Use pull_request_target for e2e tests to support fork PRs#796
Open
kelos-bot[bot] wants to merge 2 commits intomainfrom
Open
Use pull_request_target for e2e tests to support fork PRs#796kelos-bot[bot] wants to merge 2 commits intomainfrom
kelos-bot[bot] wants to merge 2 commits intomainfrom
Conversation
GitHub Actions does not expose repository secrets to pull_request events from forks. Switch the e2e job to trigger on pull_request_target instead, which runs in the base repository context and has access to secrets. The existing ok-to-test label gate ensures maintainer review before secrets are exposed. Non-e2e jobs continue to use pull_request to avoid double runs. The checkout step now explicitly uses the PR head SHA to test the correct code. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
github-actions
bot
added
needs-triage
needs-kind
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/ci.yaml">
<violation number="1" location=".github/workflows/ci.yaml:9">
P1: Adding `pull_request_target` without separating concurrency groups can cause `pull_request` and `pull_request_target` runs to cancel each other, potentially skipping required CI jobs.</violation>
<violation number="2" location=".github/workflows/ci.yaml:11">
P0: `pull_request_target` on `synchronize` allows newly pushed fork commits to run e2e with secrets as long as a prior `ok-to-test` label remains. Require fresh maintainer re-approval per commit (for example, trigger only on `labeled`).</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
This was referenced Mar 26, 2026
Collaborator
|
/kelos pick-up |
Author
|
🤖 Kelos Task Status Task |
- Restrict pull_request_target to only 'labeled' type so maintainers must re-apply ok-to-test after each new fork commit (prevents stale label reuse) - Include event_name in concurrency group key to prevent pull_request and pull_request_target runs from cancelling each other Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
github-actions
bot
removed
the
needs-kind
Author
|
🤖 Kelos Agent @gjkim42 /kelos needs-input All review feedback has been addressed:
Ready for re-review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/kind bug
What type of PR is this?
Bug fix — e2e tests cannot access secrets for PRs from forked repositories.
What this PR does / why we need it:
GitHub Actions does not expose repository secrets to
pull_requestevents from forks. This PR switches the e2e test job to usepull_request_targetinstead, which runs in the base repository's context and has access to secrets.Changes:
pull_request_targettrigger to the CI workflow (restricted tolabeledtype only, so maintainers must re-applyok-to-testafter each new fork commit)event_namein the concurrency group key to preventpull_requestandpull_request_targetruns from cancelling each otherpull_request_targetevents to avoid double runspull_request_target(withok-to-testlabel gate) instead ofpull_requestgithub.event.pull_request.head.shato test the PR's actual codeWhich issue(s) this PR is related to:
Fixes #793
Special notes for your reviewer:
The
pull_request_targetevent runs the workflow definition from the base branch (main), not the PR branch. This is the standard secure pattern for running CI with secrets on fork PRs — the workflow itself is trusted (from main), and theok-to-testlabel ensures maintainer approval before secrets are used.Security considerations addressed:
pull_request_targetonly triggers onlabeled(notsynchronize), requiring maintainers to re-applyok-to-testafter each new commit from a forkpull_requestandpull_request_targetruns from cancelling each otherDoes this PR introduce a user-facing change?