Repository navigation
Conversation
…l superseded PR runs The fleet's CI saturated GitHub's 20 concurrent jobs: about 60,800 runner wall-minutes in 48 h. With the repository variable PM_LOCAL_RUNNER=on, the Linux jobs in this workflow (2) run on the fleet's local ephemeral runners ([self-hosted, pm-local]): one fresh, resource-capped container per job. Fork pull requests always stay on ubuntu-latest. A new push to a pull request cancels that PR's earlier run; pushes to main and manual runs never wait for or cancel each other. Required check names are unchanged.
Reviewer's GuideConfigurationRoute both Linux jobs to local runners only when enabled and safe for same-repository pull requests, while keeping the GitHub-hosted fallback.
Cancel superseded pull-request runs without coupling pushes to main or manual runs, and document the runner and concurrency behavior.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
 [Medium impact] The PR appears safe to merge. SummaryThe PR adds optional local runners for Linux CI jobs and cancels earlier runs for the same pull request.
No actionable issues found. Reviews (1) · Last reviewed commit: "Run Linux CI jobs on local runners when ..." · Reviewed by Greptile |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/ci.yml" line_range="22" />
<code_context>
jobs:
test:
- runs-on: ubuntu-latest
+ runs-on: ${{ (vars.PM_LOCAL_RUNNER == 'on' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","pm-local"]') || 'ubuntu-latest' }}
strategy:
fail-fast: false
</code_context>
<issue_to_address>
**Fork code reaches local runners**
When PM_LOCAL_RUNNER is `on` and an external contributor's fork PR has its workflow run approved, a fork author can edit this PR-triggered workflow to remove the fork check or add a job targeting `self-hosted`; the edited workflow then runs PR-controlled code on a local runner, exposing its job token and runner-reachable resources.
Keep PR-controlled workflows off local runners, or enforce local-runner eligibility through a policy that PR authors cannot change.
Also at `.github/workflows/ci.yml:82`.
</issue_to_address>
### Comment 2
<location path=".github/workflows/ci.yml" line_range="17-18" />
<code_context>
+# A new push to a pull request supersedes its earlier CI run: cancel it instead of letting both hold runners.
+# Pushes to main and manual runs get a group of their own, so they never wait for or cancel each other.
+concurrency:
+ group: ci-${{ github.event.pull_request.number && format('pr-{0}', github.event.pull_request.number) || github.run_id }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
jobs:
</code_context>
<issue_to_address>
**Older PR run cancels latest**
When two pushes to the same PR are processed out of order and the older push's run enters the concurrency group last, gitHub does not guarantee that runs enter a concurrency group in push order, so an older push's run can enter after a newer push's run and cancel it. The older SHA then gets the remaining CI result while the PR's current commit has no successful required checks.
Before allowing an event's run to cancel another, verify that its head SHA is still the PR's current head, or otherwise serialize runs in commit order.
</issue_to_address>
### Comment 3
<location path=".github/workflows/ci.yml" line_range="22" />
<code_context>
jobs:
test:
- runs-on: ubuntu-latest
+ runs-on: ${{ (vars.PM_LOCAL_RUNNER == 'on' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","pm-local"]') || 'ubuntu-latest' }}
strategy:
fail-fast: false
</code_context>
<issue_to_address>
**Queued checks never fall back**
When a local runner becomes unavailable after jobs are queued and the controller turns `PM_LOCAL_RUNNER` off, `runs-on` has already resolved to `[self-hosted, pm-local]`, so changing the variable does not reroute those jobs to `ubuntu-latest`; they stay queued until a matching runner returns or the runs are canceled, leaving the check blocked.
When disabling the local runner, cancel and recreate queued jobs with `runs-on: ubuntu-latest` rather than relying on the resolved expression to change.
Also at `.github/workflows/ci.yml:82`.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 3 findings to address first, and when enabled, code from same-repository pull requests runs on self-hosted runners; if runner isolation or access is broader than intended, that code could expose runner-accessible data or affect the runner fleet. Reverting stops future runs there, but cannot undo any exposure or damage that already occurred.
Blocking findings: .github/workflows/ci.yml:22, .github/workflows/ci.yml:18, .github/workflows/ci.yml:22
| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| runs-on: ${{ (vars.PM_LOCAL_RUNNER == 'on' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","pm-local"]') || 'ubuntu-latest' }} |
There was a problem hiding this comment.
🟠 High · Fork code reaches local runners
When PM_LOCAL_RUNNER is on and an external contributor's fork PR has its workflow run approved, a fork author can edit this PR-triggered workflow to remove the fork check or add a job targeting self-hosted; the edited workflow then runs PR-controlled code on a local runner, exposing its job token and runner-reachable resources.
Keep PR-controlled workflows off local runners, or enforce local-runner eligibility through a policy that PR authors cannot change.
Also at .github/workflows/ci.yml:82.
Prompt for AI agents
In `.github/workflows/ci.yml` at line 22:
**Fork code reaches local runners**
When PM_LOCAL_RUNNER is `on` and an external contributor's fork PR has its workflow run approved, a fork author can edit this PR-triggered workflow to remove the fork check or add a job targeting `self-hosted`; the edited workflow then runs PR-controlled code on a local runner, exposing its job token and runner-reachable resources.
Keep PR-controlled workflows off local runners, or enforce local-runner eligibility through a policy that PR authors cannot change.
Also at `.github/workflows/ci.yml:82`.| group: ci-${{ github.event.pull_request.number && format('pr-{0}', github.event.pull_request.number) || github.run_id }} | ||
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} |
There was a problem hiding this comment.
🟡 Medium · Older PR run cancels latest
When two pushes to the same PR are processed out of order and the older push's run enters the concurrency group last, gitHub does not guarantee that runs enter a concurrency group in push order, so an older push's run can enter after a newer push's run and cancel it. The older SHA then gets the remaining CI result while the PR's current commit has no successful required checks.
Before allowing an event's run to cancel another, verify that its head SHA is still the PR's current head, or otherwise serialize runs in commit order.
Prompt for AI agents
In `.github/workflows/ci.yml` at lines 17-18:
**Older PR run cancels latest**
When two pushes to the same PR are processed out of order and the older push's run enters the concurrency group last, gitHub does not guarantee that runs enter a concurrency group in push order, so an older push's run can enter after a newer push's run and cancel it. The older SHA then gets the remaining CI result while the PR's current commit has no successful required checks.
Before allowing an event's run to cancel another, verify that its head SHA is still the PR's current head, or otherwise serialize runs in commit order.| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| runs-on: ${{ (vars.PM_LOCAL_RUNNER == 'on' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","pm-local"]') || 'ubuntu-latest' }} |
There was a problem hiding this comment.
🟡 Medium · Queued checks never fall back
When a local runner becomes unavailable after jobs are queued and the controller turns PM_LOCAL_RUNNER off, runs-on has already resolved to [self-hosted, pm-local], so changing the variable does not reroute those jobs to ubuntu-latest; they stay queued until a matching runner returns or the runs are canceled, leaving the check blocked.
When disabling the local runner, cancel and recreate queued jobs with runs-on: ubuntu-latest rather than relying on the resolved expression to change.
Also at .github/workflows/ci.yml:82.
Prompt for AI agents
In `.github/workflows/ci.yml` at line 22:
**Queued checks never fall back**
When a local runner becomes unavailable after jobs are queued and the controller turns `PM_LOCAL_RUNNER` off, `runs-on` has already resolved to `[self-hosted, pm-local]`, so changing the variable does not reroute those jobs to `ubuntu-latest`; they stay queued until a matching runner returns or the runs are canceled, leaving the check blocked.
When disabling the local runner, cancel and recreate queued jobs with `runs-on: ubuntu-latest` rather than relying on the resolved expression to change.
Also at `.github/workflows/ci.yml:82`.
Part of moving the fleet's CI off GitHub's shared 20-job pool. In 48 h the fleet used about 60,800 runner wall-minutes, about 21 concurrent runs against GitHub's limit of 20.
runs-onis an expression. With the repository variablePM_LOCAL_RUNNER=on(set), they run on the fleet's local, ephemeral runners ([self-hosted, pm-local]): each a fresh container that takes one job, capped in CPU, memory and pids, with no Docker socket and no host mounts.ubuntu-latest, and workflows from outside contributors' fork PRs now need approval (all_external_contributors).offputs every job back on GitHub-hosted runners. The controller does this by itself if no LAN host is reachable for 10 minutes.Required check names are unchanged. Pilot: unbraind/pm-memory#73.
Summary by Sourcery
Enable optional local execution for Linux CI jobs and prevent outdated pull request runs from consuming runner capacity.
New Features:
Enhancements:
Summary by cubic
Offloads the two Linux CI jobs to the fleet's local ephemeral runners when the
PM_LOCAL_RUNNERrepository variable ison, and cancels superseded pull request runs so CI no longer saturates GitHub's 20-job pool.[self-hosted, pm-local]containers (fresh, resource-capped, no Docker socket, no host mounts); fork PRs always stay onubuntu-latest.PM_LOCAL_RUNNERtooff(or leaving it unset) keeps everything on GitHub-hosted runners.Written for commit ffe4c17. Summary will update on new commits.