ci: guard Kilo-only workflows in forks by maphew · Pull Request #11210 · Kilo-Org/kilocode

maphew · 2026-06-13T22:25:16Z

Summary

Add canonical-repo job guards to workflows that depend on Kilo-only secrets, private resources, publishing credentials, CodeQL uploads, or Blacksmith runners.
Prevent personal forks from running fork-local CI that cannot succeed outside Kilo-Org/kilocode.
Keep upstream PR and canonical-repo CI behavior unchanged.

Why

Forks currently trigger workflows that require Kilo-owned infrastructure or credentials. Those jobs fail or queue indefinitely in forks, creating noisy and unactionable CI failures for fork owners.

Validation

bun run script/check-workflows.ts
yq eval '.' .github/workflows/*.yml >/dev/null
git diff --check
Pre-push hook: bun turbo typecheck

gpt-5.5 on behalf of matt

kilo-code-bot · 2026-06-13T22:29:03Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Incremental Changes from Previous Review

The latest commit ("ci: trim fork workflow guards") addresses several previous review comments by removing if: github.repository == 'Kilo-Org/kilocode' guards from jobs where they were redundant:

Blacksmith runner jobs (check-org-member.yml, docs-build.yml, smoke-test.yml, test-vscode.yml, visual-regression.yml, etc.) — forks cannot use Blacksmith runners, so the runner allocation failure is a sufficient guard.
Publish workflow jobs (publish.yml) — triggered by tag pushes and releases, which won't fire in forks.
Gate jobs (test.yml, typecheck.yml) — lightweight fan-in jobs that are harmless to run in forks.

Guards were retained (or strengthened with workflow_dispatch allowance) on:

codeql.yml / codeql-kotlin.yml — CodeQL uploads require security-events: write.
containers.yml — container image builds require Kilo infrastructure.
auto-docs.yml — the PR merge path still requires the repo check; workflow_dispatch is ungated.
watch-opencode-releases.yml — config var + repo check.

Other changes:

script/publish.ts refactored inline release-note logic into script/kilocode/release-notes.ts with tests.
script/upstream/utils/config.ts added new upstream files to the merge skip list.

Files Reviewed (19 files + incremental)

Carried forward from previous review:

.github/workflows/auto-docs.yml
.github/workflows/check-org-member.yml
.github/workflows/codeql-kotlin.yml
.github/workflows/codeql.yml
.github/workflows/containers.yml
.github/workflows/docs-build.yml
.github/workflows/duplicate-issues.yml
.github/workflows/publish.yml
.github/workflows/smoke-test.yml
.github/workflows/test-vscode.yml
.github/workflows/test.yml
.github/workflows/typecheck.yml
.github/workflows/visual-regression.yml
.github/workflows/watch-opencode-releases.yml

New/changed since previous review:

script/publish.ts — refactored release notes
script/kilocode/release-notes.ts — new, extracted logic
script/kilocode/release-notes.test.ts — new tests
script/check-opencode-promise-facades.ts — allowlist maintenance
script/upstream/utils/config.ts — merge skip list additions

Previous Review Summaries (2 snapshots, latest commit fadfa6f)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `fadfa6f`)

Status: No Issues Found | Recommendation: Merge

Incremental Changes from Previous Review

The latest commit ("ci: trim fork workflow guards") addresses several previous review comments by removing if: github.repository == 'Kilo-Org/kilocode' guards from jobs where they were redundant:

Blacksmith runner jobs (check-org-member.yml, docs-build.yml, smoke-test.yml, test-vscode.yml, visual-regression.yml, etc.) — forks cannot use Blacksmith runners, so the runner allocation failure is a sufficient guard.
Publish workflow jobs (publish.yml) — triggered by tag pushes and releases, which won't fire in forks.
Gate jobs (test.yml, typecheck.yml) — lightweight fan-in jobs that are harmless to run in forks.

Guards were retained (or strengthened with workflow_dispatch allowance) on:

codeql.yml / codeql-kotlin.yml — CodeQL uploads require security-events: write.
containers.yml — container image builds require Kilo infrastructure.
auto-docs.yml — the PR merge path still requires the repo check; workflow_dispatch is ungated.
watch-opencode-releases.yml — config var + repo check.

Other changes:

script/publish.ts refactored inline release-note logic into script/kilocode/release-notes.ts with tests.
script/upstream/utils/config.ts added new upstream files to the merge skip list.

Files Reviewed (19 files + incremental)

Carried forward from previous review:

.github/workflows/auto-docs.yml
.github/workflows/check-org-member.yml
.github/workflows/codeql-kotlin.yml
.github/workflows/codeql.yml
.github/workflows/containers.yml
.github/workflows/docs-build.yml
.github/workflows/duplicate-issues.yml
.github/workflows/publish.yml
.github/workflows/smoke-test.yml
.github/workflows/test-vscode.yml
.github/workflows/test.yml
.github/workflows/typecheck.yml
.github/workflows/visual-regression.yml
.github/workflows/watch-opencode-releases.yml

New/changed since previous review:

script/publish.ts — refactored release notes
script/kilocode/release-notes.ts — new, extracted logic
script/kilocode/release-notes.test.ts — new tests
script/check-opencode-promise-facades.ts — allowlist maintenance
script/upstream/utils/config.ts — merge skip list additions

Previous review (commit `e1e2420`)

Status: No Issues Found | Recommendation: Merge

This PR correctly adds github.repository == 'Kilo-Org/kilocode' guards to workflow jobs that depend on Kilo-owned infrastructure, secrets, or Blacksmith runners. The approach is standard and consistent across all modified files.

A few notes on the implementation quality:

The required gate jobs in test.yml and typecheck.yml correctly combine the repo guard with always(), preserving the existing fan-in behavior in the canonical repo while skipping cleanly in forks.
The check-org-member.yml guard is harmless — it's a workflow_call reusable workflow, and github.repository resolves to the caller's repo at runtime, so the guard works correctly for callers too.
The auto-docs.yml multi-line if expression correctly wraps the existing OR condition in parentheses after prepending the AND clause.
The duplicate-issues.yml recheck-compliance guard is correct; the check-duplicates job remains unconditionally disabled (if: false) and is unaffected.
The visual-regression.yml downstream jobs correctly AND the repo guard with the needs.check-paths.outputs.matched == 'true' condition.

Files Reviewed (14 files)

.github/workflows/auto-docs.yml
.github/workflows/check-org-member.yml
.github/workflows/codeql-kotlin.yml
.github/workflows/codeql.yml
.github/workflows/containers.yml
.github/workflows/docs-build.yml
.github/workflows/duplicate-issues.yml
.github/workflows/publish.yml
.github/workflows/smoke-test.yml
.github/workflows/test-vscode.yml
.github/workflows/test.yml
.github/workflows/typecheck.yml
.github/workflows/visual-regression.yml
.github/workflows/watch-opencode-releases.yml

_{Reviewed by gpt-5.6-sol · Input: 89.4K · Output: 9K · Cached: 386.6K}

_{Review guidance: REVIEW.md from base branch main}

maphew · 2026-06-14T04:10:46Z

Local Review for branch diff: `fix/fork-ci-workflow-guards` -> `origin/main`

Summary

This change adds canonical repository guards to workflow jobs that rely on Kilo-owned CI infrastructure, secrets, publishing permissions, private resources, or CodeQL uploads. I found no high-confidence security, performance, business logic, deploy safety, duplication, or dead-code issues in the reviewed diff.

Issues Found

No issues found.

Detailed Findings

No detailed findings.

Recommendation

APPROVE — Code is ready to merge/commit

gpt-5.5 on behalf of matt

markijbema · 2026-06-16T11:00:54Z

 jobs:
  build:
    name: Build docs site
+    if: github.repository == 'Kilo-Org/kilocode' # kilocode_change


i don't fully get it, why does this need to be disabled?

markijbema

Hey! Thanks for the PR: love that you picked it up broadly to make the contributor experience better.

However I stopped reviewing halfway because i think this is to overeager. I do agree it's a good idea to disable all jobs which are more infrastructural, but we dont need to disable jobs which are

only manually invoked
core test infrastructure (if this fails on forks we should look into that instead imho)

Can you please trim it down to only the infrastructure/autotriggered jobs?

maphew · 2026-06-16T15:32:08Z

Addressed the review feedback in fadfa6f: trimmed the fork repository guards down to infrastructure/autotriggered workflows, left manual-only and core test workflows runnable, and kept workflow_dispatch paths available on forks where applicable.\n\nValidation run locally:\n- bun run script/check-workflows.ts\n- bun run script/check-opencode-annotations.ts\n- git diff --check

johnnyeric · 2026-07-14T09:25:38Z

Hey @maphew, thanks for addressing the comments. Could you please resolve the conflict?

johnnyeric · 2026-07-16T10:24:00Z

Thanks for improving this. Just merged.

* ci: guard Kilo-only workflows in forks * ci: trim fork workflow guards --------- Co-authored-by: CI Bot <ci@beads.test>

maphew force-pushed the fix/fork-ci-workflow-guards branch from 2067c24 to e1e2420 Compare June 14, 2026 04:17

johnnyeric requested review from catrielmuller and markijbema and removed request for catrielmuller June 15, 2026 10:07

markijbema reviewed Jun 16, 2026

View reviewed changes

Comment thread .github/workflows/check-org-member.yml Outdated

markijbema reviewed Jun 16, 2026

View reviewed changes

Comment thread .github/workflows/duplicate-issues.yml Outdated

markijbema reviewed Jun 16, 2026

View reviewed changes

Comment thread .github/workflows/smoke-test.yml Outdated

markijbema reviewed Jun 16, 2026

View reviewed changes

Comment thread .github/workflows/test-vscode.yml Outdated

markijbema suggested changes Jun 16, 2026

View reviewed changes

johnnyeric approved these changes Jul 14, 2026

View reviewed changes

maphew and others added 2 commits July 14, 2026 17:13

ci: guard Kilo-only workflows in forks

58c590c

ci: trim fork workflow guards

f225118

maphew force-pushed the fix/fork-ci-workflow-guards branch from b280aaa to f225118 Compare July 14, 2026 17:14

johnnyeric and others added 3 commits July 14, 2026 19:38

Merge branch 'main' into fix/fork-ci-workflow-guards

f7898f9

Merge branch 'main' into fix/fork-ci-workflow-guards

de16eba

Merge branch 'main' into fix/fork-ci-workflow-guards

9b4d5e5

maphew requested a review from markijbema July 15, 2026 20:07

johnnyeric merged commit 0b5ad0f into Kilo-Org:main Jul 16, 2026
28 checks passed

kilo-maintainer Bot mentioned this pull request Jul 21, 2026

release(jetbrains): v7.0.8 #12429

Merged

t7tran pushed a commit to t7tran/kilocode that referenced this pull request Aug 14, 2026

ci: guard Kilo-only workflows in forks (Kilo-Org#11210)

f148b5f

* ci: guard Kilo-only workflows in forks * ci: trim fork workflow guards --------- Co-authored-by: CI Bot <ci@beads.test>

maphew mentioned this pull request Aug 24, 2026

ci: fall back to GitHub-hosted runners in forks #13364

Merged

Navigation Menu

Uh oh!

ci: guard Kilo-only workflows in forks - #11210

ci: guard Kilo-only workflows in forks#11210
johnnyeric merged 5 commits into
Kilo-Org:mainfrom
maphew:fix/fork-ci-workflow-guards

maphew commented Jun 13, 2026

Uh oh!

kilo-code-bot Bot commented Jun 13, 2026 •

edited

Loading

Previous review (commit `fadfa6f`)

Previous review (commit `e1e2420`)

Uh oh!

maphew commented Jun 14, 2026

Uh oh!

Uh oh!

Uh oh!

markijbema Jun 16, 2026

Uh oh!

Uh oh!

Uh oh!

markijbema left a comment

Uh oh!

maphew commented Jun 16, 2026

Uh oh!

johnnyeric commented Jul 14, 2026

Uh oh!

Uh oh!

johnnyeric commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

maphew commented Jun 13, 2026

Summary

Why

Validation

Uh oh!

kilo-code-bot Bot commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Previous review (commit fadfa6f)

Previous review (commit e1e2420)

Uh oh!

maphew commented Jun 14, 2026

Local Review for branch diff: fix/fork-ci-workflow-guards -> origin/main

Summary

Issues Found

Detailed Findings

Recommendation

Uh oh!

Uh oh!

Uh oh!

markijbema Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

markijbema left a comment

Choose a reason for hiding this comment

Uh oh!

maphew commented Jun 16, 2026

Uh oh!

johnnyeric commented Jul 14, 2026

Uh oh!

Uh oh!

johnnyeric commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kilo-code-bot Bot commented Jun 13, 2026 •

edited

Loading

Previous review (commit `fadfa6f`)

Previous review (commit `e1e2420`)

Local Review for branch diff: `fix/fork-ci-workflow-guards` -> `origin/main`