@@ -19,36 +19,18 @@ concurrency:
1919 cancel-in-progress : true
2020
2121jobs :
22- gate :
23- runs-on : ubuntu-latest
24- outputs :
25- run-cadence : ${{ steps.decide.outputs.run }}
26- steps :
27- - id : decide
28- env :
29- EVENT : ${{ github.event_name }}
30- IS_FORK : ${{ github.event.pull_request.head.repo.full_name != github.repository }}
31- HAS_CLA : ${{ contains(github.event.pull_request.labels.*.name, 'CLA Signed') }}
32- HAS_EXPORT : ${{ contains(github.event.pull_request.labels.*.name, 'meta-exported') }}
33- run : |
34- run=false
35- case "${EVENT}" in
36- push|schedule|workflow_dispatch)
37- run=true
38- ;;
39- pull_request)
40- [ "${IS_FORK}" = "false" ] && run=true
41- ;;
42- pull_request_target)
43- if [ "${IS_FORK}" = "true" ] && [ "${HAS_CLA}" = "true" ] && [ "${HAS_EXPORT}" = "true" ]; then
44- run=true
45- fi
46- ;;
47- esac
48- echo "run=${run}" >> "${GITHUB_OUTPUT}"
49-
22+ # Same-repo PRs run on pull_request, which reads the PR's own workflow AND code
23+ # -- so CI changes, new test jobs, code, and tests are all validated pre-merge.
24+ # Fork PRs can't get credentials (OIDC) on pull_request, so Meta-exported forks
25+ # (labeled CLA Signed + meta-exported) run on pull_request_target instead. The
26+ # run condition is inlined per job (GitHub Actions has no YAML anchors and env
27+ # is unavailable in job-level if), so keep the copies in sync.
5028 cpu-build :
51- if : github.event_name != 'pull_request_target'
29+ if : >-
30+ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
31+ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
32+ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository &&
33+ contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))
5234 uses : pytorch/test-infra/.github/workflows/linux_job_v2.yml@main
5335 permissions :
5436 id-token : write
5840 runner : linux.2xlarge
5941 docker-image : ci-image:executorch-ubuntu-22.04-clang12
6042 submodules : recursive
61- ref : ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
43+ ref : ${{ ( github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
6244 timeout : 90
6345 upload-artifact : cadence-runner-build
6446 script : |
@@ -75,21 +57,28 @@ jobs:
7557
7658 cpu-test :
7759 needs : cpu-build
78- if : github.event_name != 'pull_request_target'
60+ if : >-
61+ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
62+ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
63+ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository &&
64+ contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))
7965 permissions :
8066 id-token : write
8167 contents : read
8268 uses : ./.github/workflows/_test_cadence.yml
8369 with :
84- ref : ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
70+ ref : ${{ ( github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
8571
8672 # Cross-compile cadence_executor_runner for each Cadence Xtensa core, one job
8773 # per backend so they show as separate lines (no matrix grouping). Shared logic
8874 # lives in _xtensa_build.yml. fusion_g3 is omitted until the upstream fusion_g3
8975 # <-> nnlib-FusionG3 API skew is fixed (its runner does not link).
9076 hifi-build :
91- needs : gate
92- if : needs.gate.outputs.run-cadence == 'true'
77+ if : >-
78+ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
79+ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
80+ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository &&
81+ contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))
9382 permissions :
9483 id-token : write
9584 contents : read
9988 ref : ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
10089
10190 vision-build :
102- needs : gate
103- if : needs.gate.outputs.run-cadence == 'true'
91+ if : >-
92+ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
93+ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
94+ (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository &&
95+ contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))
10496 permissions :
10597 id-token : write
10698 contents : read
0 commit comments