From 18832871099d43c6723016489b79f5dd7cbaec17 Mon Sep 17 00:00:00 2001 From: David Liu Date: Fri, 9 Oct 2026 20:00:14 +0000 Subject: [PATCH] Skip Windows CI lanes on fork PRs The Windows unit and e2e lanes (#1025) log in to JFrog with a GitHub OIDC token, which fork PRs never get, so every Windows job failed on fork PRs. Run those matrices Linux-only for fork PRs, using the same guard as integration.yml (#1043), and extend the fork contract test to ci.yml. Co-authored-by: Isaac --- .github/workflows/ci.yml | 4 ++-- tests/test_integration_contract.py | 17 +++++++++++++++-- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d746a2405..d0d6fe853 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,7 +46,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, windows-server-latest] + os: ${{ fromJSON((github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }} defaults: run: shell: bash @@ -115,7 +115,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, windows-server-latest] + os: ${{ fromJSON((github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }} group: [gateway, claude, codex, gemini, opencode, copilot, pi] include: - group: gateway diff --git a/tests/test_integration_contract.py b/tests/test_integration_contract.py index beda32fb2..eac5651fe 100644 --- a/tests/test_integration_contract.py +++ b/tests/test_integration_contract.py @@ -142,8 +142,8 @@ def test_cuj_discovery_fails_for_a_file_without_a_check_name(tmp_path): } -def _integration_jobs(): - workflow = (Path(__file__).parent.parent / ".github/workflows/integration.yml").read_text() +def _integration_jobs(name="integration.yml"): + workflow = (Path(__file__).parent.parent / ".github/workflows" / name).read_text() body = workflow.split("\njobs:\n", 1)[1] return dict(re.findall(r"(?ms)^ ([a-z0-9-]+):\n(.*?)(?=^ [a-z0-9-]+:\n|\Z)", body)) @@ -174,6 +174,19 @@ def test_integration_jobs_that_run_on_fork_pull_requests_need_no_credentials(): ) +def test_ci_windows_lanes_skip_fork_pull_requests(): + jfrog_jobs = { + name: job for name, job in _integration_jobs("ci.yml").items() if "setup-jfrog-cli" in job + } + + assert set(jfrog_jobs) == {"test", "e2e-shards"} + for name, job in jfrog_jobs.items(): + assert ( + f"os: ${{{{ fromJSON(({FORK_GUARD}) && " + """'["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }}""" + ) in job, f"{name} logs in to JFrog with OIDC on Windows, which fork PRs can't do" + + def test_windows_integration_ci_uses_shared_claude_version(): workflow = Path(__file__).parent.parent / ".github/workflows/integration.yml" contents = workflow.read_text()