Repository navigation
CI: skip self-hosted jobs on fork PRs (#881) - #988
Merged
Merged
Conversation
A new advisory published since #981 — CVE-2026-105660 (MEDIUM, HTTP/1 request-target authority, GHSA-v53v-9hvg-37jf) — failed `mix hex.audit` in the commit hook for every branch. Bandit 1.13.0 fixed it, and OSV reports 1.13.1 clean of every advisory 1.12.5 carried, including CVE-2026-105659 (HTTP/2), so the #981 ignore entry comes out too. The endpoint still serves no HTTP/2 (`http_2_options: [enabled: false]`; Fly's proxy speaks HTTP/1.1 anyway) and endpoint_http2_test.exs keeps that under test, with @acknowledged_bandit moved to 1.13.1. thousand_island 1.5.0 -> 1.6.0 and hpax 1.0.4 -> 1.1.0 ride along as bandit's raised requirements.
Fork-PR code on the shared self-hosted pool runs as the github-runner uid every pool slot shares, with read access to other slots' live JIT config and secrets. The five always-on self-hosted jobs (lint, test, retrieval-eval, security, dialyzer) and scale-test now skip when the PR head repo is a fork; a skipped job reports success, so required checks still pass. The human backstop is the fork-PR approval policy (all_external_contributors), set on the repo with this change. Closes #881
Owner
Author
|
Review round 1 (code) counted at |
Four confirmed findings from the lean-review round on PR #988: 1. scale-nightly now carries the fork-PR guard too, keeping the Lint comment's "every self-hosted job" true and closing the hole a future trigger widening (pull_request as a pre-merge gate) would open. 2. scale-test's header comment now says it also runs on same-repo PRs, matching the `if:` below it. 3. config/runtime.exs's http_2 comment stops claiming a fix version for CVE-2026-105659 that was never verified; it records what is known (bandit 1.13.1 is OSV-clean) and why the option stays. 4. endpoint_http2_test.exs's @acknowledged_bandit comment is reworded to the same standard: 1.13.0 fixed CVE-2026-105660, OSV reports 1.13.1 clean of every advisory 1.12.5 carried.
mkreyman
enabled auto-merge (squash)
October 17, 2026 19:13
# Conflicts: # test/loopctl_web/endpoint_http2_test.exs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #881.
Problem
Fork PRs on this public repo run CI on
[self-hosted, beelink]. Every job on that pool executes as the sharedgithub-runneruid, which can read other pool slots' live JIT runner config and the secrets it carries. The approval policy (all_external_contributors, applied to the repo alongside this change) is a human backstop, not a structural one — a workflow run approved in error, or apull_requestrace, still executes fork code on the pool.Fix
Every self-hosted job in
ci.yml(lint, test, retrieval-eval, security, dialyzer, scale-test) now carries:On a fork PR each such job is skipped, and a skipped job reports success, so branch protection's required checks still pass. Same-repo PRs, pushes, and the schedule are untouched.
mcp-server-ci.ymlruns only onubuntu-latestand needs no guard; there are nopull_request_target/workflow_runtriggers anywhere.Also in this branch
Deps: bandit 1.12.5 -> 1.13.1(cherry-picked) — a new bandit advisory (CVE-2026-105660) published since #981 failsmix hex.auditin the commit hook fleet-wide; 1.13.1 is OSV-clean and the #981 ignore for CVE-2026-105659 is dropped (patched in 1.13.0). The endpoint still serves no HTTP/2.Verification
pull_requestevents,push, andschedule.all_external_contributors(verified viagh api).