From 994081b8906af33a21b2d33cec504799e6b3c02e Mon Sep 17 00:00:00 2001 From: John Stairs Date: Wed, 16 Sep 2026 13:50:10 +0000 Subject: [PATCH 1/6] empty commit From 6e4b3d93be3d6dc59e84c6d1116028e71aa976b5 Mon Sep 17 00:00:00 2001 From: John Stairs Date: Wed, 16 Sep 2026 13:57:36 +0000 Subject: [PATCH 2/6] Forks cannot access `ACTIONS_ID_TOKEN_REQUEST_URL` and `ACTIONS_ID_TOKEN_REQUEST_TOKEN` --- .github/workflows/pr-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index c5e7e249..f63a0582 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -18,7 +18,7 @@ env: CAN_ACCESS_SECRETS: ${{ secrets.CAN_ACCESS_SECRETS }} - TYGER_AUTH_METHOD: "github" + TYGER_AUTH_METHOD: ${{ secrets.CAN_ACCESS_SECRETS != '' && 'github' || 'identity' }} jobs: # If this is running a Dependabot PR or PR from a fork, it we won't have access to secrets From fe7f2cb3d5f6c6f151e69525233de14d7eae6bc2 Mon Sep 17 00:00:00 2001 From: John Stairs Date: Wed, 16 Sep 2026 14:03:20 +0000 Subject: [PATCH 3/6] Skip GHCR publishing for forks --- .github/workflows/pr-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index f63a0582..035d3cda 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -216,6 +216,7 @@ jobs: echo "DEVELOPER_CONFIG_BASE64=$developer_config_base64" >> "$GITHUB_ENV" publish-ghcr: + if: github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) runs-on: ubuntu-latest needs: get-config defaults: @@ -247,7 +248,6 @@ jobs: runs-on: ubuntu-latest needs: - get-config - - publish-ghcr defaults: run: shell: bash From a59d982a852964ace7a805d2f7b281e2971392e7 Mon Sep 17 00:00:00 2001 From: John Stairs Date: Wed, 16 Sep 2026 16:33:50 +0000 Subject: [PATCH 4/6] Fix dependencies between tasks --- .github/workflows/pr-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 035d3cda..afae7f19 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -437,6 +437,7 @@ jobs: test-private-link-deployment: needs: - get-config + - build-images runs-on: ["self-hosted", "1ES.Pool=tyger-gh-1es-westus2"] defaults: run: From 1d4580ecf029f11f488368de7f30a3addb61a9e9 Mon Sep 17 00:00:00 2001 From: John Stairs Date: Wed, 16 Sep 2026 19:54:33 +0000 Subject: [PATCH 5/6] copilot feedback --- .github/workflows/pr-ci.yml | 47 ++++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 21 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index afae7f19..7a376930 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -21,31 +21,34 @@ env: TYGER_AUTH_METHOD: ${{ secrets.CAN_ACCESS_SECRETS != '' && 'github' || 'identity' }} jobs: - # If this is running a Dependabot PR or PR from a fork, it we won't have access to secrets - # nor will be be able to obtain a federated token to access Azure resources. - # Therefore, in those cases, we use hosted runners with managed identity to access Azure resources. + # Dependabot and fork PRs cannot access secrets, obtain Azure federated tokens, or publish to GHCR. + # In those cases, use self-hosted runners with managed identity and skip GHCR publication. # We only want to use those when necessary since they are a lot slower to come up, so this job - # determines what we should pass in to `runs-on` for jobs that access Azure resources. - # Also, this repo is configured to require approvals for all workflowd external contributors, and we + # selects Azure runners and determines GHCR publication eligibility. + # Also, this repo is configured to require workflow approvals for all external contributors, and we # should inspect the code in the PR before approving the run. - test-azure-needs-hosted-runner: + configure-ci: runs-on: ubuntu-latest outputs: AZURE_RUNS_ON_JSON: ${{ steps.set-vars.outputs.AZURE_RUNS_ON_JSON }} AZURE_RUNS_ON_WINDOWS_JSON: ${{ steps.set-vars.outputs.AZURE_RUNS_ON_WINDOWS_JSON }} + CAN_PUBLISH_GHCR: ${{ steps.set-vars.outputs.CAN_PUBLISH_GHCR }} steps: - id: set-vars run: | if [[ -n "${CAN_ACCESS_SECRETS:-}" ]]; then AZURE_RUNS_ON_JSON='"ubuntu-latest"' AZURE_RUNS_ON_WINDOWS_JSON='"windows-latest"' + CAN_PUBLISH_GHCR=true else AZURE_RUNS_ON_JSON='["self-hosted", "1ES.Pool=tyger-gh-1es"]' AZURE_RUNS_ON_WINDOWS_JSON='["self-hosted", "1ES.Pool=tyger-gh-1es-windows"]' + CAN_PUBLISH_GHCR=false fi echo "AZURE_RUNS_ON_JSON=$AZURE_RUNS_ON_JSON" >> "$GITHUB_OUTPUT" echo "AZURE_RUNS_ON_WINDOWS_JSON=$AZURE_RUNS_ON_WINDOWS_JSON" >> "$GITHUB_OUTPUT" + echo "CAN_PUBLISH_GHCR=$CAN_PUBLISH_GHCR" >> "$GITHUB_OUTPUT" unit-tests-and-format: runs-on: ubuntu-latest @@ -126,10 +129,10 @@ jobs: build-images: needs: - - test-azure-needs-hosted-runner + - configure-ci - get-config - runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}} + runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}} env: EXPLICIT_IMAGE_TAG: ${{ needs.get-config.outputs.IMAGE_TAG }} @@ -216,9 +219,11 @@ jobs: echo "DEVELOPER_CONFIG_BASE64=$developer_config_base64" >> "$GITHUB_ENV" publish-ghcr: - if: github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) + if: needs.configure-ci.outputs.CAN_PUBLISH_GHCR == 'true' runs-on: ubuntu-latest - needs: get-config + needs: + - get-config + - configure-ci defaults: run: shell: bash @@ -324,9 +329,9 @@ jobs: up: needs: - - test-azure-needs-hosted-runner + - configure-ci - get-config - runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}} + runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}} defaults: run: shell: bash @@ -363,10 +368,10 @@ jobs: restore-scale-to-zero: needs: - - test-azure-needs-hosted-runner + - configure-ci - up - get-config - runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}} + runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}} defaults: run: shell: bash @@ -394,10 +399,10 @@ jobs: integration-tests: name: integration-tests (${{ matrix.label }}) needs: - - test-azure-needs-hosted-runner + - configure-ci - get-config - up - runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}} + runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}} env: TYGER_MIN_NODE_COUNT: "1" DO_NOT_BUILD_IMAGES: "true" @@ -443,7 +448,7 @@ jobs: run: shell: bash outputs: - TYGER_PRIVATE_LINK_URL: ${{ steps.capture-urls.outputs.TYGER_PRIVATE_LINK_URL }} + TYGER_PRIVATE_LINK_URL: ${{ steps.capture-urls.outputs.TYGER_PRIVATE_LINK_URL }}1`` TYGER_PRIVATE_LINK_BUFFER_URL: ${{ steps.capture-urls.outputs.TYGER_PRIVATE_LINK_BUFFER_URL }} env: DO_NOT_BUILD_IMAGES: "true" @@ -549,11 +554,11 @@ jobs: windows-smoke-tests: needs: - - test-azure-needs-hosted-runner + - configure-ci - get-config - build-binaries - up - runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_WINDOWS_JSON)}} + runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_WINDOWS_JSON)}} steps: - name: Checkout uses: actions/checkout@v6 @@ -598,13 +603,13 @@ jobs: # Do not install from the unapproved GHCR registry for the long-running CI environment if: github.event_name == 'pull_request' needs: - - test-azure-needs-hosted-runner + - configure-ci - get-config - publish-ghcr - build-binaries - integration-tests - windows-smoke-tests - runs-on: ${{ fromJson(needs.test-azure-needs-hosted-runner.outputs.AZURE_RUNS_ON_JSON)}} + runs-on: ${{ fromJson(needs.configure-ci.outputs.AZURE_RUNS_ON_JSON)}} defaults: run: shell: bash From 60e991fe5cb7cddb7310a363ae91b1dc8c3a6512 Mon Sep 17 00:00:00 2001 From: John Stairs Date: Thu, 17 Sep 2026 00:19:30 +0000 Subject: [PATCH 6/6] Fix typo --- .github/workflows/pr-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 7a376930..b74199f7 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -448,7 +448,7 @@ jobs: run: shell: bash outputs: - TYGER_PRIVATE_LINK_URL: ${{ steps.capture-urls.outputs.TYGER_PRIVATE_LINK_URL }}1`` + TYGER_PRIVATE_LINK_URL: ${{ steps.capture-urls.outputs.TYGER_PRIVATE_LINK_URL }} TYGER_PRIVATE_LINK_BUFFER_URL: ${{ steps.capture-urls.outputs.TYGER_PRIVATE_LINK_BUFFER_URL }} env: DO_NOT_BUILD_IMAGES: "true"