From 7b1ecfdc77b2e212347f8fb30f00bdf37a24906b Mon Sep 17 00:00:00 2001 From: Sergey Kozyrenko Date: Fri, 24 Jul 2026 13:13:15 +0700 Subject: [PATCH] fix(ci): stop unrelated labels from cancelling the stand run, and gate it to non-forks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Concurrency is evaluated for the whole run before the job's `if`, so a run started by any other label joined the same group and cancelled an approved, in-flight stand run — then skipped its own job, leaving nothing in its place. Key the group on the label as well. The file's header promises fork PRs get Tier 1 only, but nothing enforced it. GitHub withholds secrets from fork `pull_request` runs, so a labelled fork PR held reviewers for an environment approval and then failed on empty credentials. Require a non-fork head. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/e2e-stand.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/e2e-stand.yml b/.github/workflows/e2e-stand.yml index 069a4b9a..346f9744 100644 --- a/.github/workflows/e2e-stand.yml +++ b/.github/workflows/e2e-stand.yml @@ -22,15 +22,20 @@ on: permissions: contents: read +# Keyed on the label too: concurrency is evaluated for the whole run before the job's `if`, so a run +# started by an unrelated label would share this group and cancel an approved stand run mid-flight. concurrency: - group: e2e-stand-${{ github.event.pull_request.number || github.run_id }} + group: e2e-stand-${{ github.event.pull_request.number || github.run_id }}-${{ github.event.label.name }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: e2e-stand: + # GitHub withholds secrets from fork `pull_request` runs: without the fork check a labelled fork + # PR holds reviewers for an environment approval and then fails on empty credentials. if: > github.event_name == 'workflow_dispatch' || - github.event.label.name == 'e2e:stand' + (github.event.label.name == 'e2e:stand' && + github.event.pull_request.head.repo.fork == false) runs-on: ubuntu-latest timeout-minutes: 30 environment: e2e-stand