ci(nixos): allow fork PR checkout under pull_request_target (+ ARM-primary) - #545
Merged
Conversation
…mary actions/checkout now refuses to check out a fork PR's head under pull_request_target unless allow-unsafe-pr-checkout is set, so every testable fork PR (e.g. the Asteroids PR) fails at checkout before building. Add the opt-in on the two head-checkout steps only; the trusted update-manifest checkout is left untouched. Also flips the build to the free ubuntu-24.04-arm hosted runner first, with the self-hosted Pi5 as last-resort fallback.
brickbots
added a commit
that referenced
this pull request
Jul 31, 2026
release had accumulated CI work that was never on main (#514, #515, #516, #519, #522, #545), and both branches had independently applied the same focus-technique docs (#546 on main, #547 on release) and the same manifest/PR-builder changes. Merging release in first makes the coming main -> release promotion clean instead of carrying four conflicts into the release cut. Four conflicts, each resolved by taking one side wholesale -- none was a semantic disagreement, only the same work committed twice: .github/scripts/update_manifest.py -> release Strict superset: newest-first entry ordering plus the --migration-url / --migration-sha256-url arguments from #516. main had nothing release lacked. .github/workflows/nixos-pr-build.yml -> release Genuinely divergent designs. main (#493) polls a self-hosted Pi5 first via a native-wait job, falling back to a hosted arm64 runner; release (#495 + #545) was re-architected ARM-primary with the Pi5 as last-resort fallback, drops the polling job, and adds allow-unsafe-pr-checkout for fork PRs under pull_request_target. release's is the newer and hardened design. docs/source/quick_start.rst -> main docs/source/troubleshooting.rst -> main Both branches carry the same small-turn focus technique, but release applied it to the old Focus screen's prose (+/- zoom to 2x/4x). main describes the rebuilt screen from #531 -- magnified star tiles, SQUARE cycling to the Image view, the central HFD -- which is what 2.6.1 actually ships. Net effect: main gains the release-only CI (release.yml, workflow_dispatch only, so nothing fires on merge) and keeps its own newer docs. No source changes. 1100 unit+smoke tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Testable fork PRs (e.g. #534 "Asteroids!", from
mrosseel:feature/observable-asteroids) fail immediately at checkout:actions/checkoutrecently began refusing to check out a fork PR's head when the trigger ispull_request_target. Becausepull_request_targetruns the base repo's default-branch copy of the workflow, this can only be fixed here onrelease— a contributor's fork branch can't change it. Same-repo PRs are unaffected, which is why it only bites fork PRs.Fix
allow-unsafe-pr-checkout: trueto the two head-checkout steps only (build-hosted,build-pi5). The trustedupdate-manifestcheckout (base branch, holds the write token) is left untouched.testable/previewlabel (the existing review gate for running contributor code) and checks out a pinned head SHA.ubuntu-24.04-armhosted runner, with the self-hosted Pi5 demoted to a last-resort fallback (matches theci-nixos-arm-primarychange).Effect
Once merged into
release, re-triggering a labeled fork PR (toggle itstestablelabel) builds on GitHub's ARM runner instead of dying at checkout.