:
&& contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -706,6 +733,9 @@ jobs:


- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -805,6 +835,9 @@ jobs:
&& contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -904,6 +937,9 @@ jobs:


- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -1003,6 +1039,9 @@ jobs:
&& contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -1102,6 +1141,9 @@ jobs:


- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -1201,6 +1243,9 @@ jobs:
&& contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -1318,6 +1363,9 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down
19 changes: 17 additions & 2 deletions .github/workflows/ci-cd-build-packages.yml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,18 @@ name: 'CI/CD: build packages [<%= part_number %>]'
on:
workflow_call:
inputs:
git_commit:
type: string
required: false
allow_unsafe_pr_checkout:
type: boolean
required: false
ci_artifacts_run_number:
required: true
type: string
necessary_jobs:
required: true
necessary_jobs:
type: string
required: true

env:
CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
Expand All @@ -31,6 +37,9 @@ jobs:
packages: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -119,6 +128,9 @@ jobs:
<% end %>

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down Expand Up @@ -232,6 +244,9 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.git_commit }}
allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
with:
project_id: ${{ vars.GCLOUD_PROJECT_ID }}
Expand Down
Loading