From 8d6c2ff8248d2fa4cdc7dc5e7d717c846226e7a1 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sat, 15 Aug 2026 17:01:41 -0700 Subject: [PATCH] ci(free-tests): PR-number concurrency, failure-log artifact, main-push runs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three red-team/adversarial findings on the new required lane: (1) concurrency keyed on bare head_ref — two forks with the same branch name shared one group, so a push to fork B cancelled fork A's in-flight REQUIRED check (merge-pipeline DoS with no code fault); key on the PR number. (2) The runner's full logs die with the runner in os.tmpdir() — a red check named WHICH test failed but never why; upload the shard logs as an artifact on failure. (3) PR-only trigger meant two individually-green PRs could merge into a red main with nothing running the suite there; add push: branches: [main]. --- .github/workflows/free-tests.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/free-tests.yml b/.github/workflows/free-tests.yml index e5caf2166..6c6ae5dc2 100644 --- a/.github/workflows/free-tests.yml +++ b/.github/workflows/free-tests.yml @@ -24,6 +24,10 @@ name: Free Tests on: pull_request: branches: [main] + # Also on main pushes: two individually-green PRs can merge into a red + # main; without this nothing runs the free suite on main until the next PR. + push: + branches: [main] workflow_dispatch: concurrency: