Re: [PATCH] .github/workflows/tf_testsuite.yml: only run on SELinuxProject/selinux

On Wed, Aug 5, 2026 at 2:53 AM Ondrej Mosnacek <[email protected]> wrote:
>
> On Tue, Aug 4, 2026 at 8:39 PM Stephen Smalley
> <[email protected]> wrote:
> >
> > Only try to run the testfarm tests on SELinuxProject/selinux; anything
> > else will fail due to lacking access to the API key.
> >
> > Signed-off-by: Stephen Smalley <[email protected]>
> > ---
> >  .github/workflows/tf_testsuite.yml | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/.github/workflows/tf_testsuite.yml b/.github/workflows/tf_testsuite.yml
> > index 7e3993d3..48484496 100644
> > --- a/.github/workflows/tf_testsuite.yml
> > +++ b/.github/workflows/tf_testsuite.yml
> > @@ -5,6 +5,7 @@ on: [push, pull_request]
> >  jobs:
> >    tf_testsuite:
> >      runs-on: ubuntu-latest
> > +    if: github.repository == 'SELinuxProject/selinux'
> >      strategy:
> >        fail-fast: false
> >        matrix:
> > --
> > 2.55.0
> >
>
> IMHO this is overly restrictive - a contributor may have a TF token
> set up in their fork and this would prevent the test from running when
> they push a branch there (they would have to commit a revert of this
> patch and leave it out when submitting upstream). I think it's better
> to let it always try to run and suffer the failure when there's no
> token. We could disable it at least for pull requests, though, where
> sadly having a token set up in either repo doesn't help.

Ok, I'll drop this patch then. I just find it annoying that every time
I push a branch to my fork it tries to run these and fails and
therefore doesn't get the nice green check mark overall even when
everything else passes. I noticed that the CIFuzz workflow had this
conditional and thought I'd replicate it for the testfarm one, but
that's fine - I'll just live with it as is.