From 61043244360baba35fb4b466d2bf71aef34e5a77 Mon Sep 17 00:00:00 2001 From: Shubham Pampattiwar Date: Tue, 14 Jul 2026 11:06:16 -0700 Subject: [PATCH 1/3] Skip upstream-only workflows on forks Add repository guard (github.repository == 'velero-io/velero') to workflows that should only run on the upstream repo. This prevents unnecessary CI runs on forks like openshift/velero where these workflows either fail due to missing secrets/config or duplicate fork-specific CI. Guarded workflows: auto_assign_prs, auto_label_prs, auto_request_review, e2e-test-kind, nightly-trivy-scan, pr-changelog-check, pr-codespell, pr-filepath-check, pr-linter-check, prow-action, rebase, stale-issues. Intentionally left unguarded: pr-ci-check (useful for contributors on forks), get-go-version (reusable workflow_call only). Signed-off-by: Shubham Pampattiwar --- .github/workflows/auto_assign_prs.yml | 1 + .github/workflows/auto_label_prs.yml | 1 + .github/workflows/auto_request_review.yml | 1 + .github/workflows/e2e-test-kind.yaml | 3 +++ .github/workflows/nightly-trivy-scan.yml | 1 + .github/workflows/pr-changelog-check.yml | 1 + .github/workflows/pr-codespell.yml | 1 + .github/workflows/pr-filepath-check.yml | 1 + .github/workflows/pr-linter-check.yml | 1 + .github/workflows/prow-action.yml | 1 + .github/workflows/rebase.yml | 2 +- .github/workflows/stale-issues.yml | 1 + 12 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto_assign_prs.yml b/.github/workflows/auto_assign_prs.yml index 9b915533c..8966b235e 100644 --- a/.github/workflows/auto_assign_prs.yml +++ b/.github/workflows/auto_assign_prs.yml @@ -14,6 +14,7 @@ permissions: jobs: # Automatically assigns reviewers and owner add-reviews: + if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest steps: - name: Set the author of a PR as the assignee diff --git a/.github/workflows/auto_label_prs.yml b/.github/workflows/auto_label_prs.yml index 042cc7e95..21540d8cb 100644 --- a/.github/workflows/auto_label_prs.yml +++ b/.github/workflows/auto_label_prs.yml @@ -15,6 +15,7 @@ permissions: jobs: # Automatically labels PRs based on file globs in the change. triage: + if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest steps: - uses: actions/labeler@v5 diff --git a/.github/workflows/auto_request_review.yml b/.github/workflows/auto_request_review.yml index 47844bc6c..096e4bdbc 100644 --- a/.github/workflows/auto_request_review.yml +++ b/.github/workflows/auto_request_review.yml @@ -11,6 +11,7 @@ permissions: jobs: auto-request-review: + if: github.repository == 'velero-io/velero' name: Auto Request Review runs-on: ubuntu-latest steps: diff --git a/.github/workflows/e2e-test-kind.yaml b/.github/workflows/e2e-test-kind.yaml index fc77cb4d3..6e3e4b447 100644 --- a/.github/workflows/e2e-test-kind.yaml +++ b/.github/workflows/e2e-test-kind.yaml @@ -17,6 +17,7 @@ jobs: # Build the Velero CLI and image once for all Kubernetes versions, and cache it so the fan-out workers can get it. build: + if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest needs: get-go-version outputs: @@ -81,6 +82,7 @@ jobs: # Create json of k8s versions to test # from guide: https://stackoverflow.com/a/65094398/4590470 setup-test-matrix: + if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest env: GH_TOKEN: ${{ github.token }} @@ -106,6 +108,7 @@ jobs: # Run E2E test against all Kubernetes versions on kind run-e2e-test: + if: github.repository == 'velero-io/velero' needs: - build - setup-test-matrix diff --git a/.github/workflows/nightly-trivy-scan.yml b/.github/workflows/nightly-trivy-scan.yml index 85ce3cdc5..dc4fa8b9f 100644 --- a/.github/workflows/nightly-trivy-scan.yml +++ b/.github/workflows/nightly-trivy-scan.yml @@ -5,6 +5,7 @@ on: jobs: nightly-scan: + if: github.repository == 'velero-io/velero' name: Trivy nightly scan runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/pr-changelog-check.yml b/.github/workflows/pr-changelog-check.yml index 0f296853a..f9fb14f37 100644 --- a/.github/workflows/pr-changelog-check.yml +++ b/.github/workflows/pr-changelog-check.yml @@ -7,6 +7,7 @@ on: jobs: build: + if: github.repository == 'velero-io/velero' name: Run Changelog Check runs-on: ubuntu-latest steps: diff --git a/.github/workflows/pr-codespell.yml b/.github/workflows/pr-codespell.yml index 65d2a1885..b65ae7ae5 100644 --- a/.github/workflows/pr-codespell.yml +++ b/.github/workflows/pr-codespell.yml @@ -3,6 +3,7 @@ on: [pull_request] jobs: codespell: + if: github.repository == 'velero-io/velero' name: Run Codespell runs-on: ubuntu-latest steps: diff --git a/.github/workflows/pr-filepath-check.yml b/.github/workflows/pr-filepath-check.yml index 260a09dc4..9b8ca593d 100644 --- a/.github/workflows/pr-filepath-check.yml +++ b/.github/workflows/pr-filepath-check.yml @@ -3,6 +3,7 @@ on: [pull_request] jobs: filepath-check: + if: github.repository == 'velero-io/velero' name: Check for invalid characters in file paths runs-on: ubuntu-latest steps: diff --git a/.github/workflows/pr-linter-check.yml b/.github/workflows/pr-linter-check.yml index 6ed7f073d..761cf2fe4 100644 --- a/.github/workflows/pr-linter-check.yml +++ b/.github/workflows/pr-linter-check.yml @@ -13,6 +13,7 @@ jobs: ref: ${{ github.event.pull_request.base.ref }} build: + if: github.repository == 'velero-io/velero' name: Run Linter Check runs-on: ubuntu-latest needs: get-go-version diff --git a/.github/workflows/prow-action.yml b/.github/workflows/prow-action.yml index e247590fe..871f69f8f 100644 --- a/.github/workflows/prow-action.yml +++ b/.github/workflows/prow-action.yml @@ -11,6 +11,7 @@ permissions: jobs: execute: + if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest steps: - uses: jpmcb/prow-github-actions@v1.1.3 diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml index 07c86b534..064bef70a 100644 --- a/.github/workflows/rebase.yml +++ b/.github/workflows/rebase.yml @@ -5,7 +5,7 @@ name: Automatic Rebase jobs: rebase: name: Rebase - if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase') + if: github.repository == 'velero-io/velero' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase') runs-on: ubuntu-latest steps: - name: Checkout the latest code diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml index 0dffc96c4..99a74872b 100644 --- a/.github/workflows/stale-issues.yml +++ b/.github/workflows/stale-issues.yml @@ -5,6 +5,7 @@ on: jobs: stale: + if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest steps: - uses: actions/stale@v10.1.1 From 97858c327336f78fd98de8814e5caf223bb1db7e Mon Sep 17 00:00:00 2001 From: Shubham Pampattiwar Date: Tue, 14 Jul 2026 11:08:04 -0700 Subject: [PATCH 2/3] Add changelog for PR #10001 Signed-off-by: Shubham Pampattiwar --- changelogs/unreleased/10001-shubham-pampattiwar | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelogs/unreleased/10001-shubham-pampattiwar diff --git a/changelogs/unreleased/10001-shubham-pampattiwar b/changelogs/unreleased/10001-shubham-pampattiwar new file mode 100644 index 000000000..d21f5cae5 --- /dev/null +++ b/changelogs/unreleased/10001-shubham-pampattiwar @@ -0,0 +1 @@ +Skip upstream-only workflows on forks From 2edf8f8260ddc85872709c2dc64255f4f0c1efdf Mon Sep 17 00:00:00 2001 From: Shubham Pampattiwar Date: Tue, 14 Jul 2026 12:36:01 -0700 Subject: [PATCH 3/3] Remove guards from e2e-test-kind, pr-linter-check, nightly-trivy-scan Per review feedback, these workflows are useful on forks: - e2e-test-kind: tests pass on downstream forks - pr-linter-check: keeps lint up to date for upstream-bound features - nightly-trivy-scan: wanted in downstream forks Also remove changelog file per reviewer request. Signed-off-by: Shubham Pampattiwar --- .github/workflows/e2e-test-kind.yaml | 3 --- .github/workflows/nightly-trivy-scan.yml | 1 - .github/workflows/pr-linter-check.yml | 1 - changelogs/unreleased/10001-shubham-pampattiwar | 1 - 4 files changed, 6 deletions(-) delete mode 100644 changelogs/unreleased/10001-shubham-pampattiwar diff --git a/.github/workflows/e2e-test-kind.yaml b/.github/workflows/e2e-test-kind.yaml index 6e3e4b447..fc77cb4d3 100644 --- a/.github/workflows/e2e-test-kind.yaml +++ b/.github/workflows/e2e-test-kind.yaml @@ -17,7 +17,6 @@ jobs: # Build the Velero CLI and image once for all Kubernetes versions, and cache it so the fan-out workers can get it. build: - if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest needs: get-go-version outputs: @@ -82,7 +81,6 @@ jobs: # Create json of k8s versions to test # from guide: https://stackoverflow.com/a/65094398/4590470 setup-test-matrix: - if: github.repository == 'velero-io/velero' runs-on: ubuntu-latest env: GH_TOKEN: ${{ github.token }} @@ -108,7 +106,6 @@ jobs: # Run E2E test against all Kubernetes versions on kind run-e2e-test: - if: github.repository == 'velero-io/velero' needs: - build - setup-test-matrix diff --git a/.github/workflows/nightly-trivy-scan.yml b/.github/workflows/nightly-trivy-scan.yml index dc4fa8b9f..85ce3cdc5 100644 --- a/.github/workflows/nightly-trivy-scan.yml +++ b/.github/workflows/nightly-trivy-scan.yml @@ -5,7 +5,6 @@ on: jobs: nightly-scan: - if: github.repository == 'velero-io/velero' name: Trivy nightly scan runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/pr-linter-check.yml b/.github/workflows/pr-linter-check.yml index 761cf2fe4..6ed7f073d 100644 --- a/.github/workflows/pr-linter-check.yml +++ b/.github/workflows/pr-linter-check.yml @@ -13,7 +13,6 @@ jobs: ref: ${{ github.event.pull_request.base.ref }} build: - if: github.repository == 'velero-io/velero' name: Run Linter Check runs-on: ubuntu-latest needs: get-go-version diff --git a/changelogs/unreleased/10001-shubham-pampattiwar b/changelogs/unreleased/10001-shubham-pampattiwar deleted file mode 100644 index d21f5cae5..000000000 --- a/changelogs/unreleased/10001-shubham-pampattiwar +++ /dev/null @@ -1 +0,0 @@ -Skip upstream-only workflows on forks