Repository navigation
ci: reuse builds only from this repository's own runs - #165
Merged
Merged
Conversation
lookup-build.py took the newest artifact with a matching name from any run in the repository. Artifact names are chosen by the workflow that uploads them, and a pull request from a fork runs its own copy of the workflow files; the build key leaves .github and tools/aurora-ci out. So a fork pull request that changes only CI files could upload a kernel-package-<key> and a kernel-verified-<key> under the key of the current tree, and the next push or merge queue run with that tree would reuse the package, skip KUnit and the boot test, and attest it. The same applies to the baseline a later pull request is compared with. Accept an artifact only when its run is the kernel CI (kernel-ci.yml or kernel-ci-label.yml), on a push, merge group, schedule, manual run or pull request event, and both the run's repository and its head repository are this one. Pushing a branch here needs write access, so a fork's run never qualifies. Reported-by: Marcelo Alcantara <[email protected]> Signed-off-by: Chris Kearney <[email protected]> Co-Authored-By: Claude Opus 5.5 <[email protected]>
chriskearney
added a commit
that referenced
this pull request
Oct 21, 2026
…hecks Two follow-ups from running the CI on the Namespace runner. Reuse (follow-up to #165): a reused kernel-package or kernel-verified artifact is now accepted only from a push, merge_group, schedule or workflow_dispatch run (REUSE_EVENTS), never a pull_request. A CI-only pull request from a writer has the same build key as the branch tip and could otherwise plant a package or verification record that a later queue or push run reuses before anyone reviews it. A comparison baseline (kernel-metadata) is only read, never substituted, so a pull_request run is still fine there (BASELINE_EVENTS). Package checks: inspect-package.py resolves module symbols with depmod and unpacks with tar --zstd, which the Namespace builder image does not ship. Install kmod and zstd in the package job when they are missing. Signed-off-by: Chris Kearney <[email protected]> Co-Authored-By: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the gap @maralcbr found in #160's build reuse before CI becomes a merge gate.
lookup-build.pyreused the newest artifact with a matching name from any run in the repository. Artifact names are chosen by the workflow that uploads them, and a fork's pull request runs its own copy of the workflow files; the build key leaves.githubandtools/aurora-ciout. So a fork PR that changed only CI files could upload akernel-package-<key>andkernel-verified-<key>under the current tree's key. The next push or merge queue run with that tree would then reuse the planted package, skip KUnit and boot, and attest it. The comparison baseline (kernel-metadata-<id>) had the same hole.Now an artifact is reused only when its run is:
kernel-ci.ymlorkernel-ci-label.yml),push,merge_group,schedule,workflow_dispatchorpull_requestevent,Pushing a branch here needs write access, so a fork's run never qualifies. The check uses the artifact's
workflow_run.head_repository_id, then confirms against the run itself.Tested
pull_request_targetis rejected;🤖 Generated with Claude Code