From 02d504ca3adf2c11cf72d438f94a46ca9baa8a3c Mon Sep 17 00:00:00 2001 From: Dmytro Sydorov Date: Mon, 13 Jul 2026 15:35:05 +0200 Subject: [PATCH 1/2] ci: dispatch release builder and validate via workflow_run (DEVOPS-1050) Convert the release builder to workflow_dispatch (the GitHub Release is now a pipeline output created by goreleaser, not a trigger) and drive e2e, unit-test and ginkgo validation off workflow_run of the Release builder completing. On the release path change detection is skipped, jobs run only for a green build, and the built tag is checked out. Previous-tag derivation is made branch-local. Closes DEVOPS-1050 --- .github/workflows/e2e-ginkgo.yaml | 41 ++++++++++++++---- .github/workflows/e2e.yaml | 70 +++++++++++++++++++++++++++---- .github/workflows/release.yaml | 21 +++++++--- .github/workflows/unit-tests.yaml | 18 ++++++-- 4 files changed, 125 insertions(+), 25 deletions(-) diff --git a/.github/workflows/e2e-ginkgo.yaml b/.github/workflows/e2e-ginkgo.yaml index 052a206cad..5e129ff613 100644 --- a/.github/workflows/e2e-ginkgo.yaml +++ b/.github/workflows/e2e-ginkgo.yaml @@ -4,9 +4,13 @@ permissions: contents: read pull-requests: read +# Release validation runs post-build via workflow_run on the "Release" builder +# completing (DEVOPS-1050). On that path detect_changes is skipped, the suite +# runs against the built tag, and the label filter falls back to the default. on: - release: - types: [created] + workflow_run: + workflows: ["Release"] + types: [completed] workflow_dispatch: inputs: ginkgo-label: @@ -44,7 +48,8 @@ env: jobs: parse_label-filter: name: Parse label filter and check if tests should run - if: github.repository_owner == 'loft-sh' # do not run on forks + # do not run on forks; on the release path only for a green build + if: github.repository_owner == 'loft-sh' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') runs-on: ubuntu-22.04 outputs: @@ -97,6 +102,9 @@ jobs: echo "parsed-label-filter=${PARSED_LABEL_FILTER}" >> "$GITHUB_OUTPUT" detect_changes: + # PR-only: the release (workflow_run) path always validates and bypasses + # change detection; entry jobs break skip-propagation with !cancelled(). + if: github.event_name == 'pull_request' needs: [parse_label-filter] uses: loft-sh/github-actions/.github/workflows/detect-changes.yaml@detect-changes/v1 with: @@ -115,13 +123,20 @@ jobs: build: runs-on: ubuntu-latest - if: github.repository_owner == 'loft-sh' && needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && github.repository_owner == 'loft-sh' && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) needs: detect_changes steps: - name: Checkout repository uses: actions/checkout@v5 with: fetch-depth: 0 + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - run: git fetch --force --tags @@ -163,7 +178,13 @@ jobs: download-latest-cli: needs: detect_changes - if: needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) name: Download the latest vCluster cli runs-on: ubuntu-latest steps: @@ -183,9 +204,14 @@ jobs: - build - parse_label-filter - detect_changes - if: > + if: >- + !cancelled() && needs.build.result == 'success' && needs.parse_label-filter.outputs.skip-edited != 'true' && - needs.detect_changes.outputs.has_changed == 'true' + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) runs-on: large-8_32 permissions: id-token: write # needed for OIDC → AWS @@ -195,6 +221,7 @@ jobs: uses: actions/checkout@v5 with: fetch-depth: 0 + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - run: git fetch --force --tags diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index aead504f71..6da0c3bc40 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -1,8 +1,14 @@ name: E2E CI +# Release validation runs post-build via workflow_run on the "Release" builder +# completing (DEVOPS-1050): a release created by the builder inside Actions does +# not emit release:created, so validators keyed on it would silently never run. +# On the workflow_run path detect_changes is skipped and the suite runs against +# the built tag (github.event.workflow_run.head_branch). on: - release: - types: [created] + workflow_run: + workflows: ["Release"] + types: [completed] pull_request: branches: - main @@ -22,6 +28,9 @@ env: jobs: detect_changes: + # PR-only: the release (workflow_run) path always validates, so it bypasses + # change detection. Entry jobs break the skip-propagation with !cancelled(). + if: github.event_name == 'pull_request' uses: loft-sh/github-actions/.github/workflows/detect-changes.yaml@v1 with: paths: | @@ -37,13 +46,20 @@ jobs: - "manifests/**" build: runs-on: ubuntu-latest - if: github.repository_owner == 'loft-sh' && needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && github.repository_owner == 'loft-sh' && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) needs: detect_changes steps: - name: Checkout repository uses: actions/checkout@v6 with: fetch-depth: 0 + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - run: git fetch --force --tags @@ -86,11 +102,19 @@ jobs: get-testsuites-dir: needs: detect_changes - if: needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v6 + with: + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - id: set-paths-matrix run: | set -x @@ -105,11 +129,19 @@ jobs: needs: - build - detect_changes - if: needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && needs.build.result == 'success' && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v6 + with: + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - uses: azure/setup-helm@v4 name: Setup Helm @@ -158,7 +190,13 @@ jobs: download-latest-cli: needs: detect_changes - if: needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) name: Download the latest vCluster cli runs-on: ubuntu-latest steps: @@ -178,7 +216,13 @@ jobs: - build - download-latest-cli - detect_changes - if: needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && needs.build.result == 'success' && needs.download-latest-cli.result == 'success' && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) runs-on: ubuntu-latest strategy: fail-fast: false @@ -187,6 +231,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v6 + with: + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - uses: azure/setup-helm@v4 name: Setup Helm @@ -266,7 +312,13 @@ jobs: - build - get-testsuites-dir - detect_changes - if: needs.detect_changes.outputs.has_changed == 'true' + if: >- + !cancelled() && needs.build.result == 'success' && needs.get-testsuites-dir.result == 'success' && + ( + (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || + github.event_name == 'workflow_dispatch' + ) runs-on: ubuntu-latest permissions: id-token: write # needed for OIDC → AWS @@ -292,6 +344,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v6 + with: + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - name: Set up Go uses: actions/setup-go@v6 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a1ad8485b2..abc90432f4 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,8 +1,14 @@ name: Release +# Builder for the vCluster release pipeline (DEVOPS-1050). The GitHub Release is +# a pipeline OUTPUT, not a trigger: goreleaser creates it at the end of a green +# build. This workflow is dispatched by the loft-sh/github-actions +# vcluster-release action via `gh workflow run release.yaml --ref `, so +# github.ref is refs/tags/ and github.ref_name is the version. It no +# longer triggers on release:created, so a monorepo-created OSS release can never +# re-trigger this builder. on: - release: - types: [created] + workflow_dispatch: jobs: check_minimum_version_tag: @@ -10,11 +16,11 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - if: ${{ !contains(github.event.release.tag_name, '-') }} + if: ${{ !contains(github.ref_name, '-') }} with: - ref: ${{ github.event.release.tag_name }} + ref: ${{ github.ref_name }} - name: Validate MinimumVersionTag is stable - if: ${{ !contains(github.event.release.tag_name, '-') }} + if: ${{ !contains(github.ref_name, '-') }} run: | MINIMUM_VERSION_TAG=$(grep -oP 'MinimumVersionTag\s*=\s*"\Kv[^"]+' pkg/platform/version.go) if [[ ! "$MINIMUM_VERSION_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then @@ -76,7 +82,10 @@ jobs: run: | RELEASE_VERSION=$(echo "$GITHUB_REF" | sed -nE 's!refs/tags/!!p') echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT" - echo "previous_tag=$(git describe --abbrev=0 --tags "$(git rev-list --tags --skip=1 --max-count=1)")" >> "$GITHUB_OUTPUT" + # Branch-local previous tag: the tag reachable from this commit's + # parent on THIS branch, not the global latest tag (which would be + # wrong on a release branch). See DEVOPS-1050. + echo "previous_tag=$(git describe --tags --abbrev=0 --match 'v*' "${GITHUB_SHA}^" 2>/dev/null || true)" >> "$GITHUB_OUTPUT" - name: Validate semver id: semver uses: loft-sh/github-actions/.github/actions/semver-validation@semver-validation/v1 diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml index dd0db3e9a4..84e2309f94 100644 --- a/.github/workflows/unit-tests.yaml +++ b/.github/workflows/unit-tests.yaml @@ -1,8 +1,12 @@ name: Unit tests +# Runs on PRs and, post-build, when the "Release" builder completes (DEVOPS-1050: +# release:created does not fire for builder-created releases). On the workflow_run +# path the jobs run only for a green build and check out the built tag. on: - release: - types: [created] + workflow_run: + workflows: ["Release"] + types: [completed] pull_request: branches: - main @@ -23,11 +27,14 @@ concurrency: jobs: helm-unit-tests: name: Execute all helm tests - if: github.repository_owner == 'loft-sh' # do not run on forks + # do not run on forks; on the release path only for a green build + if: github.repository_owner == 'loft-sh' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v6 + with: + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - name: Install Helm Unit Test Plugin run: | helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4 @@ -37,11 +44,14 @@ jobs: go-unit-test: name: Execute all go tests - if: github.repository_owner == 'loft-sh' # do not run on forks + # do not run on forks; on the release path only for a green build + if: github.repository_owner == 'loft-sh' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') runs-on: ubuntu-22.04 steps: - name: Check out code into the Go module directory uses: actions/checkout@v6 + with: + ref: ${{ github.event.workflow_run.head_branch || github.ref }} - name: Set up Go uses: actions/setup-go@v6 with: From 9df60ff00c32400dd2fddb5c1969622f69c5b7eb Mon Sep 17 00:00:00 2001 From: Dmytro Sydorov Date: Mon, 13 Jul 2026 15:47:32 +0200 Subject: [PATCH 2/2] ci: builder-only conversion, leave validators unchanged (DEVOPS-1050) Legacy lines keep their existing validators untouched: release validation is handled by main's workflow_run validators, gated to new (>= v0.37) lines. This branch only converts the builder release.yaml (release-as-output + dispatch). --- .github/workflows/e2e-ginkgo.yaml | 41 ++++-------------- .github/workflows/e2e.yaml | 70 ++++--------------------------- .github/workflows/unit-tests.yaml | 18 ++------ 3 files changed, 19 insertions(+), 110 deletions(-) diff --git a/.github/workflows/e2e-ginkgo.yaml b/.github/workflows/e2e-ginkgo.yaml index 5e129ff613..052a206cad 100644 --- a/.github/workflows/e2e-ginkgo.yaml +++ b/.github/workflows/e2e-ginkgo.yaml @@ -4,13 +4,9 @@ permissions: contents: read pull-requests: read -# Release validation runs post-build via workflow_run on the "Release" builder -# completing (DEVOPS-1050). On that path detect_changes is skipped, the suite -# runs against the built tag, and the label filter falls back to the default. on: - workflow_run: - workflows: ["Release"] - types: [completed] + release: + types: [created] workflow_dispatch: inputs: ginkgo-label: @@ -48,8 +44,7 @@ env: jobs: parse_label-filter: name: Parse label filter and check if tests should run - # do not run on forks; on the release path only for a green build - if: github.repository_owner == 'loft-sh' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') + if: github.repository_owner == 'loft-sh' # do not run on forks runs-on: ubuntu-22.04 outputs: @@ -102,9 +97,6 @@ jobs: echo "parsed-label-filter=${PARSED_LABEL_FILTER}" >> "$GITHUB_OUTPUT" detect_changes: - # PR-only: the release (workflow_run) path always validates and bypasses - # change detection; entry jobs break skip-propagation with !cancelled(). - if: github.event_name == 'pull_request' needs: [parse_label-filter] uses: loft-sh/github-actions/.github/workflows/detect-changes.yaml@detect-changes/v1 with: @@ -123,20 +115,13 @@ jobs: build: runs-on: ubuntu-latest - if: >- - !cancelled() && github.repository_owner == 'loft-sh' && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: github.repository_owner == 'loft-sh' && needs.detect_changes.outputs.has_changed == 'true' needs: detect_changes steps: - name: Checkout repository uses: actions/checkout@v5 with: fetch-depth: 0 - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - run: git fetch --force --tags @@ -178,13 +163,7 @@ jobs: download-latest-cli: needs: detect_changes - if: >- - !cancelled() && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: needs.detect_changes.outputs.has_changed == 'true' name: Download the latest vCluster cli runs-on: ubuntu-latest steps: @@ -204,14 +183,9 @@ jobs: - build - parse_label-filter - detect_changes - if: >- - !cancelled() && needs.build.result == 'success' && + if: > needs.parse_label-filter.outputs.skip-edited != 'true' && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + needs.detect_changes.outputs.has_changed == 'true' runs-on: large-8_32 permissions: id-token: write # needed for OIDC → AWS @@ -221,7 +195,6 @@ jobs: uses: actions/checkout@v5 with: fetch-depth: 0 - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - run: git fetch --force --tags diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 6da0c3bc40..aead504f71 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -1,14 +1,8 @@ name: E2E CI -# Release validation runs post-build via workflow_run on the "Release" builder -# completing (DEVOPS-1050): a release created by the builder inside Actions does -# not emit release:created, so validators keyed on it would silently never run. -# On the workflow_run path detect_changes is skipped and the suite runs against -# the built tag (github.event.workflow_run.head_branch). on: - workflow_run: - workflows: ["Release"] - types: [completed] + release: + types: [created] pull_request: branches: - main @@ -28,9 +22,6 @@ env: jobs: detect_changes: - # PR-only: the release (workflow_run) path always validates, so it bypasses - # change detection. Entry jobs break the skip-propagation with !cancelled(). - if: github.event_name == 'pull_request' uses: loft-sh/github-actions/.github/workflows/detect-changes.yaml@v1 with: paths: | @@ -46,20 +37,13 @@ jobs: - "manifests/**" build: runs-on: ubuntu-latest - if: >- - !cancelled() && github.repository_owner == 'loft-sh' && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: github.repository_owner == 'loft-sh' && needs.detect_changes.outputs.has_changed == 'true' needs: detect_changes steps: - name: Checkout repository uses: actions/checkout@v6 with: fetch-depth: 0 - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - run: git fetch --force --tags @@ -102,19 +86,11 @@ jobs: get-testsuites-dir: needs: detect_changes - if: >- - !cancelled() && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: needs.detect_changes.outputs.has_changed == 'true' runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v6 - with: - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - id: set-paths-matrix run: | set -x @@ -129,19 +105,11 @@ jobs: needs: - build - detect_changes - if: >- - !cancelled() && needs.build.result == 'success' && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: needs.detect_changes.outputs.has_changed == 'true' runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v6 - with: - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - uses: azure/setup-helm@v4 name: Setup Helm @@ -190,13 +158,7 @@ jobs: download-latest-cli: needs: detect_changes - if: >- - !cancelled() && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: needs.detect_changes.outputs.has_changed == 'true' name: Download the latest vCluster cli runs-on: ubuntu-latest steps: @@ -216,13 +178,7 @@ jobs: - build - download-latest-cli - detect_changes - if: >- - !cancelled() && needs.build.result == 'success' && needs.download-latest-cli.result == 'success' && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: needs.detect_changes.outputs.has_changed == 'true' runs-on: ubuntu-latest strategy: fail-fast: false @@ -231,8 +187,6 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v6 - with: - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - uses: azure/setup-helm@v4 name: Setup Helm @@ -312,13 +266,7 @@ jobs: - build - get-testsuites-dir - detect_changes - if: >- - !cancelled() && needs.build.result == 'success' && needs.get-testsuites-dir.result == 'success' && - ( - (github.event_name == 'pull_request' && needs.detect_changes.outputs.has_changed == 'true') || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || - github.event_name == 'workflow_dispatch' - ) + if: needs.detect_changes.outputs.has_changed == 'true' runs-on: ubuntu-latest permissions: id-token: write # needed for OIDC → AWS @@ -344,8 +292,6 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v6 - with: - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - name: Set up Go uses: actions/setup-go@v6 diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml index 84e2309f94..dd0db3e9a4 100644 --- a/.github/workflows/unit-tests.yaml +++ b/.github/workflows/unit-tests.yaml @@ -1,12 +1,8 @@ name: Unit tests -# Runs on PRs and, post-build, when the "Release" builder completes (DEVOPS-1050: -# release:created does not fire for builder-created releases). On the workflow_run -# path the jobs run only for a green build and check out the built tag. on: - workflow_run: - workflows: ["Release"] - types: [completed] + release: + types: [created] pull_request: branches: - main @@ -27,14 +23,11 @@ concurrency: jobs: helm-unit-tests: name: Execute all helm tests - # do not run on forks; on the release path only for a green build - if: github.repository_owner == 'loft-sh' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') + if: github.repository_owner == 'loft-sh' # do not run on forks runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v6 - with: - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - name: Install Helm Unit Test Plugin run: | helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4 @@ -44,14 +37,11 @@ jobs: go-unit-test: name: Execute all go tests - # do not run on forks; on the release path only for a green build - if: github.repository_owner == 'loft-sh' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') + if: github.repository_owner == 'loft-sh' # do not run on forks runs-on: ubuntu-22.04 steps: - name: Check out code into the Go module directory uses: actions/checkout@v6 - with: - ref: ${{ github.event.workflow_run.head_branch || github.ref }} - name: Set up Go uses: actions/setup-go@v6 with: