Repository navigation
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
ce42389 to
b6b893c
Compare
|
@googlebot I signed it! |
1 similar comment
|
@googlebot I signed it! |
…roval environment The Java PR workflow runs java_build, java_unit_tests and the integration (smoke/full) jobs on the self-hosted [self-hosted, it] runners, which hold Google Cloud credentials for the cloud-teleport-testing project (the IT steps pass --it-project=cloud-teleport-testing with no google-github-actions/auth step, so the runner itself provides the credentials). These jobs run PR code (./cicd/run-build, run-unit-tests, run-it-*) with no gate restricting fork PRs, so a pull request's code executes on the credentialed runner. Add `environment: fork-ci-approval` to java_build. Every other self-hosted `it` job transitively `needs: java_build`, so one approval gate at the root holds the whole chain until a maintainer approves the current commit. Configure required reviewers on the fork-ci-approval environment to activate it; until then the environment imposes no gate, so this change is behavior-neutral.
b6b893c to
2fd49b9
Compare
| # required reviewers on the `fork-ci-approval` environment in repo settings | ||
| # to activate this (until then the environment imposes no gate, so merging | ||
| # this PR is behavior-neutral). | ||
| environment: fork-ci-approval |
There was a problem hiding this comment.
This is not a valid way of defining this restriction since fork-ci-approval is not an environment that exists. But we already have this restriction enforced at the repo level (notice that your PR did not run CI checks)
There was a problem hiding this comment.
thanks, you're right. Since it's enforced at repo level, I'll close this.
What
The
Java PRworkflow runsjava_build,java_unit_testsand the integration(smoke / full) jobs on the self-hosted
[self-hosted, it]runners. Those runnershold Google Cloud credentials for the
cloud-teleport-testingproject — the ITsteps pass
--it-project="cloud-teleport-testing"and there is nogoogle-github-actions/authstep, so the credentials come from the runneritself. These jobs execute PR code (
./cicd/run-build,run-unit-tests,run-it-*), and nothing restricts fork pull requests, so a PR's code runs on thecredentialed runner.
Change
Add
environment: fork-ci-approvaltojava_build. Every other self-hosteditjob transitivelyneeds: java_build, so a single approval gate at the rootholds the whole chain until a maintainer approves the current commit.
To activate: in repo settings, add required reviewers to the
fork-ci-approvalenvironment. Until that is configured the environment imposesno gate, so merging this PR is behavior-neutral (safe to merge first, configure
after).
Notes
tflite-micro) for running fork code on privileged runners.
jobs to same-repository PRs instead, happy to adjust.
🤖 Generated with Claude Code