Skip to content

Restrict macOS runtime to trusted CI runs #251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sunxiaoguang wants to merge 2 commits into from
+65 −80
Closed

Restrict macOS runtime to trusted CI runs #251

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bebf636
Restrict macOS runtime to trusted runs
sunxiaoguang Jul 28, 2026
5406021
Harden runtime fixture caching
sunxiaoguang Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,9 +337,13 @@ jobs:
runtime-macos:
name: Runtime (${{ matrix.name }})
needs: build-macos
# Never run guest code or touch the persistent runner for pull requests;
# only trusted main-branch pushes and an explicitly selected main dispatch
# may enter the self-hosted HVF lane.
if: >
github.repository == 'sysprog21/elfuse' &&
(github.event_name == 'push' || github.event_name == 'pull_request')
((github.event_name == 'push' && github.ref == 'refs/heads/main') ||
(github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
runs-on: [self-hosted, macOS, arm64]
# Sanitizer builds run several times slower than the release build, so the
# job budget and the per-test TEST_TIMEOUT are widened per leg. Without
Expand Down Expand Up @@ -470,7 +474,9 @@ jobs:
- name: Restore cached test fixtures
# Only the release leg needs fixtures: the sanitizer legs run the
# fixture-free check-sanitizer subset.
if: ${{ matrix.run_matrix }}
if: >
matrix.run_matrix && github.ref == 'refs/heads/main' &&
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
(github.event_name == 'push' || github.event_name == 'workflow_dispatch')
# actions/checkout's default clean:true runs `git clean -ffdx`, which
# wipes externals/test-fixtures (gitignored) on this self-hosted
# runner even though its disk otherwise persists across runs.
Expand Down Expand Up @@ -600,7 +606,10 @@ jobs:
# unchanged Alpine packages. Runs even if an earlier step failed, as
# long as the job wasn't cancelled, so a fixture-unrelated test
# failure doesn't cost the next run its cache.
if: ${{ !cancelled() && matrix.sanitizer == 'release' }}
if: >
!cancelled() && matrix.sanitizer == 'release' &&
github.ref == 'refs/heads/main' &&
(github.event_name == 'push' || github.event_name == 'workflow_dispatch')
run: |
if [ -d externals/test-fixtures ]; then
cache="$HOME/.cache/elfuse-ci/test-fixtures"
Expand Down
Loading