From 1789cd065b9b40f6c150d22511743aecd7791122 Mon Sep 17 00:00:00 2001 From: Chang Su Date: Fri, 17 Apr 2026 09:59:12 -0700 Subject: [PATCH] ci: gate expensive jobs on 'ci-approved' label for fork PRs Adds an if: condition on build-wheel that skips expensive GPU and paid-API jobs for fork PRs unless they carry the 'ci-approved' label. Internal PRs run unconditionally. build-wheel is the first-tier expensive job; benchmarks, e2e-* (1/2/4-GPU), e2e-vendor (paid Anthropic/OpenAI/xAI APIs), python-unit-tests, go-unit-tests, and go-bindings-e2e all inherit the gate transitively through their needs: build-wheel chain. Does not reintroduce pull_request_target or the prior ci-gate job (both reverted in #1175). To kick off expensive jobs on a fork PR after adding the label: wait for the contributor's next push (synchronize event), or click "Re-run all jobs" in the Actions UI. Recommended companion setting (repo admin): Settings -> Actions -> General -> Fork pull request workflows from outside collaborators: change to "Require approval for first-time contributors" so returning fork contributors don't need the manual approve-and-run click on every push. Signed-off-by: Chang Su --- .github/workflows/pr-test-rust.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/pr-test-rust.yml b/.github/workflows/pr-test-rust.yml index dbd1fbe721..02ce85c32f 100644 --- a/.github/workflows/pr-test-rust.yml +++ b/.github/workflows/pr-test-rust.yml @@ -103,6 +103,14 @@ jobs: python -c "from smg_grpc_proto import sglang_scheduler_pb2; print('OK')" build-wheel: + # Fork PRs must be labeled with 'ci-approved' for expensive jobs to run. + # Internal PRs (non-fork) run unconditionally. build-wheel is the + # first-tier expensive job; benchmarks, e2e-*, e2e-vendor, python-unit-tests, + # go-unit-tests, and go-bindings-e2e all chain off it via `needs:` and + # inherit the gate transitively. + if: >- + !github.event.pull_request.head.repo.fork || + contains(github.event.pull_request.labels.*.name, 'ci-approved') runs-on: k8s-runner-gpu permissions: contents: read