ci: forks never reach keel-lxc-1, and no expression in a run block #18

Merged

marcos-mendez merged 1 commit from ci/fork-guard into main

2026-10-01 02:29:30 -03:00

marcos-mendez commented

2026-10-01 02:03:12 -03:00

(Migrated from github.com)

Why

The security review of the runner hardening (#16) found that a fork's pull request, once someone clicked "Approve and run", still ran on keel-lxc-1, the VM that serves keellinux.org. Neither test-appliance.yml nor build-deb.yml had a fork guard. lxc-trixie.yml in #17 already has one.

What changes

boot-published-layer (test-appliance.yml) and deb (build-deb.yml) carry the guard lxc-trixie.yml uses. It refuses pull_request_target, and any pull_request whose head repository is not the repository itself.
A job skipped by if: reports success, and branch protection counts a skipped required check as passed. So on a fork's pull request the required appliance / boot-published-layer shows as skipped and does not block. To keep that from passing for a boot, test-appliance.yml also runs fork-not-booted on a hosted runner in exactly that case. It fails with the reason and shows as a red appliance / fork-not-booted. That check blocks a merge only where it is made a required check, and adding it as required is harmless for internal pull requests, where it is skipped.
The appliance input is checked against ^[a-z0-9-]+$ before it reaches a path, a container name or the mirror URL.
The manifest path reaches the parent check through env: instead of an expression inside run:.
profile/WORKFLOWS.md documents the guard, plus the runner group's workflow restriction set the same day: only the reusable workflows of this repository at refs/heads/main get the runner.

Evidence

actionlint 1.7.7 (the pinned version): no findings.
keel-core with a temporary caller pointed at this branch, run https://github.com/Keel-Linux/keel-core/actions/runs/36815876343: appliance / boot-published-layer green, appliance / fork-not-booted skipped.

Test plan

lint / actionlint and tests / coverage green
after merge, an appliance pull request from a branch: boot-published-layer green, fork-not-booted skipped

## Why The security review of the runner hardening (#16) found that a fork's pull request, once someone clicked "Approve and run", still ran on `keel-lxc-1`, the VM that serves keellinux.org. Neither `test-appliance.yml` nor `build-deb.yml` had a fork guard. `lxc-trixie.yml` in #17 already has one. ## What changes - `boot-published-layer` (test-appliance.yml) and `deb` (build-deb.yml) carry the guard `lxc-trixie.yml` uses. It refuses `pull_request_target`, and any `pull_request` whose head repository is not the repository itself. - A job skipped by `if:` reports success, and branch protection counts a skipped required check as passed. So on a fork's pull request the required `appliance / boot-published-layer` shows as skipped and does not block. To keep that from passing for a boot, `test-appliance.yml` also runs `fork-not-booted` on a hosted runner in exactly that case. It fails with the reason and shows as a red `appliance / fork-not-booted`. That check blocks a merge only where it is made a required check, and adding it as required is harmless for internal pull requests, where it is skipped. - The `appliance` input is checked against `^[a-z0-9-]+$` before it reaches a path, a container name or the mirror URL. - The manifest path reaches the parent check through `env:` instead of an expression inside `run:`. - `profile/WORKFLOWS.md` documents the guard, plus the runner group's workflow restriction set the same day: only the reusable workflows of this repository at `refs/heads/main` get the runner. ## Evidence - actionlint 1.7.7 (the pinned version): no findings. - keel-core with a temporary caller pointed at this branch, run https://github.com/Keel-Linux/keel-core/actions/runs/36815876343: `appliance / boot-published-layer` green, `appliance / fork-not-booted` skipped. ## Test plan - [ ] `lint / actionlint` and `tests / coverage` green - [ ] after merge, an appliance pull request from a branch: `boot-published-layer` green, `fork-not-booted` skipped