From 7a6d464f51631174b41e228ddaab5b3aa8fc6a7f Mon Sep 17 00:00:00 2001 From: InauguralPhysicist Date: Sat, 11 Jul 2026 14:43:37 -0500 Subject: [PATCH] =?UTF-8?q?ci:=20give=20fork=20PRs=20Linux=20CI=20?= =?UTF-8?q?=E2=80=94=20run=20them=20in=20the=20rolling=20ci-main=20image?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fork PRs get a read-only GITHUB_TOKEN (no packages:write), so the dev-image job's GHCR login/push failed — and because every Linux leg runs inside that image via needs+container, all of them skipped. Fork PRs (first one: #553) effectively had no Linux CI; never noticed because there had never been one. dev-image now skips login/push on fork PRs and points the Linux legs at a rolling ci-main tag that every main push publishes alongside its ci- tag: same toolchain, just not rebuilt from the PR's Dockerfile (a fork PR editing .devcontainer/Dockerfile still tests with the base image — push its branch to origin to exercise that). Same-repo PRs and main pushes behave exactly as before. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f4b5e3d..1b846f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,16 @@ jobs: - name: Set up Docker buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + # Fork PRs run with a read-only GITHUB_TOKEN (no packages:write), so + # they cannot push a ci- image — and with no image, every Linux + # leg used to skip, leaving fork PRs with no Linux CI at all. Fork + # PRs instead run inside the rolling `ci-main` image that every main + # push publishes below: same toolchain, just not rebuilt from the + # PR's Dockerfile. (The rare fork PR that EDITS + # .devcontainer/Dockerfile still tests with the base image — push + # its branch to origin to exercise the Dockerfile change.) - name: Log in to GitHub Container Registry + if: github.event.pull_request.head.repo.fork != true uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io @@ -37,22 +46,37 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} # GHCR requires a lowercase owner; compute the ref once and hand it to - # the downstream jobs through a job output. + # the downstream jobs through a job output. `image` is what the Linux + # legs run in; `tags` is what this job pushes (empty on fork PRs — + # nothing is pushed; main pushes also advance the rolling ci-main tag). - name: Compute image ref id: ref env: OWNER: ${{ github.repository_owner }} + IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }} + EVENT: ${{ github.event_name }} run: | - echo "image=ghcr.io/${OWNER,,}/eigenscript-dev:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT" + BASE="ghcr.io/${OWNER,,}/eigenscript-dev" + if [ "$IS_FORK" = "true" ]; then + echo "image=$BASE:ci-main" >> "$GITHUB_OUTPUT" + echo "tags=" >> "$GITHUB_OUTPUT" + elif [ "$EVENT" = "push" ]; then + echo "image=$BASE:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT" + echo "tags=$BASE:ci-${{ github.sha }},$BASE:ci-main" >> "$GITHUB_OUTPUT" + else + echo "image=$BASE:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT" + echo "tags=$BASE:ci-${{ github.sha }}" >> "$GITHUB_OUTPUT" + fi - name: Build and push dev image + if: github.event.pull_request.head.repo.fork != true uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: .devcontainer/Dockerfile platforms: linux/amd64 push: true - tags: ${{ steps.ref.outputs.image }} + tags: ${{ steps.ref.outputs.tags }} cache-from: type=gha cache-to: type=gha,mode=max