Re: [PATCH] .github/workflows/tf_testsuite.yml: only run on SELinuxProject/selinux

On Tue, Aug 4, 2026 at 8:39 PM Stephen Smalley
<[email protected]> wrote:
>
> Only try to run the testfarm tests on SELinuxProject/selinux; anything
> else will fail due to lacking access to the API key.
>
> Signed-off-by: Stephen Smalley <[email protected]>
> ---
>  .github/workflows/tf_testsuite.yml | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/.github/workflows/tf_testsuite.yml b/.github/workflows/tf_testsuite.yml
> index 7e3993d3..48484496 100644
> --- a/.github/workflows/tf_testsuite.yml
> +++ b/.github/workflows/tf_testsuite.yml
> @@ -5,6 +5,7 @@ on: [push, pull_request]
>  jobs:
>    tf_testsuite:
>      runs-on: ubuntu-latest
> +    if: github.repository == 'SELinuxProject/selinux'
>      strategy:
>        fail-fast: false
>        matrix:
> --
> 2.55.0
>

IMHO this is overly restrictive - a contributor may have a TF token
set up in their fork and this would prevent the test from running when
they push a branch there (they would have to commit a revert of this
patch and leave it out when submitting upstream). I think it's better
to let it always try to run and suffer the failure when there's no
token. We could disable it at least for pull requests, though, where
sadly having a token set up in either repo doesn't help.

-- 
Ondrej Mosnacek
Senior Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.