From 86d4106e48f44dd09a66807543c9c00ce9f8c873 Mon Sep 17 00:00:00 2001 From: Yun Wang Date: Thu, 17 Sep 2026 16:08:04 +0200 Subject: [PATCH 1/3] ci: skip the test suite on release-please Release PRs A Release PR bumps the version and rewrites the changelog. Every source commit in it already passed the suite on the PR it came from, so running it again only delays the release. The guard sits on each job rather than on the calling job in ci.yml: a job skipped by `if:` reports success and satisfies a required status check, while a reusable workflow that is never called produces no check at all and would leave a required one pending forever. The pre-tag gate is unaffected. release.yml triggers on push, where github.head_ref is empty, so the suite still runs before a tag lands. --- .github/workflows/run_tests.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml index f6dc9daf..69fbfed3 100644 --- a/.github/workflows/run_tests.yml +++ b/.github/workflows/run_tests.yml @@ -18,8 +18,12 @@ env: permissions: contents: read +# Release PRs only bump the version and rewrite the changelog, and every commit in one +# already passed this suite on its own PR. The guard sits on each job, not on the caller, +# so a skipped job still reports success to a required status check. jobs: ruff: + if: ${{ !startsWith(github.head_ref, 'release-please--') }} name: Ruff runs-on: ubuntu-latest steps: @@ -31,6 +35,7 @@ jobs: run: make lint typecheck: + if: ${{ !startsWith(github.head_ref, 'release-please--') }} name: Type Check (ty) runs-on: ubuntu-latest steps: @@ -45,6 +50,7 @@ jobs: # Uses STREAM_CHAT_* credentials which do NOT have video enabled. # Video paths and manual test paths are defined in the Makefile. test-non-video: + if: ${{ !startsWith(github.head_ref, 'release-please--') }} name: Non-video tests (${{ matrix.python-version }}) environment: name: ci @@ -71,6 +77,7 @@ jobs: # ── Video tests (video-enabled credentials) ───────────────────── # Uses STREAM_* credentials which have video enabled. test-video: + if: ${{ !startsWith(github.head_ref, 'release-please--') }} name: Video tests (${{ matrix.python-version }}) environment: name: ci From 32fdb0a86b4c8a46b97d9aaa05fdc6554d485a48 Mon Sep 17 00:00:00 2001 From: Yun Wang Date: Thu, 17 Sep 2026 16:35:07 +0200 Subject: [PATCH 2/3] ci: verify release-please authorship before skipping checks The branch-name guard was spoofable: any PR, a fork's included, could name its head branch release-please--x and skip every required check, which branch protection then counts as satisfied. The guard now also requires the PR to be opened by github-actions[bot] from a branch in this repository. --- .github/workflows/run_tests.yml | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml index 69fbfed3..bb35d1cb 100644 --- a/.github/workflows/run_tests.yml +++ b/.github/workflows/run_tests.yml @@ -18,12 +18,19 @@ env: permissions: contents: read -# Release PRs only bump the version and rewrite the changelog, and every commit in one -# already passed this suite on its own PR. The guard sits on each job, not on the caller, -# so a skipped job still reports success to a required status check. +# Every job below skips on a Release PR. release-please only bumps the version and rewrites +# the changelog, and every source commit in one already passed this suite on the PR it came +# from. The guard sits on each job rather than on the calling job in ci.yml, because a job +# skipped by `if:` reports success and satisfies a required status check, while a reusable +# workflow that is never called produces no check at all. It tests the author as well as the +# branch name: on its own, the name would let any PR, a fork's included, call its branch +# release-please--x and skip every required check, which branch protection counts as met. jobs: ruff: - if: ${{ !startsWith(github.head_ref, 'release-please--') }} + if: >- + ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + && github.event.pull_request.head.repo.full_name == github.repository + && startsWith(github.head_ref, 'release-please--')) }} name: Ruff runs-on: ubuntu-latest steps: @@ -35,7 +42,10 @@ jobs: run: make lint typecheck: - if: ${{ !startsWith(github.head_ref, 'release-please--') }} + if: >- + ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + && github.event.pull_request.head.repo.full_name == github.repository + && startsWith(github.head_ref, 'release-please--')) }} name: Type Check (ty) runs-on: ubuntu-latest steps: @@ -50,7 +60,10 @@ jobs: # Uses STREAM_CHAT_* credentials which do NOT have video enabled. # Video paths and manual test paths are defined in the Makefile. test-non-video: - if: ${{ !startsWith(github.head_ref, 'release-please--') }} + if: >- + ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + && github.event.pull_request.head.repo.full_name == github.repository + && startsWith(github.head_ref, 'release-please--')) }} name: Non-video tests (${{ matrix.python-version }}) environment: name: ci @@ -77,7 +90,10 @@ jobs: # ── Video tests (video-enabled credentials) ───────────────────── # Uses STREAM_* credentials which have video enabled. test-video: - if: ${{ !startsWith(github.head_ref, 'release-please--') }} + if: >- + ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + && github.event.pull_request.head.repo.full_name == github.repository + && startsWith(github.head_ref, 'release-please--')) }} name: Video tests (${{ matrix.python-version }}) environment: name: ci From e8b405b089098a654a63f3d008048945fc5e6915 Mon Sep 17 00:00:00 2001 From: Yun Wang Date: Thu, 17 Sep 2026 16:36:17 +0200 Subject: [PATCH 3/3] ci: test a human commit pushed onto a Release PR The guard keyed on who opened the PR, so a commit pushed by hand onto the release-please branch, to fix a conflict or a changelog entry, inherited the skip and reached the default branch having run nothing. github.actor is the pusher rather than the PR author, so that commit is now tested like any other and only release-please's own pushes skip. --- .github/workflows/run_tests.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml index bb35d1cb..c1f9400a 100644 --- a/.github/workflows/run_tests.yml +++ b/.github/workflows/run_tests.yml @@ -25,10 +25,14 @@ permissions: # workflow that is never called produces no check at all. It tests the author as well as the # branch name: on its own, the name would let any PR, a fork's included, call its branch # release-please--x and skip every required check, which branch protection counts as met. +# github.actor is the third clause, and it is the pusher rather than the PR author, so a +# human commit pushed onto the Release PR to fix a conflict or a changelog entry is tested +# like any other commit instead of riding the skip into main untested. jobs: ruff: if: >- - ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + ${{ !(github.actor == 'github-actions[bot]' + && github.event.pull_request.user.login == 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'release-please--')) }} name: Ruff @@ -43,7 +47,8 @@ jobs: typecheck: if: >- - ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + ${{ !(github.actor == 'github-actions[bot]' + && github.event.pull_request.user.login == 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'release-please--')) }} name: Type Check (ty) @@ -61,7 +66,8 @@ jobs: # Video paths and manual test paths are defined in the Makefile. test-non-video: if: >- - ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + ${{ !(github.actor == 'github-actions[bot]' + && github.event.pull_request.user.login == 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'release-please--')) }} name: Non-video tests (${{ matrix.python-version }}) @@ -91,7 +97,8 @@ jobs: # Uses STREAM_* credentials which have video enabled. test-video: if: >- - ${{ !(github.event.pull_request.user.login == 'github-actions[bot]' + ${{ !(github.actor == 'github-actions[bot]' + && github.event.pull_request.user.login == 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'release-please--')) }} name: Video tests (${{ matrix.python-version }})