ci(tests): run clippy/test on self-hosted, keep fork PRs sandboxed - #88
Merged
Conversation
Move the compiling jobs (clippy, test) to [self-hosted, dev-server] for the 8-core speedup and a warm cargo cache. The repo is public, so fork PRs run untrusted code — a conditional runs-on keeps them on ubuntu-latest. Runner groups can't gate by trigger, so this split lives in the workflow rather than relying on the manual fork-PR approval gate. Give Swatinem a shared-key so clippy and test share the dependency cache instead of compiling deps twice, plus cache-on-failure. fmt stays on ubuntu-latest (no compilation). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to #86 (docker image build, already merged) — moves the compiling test jobs onto the same self-hosted runners.
What
clippyandtest→[self-hosted, dev-server]for the 8-core speedup + warm cargo cache.fmtstays onubuntu-latest(no compilation, nothing to gain).Security (this repo is PUBLIC)
Fork PRs run untrusted code. Runner groups can't gate by trigger, and the fork-PR approval gate is weak (returning contributors auto-run; approval fatigue). So a conditional
runs-onkeeps fork PRs onubuntu-latestand routes only trusted events (in-repo branches, push, dispatch) to the self-hosted host:Fork code therefore never reaches the dev box regardless of the approval setting.
Cache
Swatinem
shared-key: rust-ciso clippy and test share the dependency cache instead of compiling deps twice, pluscache-on-failure.Requires
subsquid/dataaccess to thedev-serverrunner group (same as #86).🤖 Generated with Claude Code