Repository navigation
Conversation
Contributor
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
kyy8-L
force-pushed
the
harden/self-hosted-fork-approval
branch
from
October 22, 2026 05:51
259de83 to
ce42389
Compare
…roval environment The Java PR workflow runs java_build, java_unit_tests and the integration (smoke/full) jobs on the self-hosted [self-hosted, it] runners, which hold Google Cloud credentials for the cloud-teleport-testing project (the IT steps pass --it-project=cloud-teleport-testing with no google-github-actions/auth step, so the runner itself provides the credentials). These jobs run PR code (./cicd/run-build, run-unit-tests, run-it-*) with no gate restricting fork PRs, so a pull request's code executes on the credentialed runner. Add `environment: fork-ci-approval` to java_build. Every other self-hosted `it` job transitively `needs: java_build`, so one approval gate at the root holds the whole chain until a maintainer approves the current commit. Configure required reviewers on the fork-ci-approval environment to activate it; until then the environment imposes no gate, so this change is behavior-neutral.
kyy8-L
force-pushed
the
harden/self-hosted-fork-approval
branch
from
October 22, 2026 05:53
ce42389 to
b6b893c
Compare
Author
|
@googlebot I signed it! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
Java PRworkflow runsjava_build,java_unit_testsand the integration(smoke / full) jobs on the self-hosted
[self-hosted, it]runners. Those runnershold Google Cloud credentials for the
cloud-teleport-testingproject — the ITsteps pass
--it-project="cloud-teleport-testing"and there is nogoogle-github-actions/authstep, so the credentials come from the runneritself. These jobs execute PR code (
./cicd/run-build,run-unit-tests,run-it-*), and nothing restricts fork pull requests, so a PR's code runs on thecredentialed runner.
Change
Add
environment: fork-ci-approvaltojava_build. Every other self-hosteditjob transitivelyneeds: java_build, so a single approval gate at the rootholds the whole chain until a maintainer approves the current commit.
To activate: in repo settings, add required reviewers to the
fork-ci-approvalenvironment. Until that is configured the environment imposesno gate, so merging this PR is behavior-neutral (safe to merge first, configure
after).
Notes
tflite-micro) for running fork code on privileged runners.
jobs to same-repository PRs instead, happy to adjust.
🤖 Generated with Claude Code