fix(ci): stop unrelated labels from cancelling the stand run, and gate it to non-forks

Concurrency is evaluated for the whole run before the job's `if`, so a run
started by any other label joined the same group and cancelled an approved,
in-flight stand run — then skipped its own job, leaving nothing in its place.
Key the group on the label as well.

The file's header promises fork PRs get Tier 1 only, but nothing enforced it.
GitHub withholds secrets from fork `pull_request` runs, so a labelled fork PR
held reviewers for an environment approval and then failed on empty
credentials. Require a non-fork head.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Sergey Kozyrenko
2026-07-24 13:13:15 +07:00
co-authored by Claude Opus 4.8
parent 3b948d68ea
commit 7b1ecfdc77
+7 -2
View File
@@ -22,15 +22,20 @@ on:
permissions:
contents: read
# Keyed on the label too: concurrency is evaluated for the whole run before the job's `if`, so a run
# started by an unrelated label would share this group and cancel an approved stand run mid-flight.
concurrency:
group: e2e-stand-${{ github.event.pull_request.number || github.run_id }}
group: e2e-stand-${{ github.event.pull_request.number || github.run_id }}-${{ github.event.label.name }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
e2e-stand:
# GitHub withholds secrets from fork `pull_request` runs: without the fork check a labelled fork
# PR holds reviewers for an environment approval and then fails on empty credentials.
if: >
github.event_name == 'workflow_dispatch' ||
github.event.label.name == 'e2e:stand'
(github.event.label.name == 'e2e:stand' &&
github.event.pull_request.head.repo.fork == false)
runs-on: ubuntu-latest
timeout-minutes: 30
environment: e2e-stand