hanzoai/ci
2
0
Fork 0
mirror of https://github.com/hanzoai/ci.git synced 2026-10-20 15:28:05 +00:00
Code Issues Releases Activity

fix(review): the review job carries HANZO_CI_TRUSTED, and its step asks it

Browse Source 
fork-is-sandboxed has failed every run of this repository since 600a2d1
added the review job without it ("5 job(s), 4 carry HANZO_CI_TRUSTED"),
so no ci or git-runner image has published since. The job already skips
a fork; its credentialed step now carries the same guard as every other.
All 31 entries of hanzo.yml's test block pass locally.
This commit is contained in:
zeekay
2026-10-20 08:09:24 -07:00
parent e1c4e4876b
commit 46217c695a
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+5
View File
@@ -3430,11 +3430,16 @@ jobs:
if: inputs.gates == '' && !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository)
timeout-minutes: 15
runs-on: ${{ (startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) && 'ephemeral-linux-amd64' || 'linux-amd64' }}
# The job already skips a fork; the step that names the KMS pair says so
# itself as well, the one guard every credentialed step carries.
env:
HANZO_CI_TRUSTED: ${{ !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- name: Review the change
if: env.HANZO_CI_TRUSTED == 'true'
env:
JOB_TOKEN: ${{ github.token }}
JOB_SHA: ${{ github.job_workflow_sha }}