Skip to content

Commit 1582eff

Browse files
myasnikovdaniilmyasnikovdaniil
committed
docs(ci): correct the stale shared-runner claims in the fork e2e lane
Two comments in e2e-fork.yaml justified themselves with a threat that no longer exists: the allowlist derivation guarded a `git worktree add` against "a crashed/concurrent run on the shared self-hosted runner", and the sandbox name was said to disambiguate "concurrent fork runs on a shared host". The dedicated runner was decommissioned in #2937 — these labels are ephemeral Oracle ARC VMs, one per job, as .github/actionlint.yaml states. A comment that asserts a shared host next to a step handling a push token misleads exactly the reader who is auditing that boundary. Both guards stay; only their stated reason changes to the one that actually holds. Assisted-By: Claude <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>
1 parent 1d668e1 commit 1582eff

1 file changed

Lines changed: 8 additions & 4 deletions

File tree

‎.github/workflows/e2e-fork.yaml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -333,8 +333,10 @@ jobs:
333333
run: |
334334
set -eu
335335
base="$(git rev-parse HEAD^1)"
336-
# Unique path so a leftover from a crashed/concurrent run on the shared
337-
# self-hosted runner can't fail `git worktree add`.
336+
# Fresh path per invocation so a leftover from an earlier step in this
337+
# job can't fail `git worktree add`. (The runner itself is an
338+
# ephemeral Oracle ARC VM, one per job — see .github/actionlint.yaml
339+
# and #2937 — so there is no cross-run leftover to defend against.)
338340
bt="$(mktemp -d)/basetree"
339341
git worktree add --quiet --detach "$bt" "$base"
340342
git -C "$bt" ls-files 'packages/*/*/Makefile' | while IFS= read -r mk; do
@@ -431,8 +433,10 @@ jobs:
431433
actions: read
432434
# Set the sandbox name as a job-level env var rather than writing it to
433435
# $GITHUB_ENV from a step (which the zizmor github-env audit flags). run_id
434-
# is unique per run — in workflow_run context GITHUB_REF is the default
435-
# branch, so it can't disambiguate concurrent fork runs on a shared host.
436+
# rather than the ref because in workflow_run context GITHUB_REF is always
437+
# the default branch, so it would name every fork run's sandbox identically
438+
# and make the logs (and any manual `docker` poke at a live sandbox)
439+
# ambiguous across runs.
436440
env:
437441
SANDBOX_NAME: cozy-e2e-sandbox-fork-${{ github.run_id }}
438442
steps:

0 commit comments

Comments
 (0)