Skip to content

Block manual GitLab CI on main #141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yoshifuminakamura merged 1 commit into from
Aug 31, 2026
Merged

Block manual GitLab CI on main #141

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/gitlab-manual-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,19 @@ jobs:
fetch-depth: 0
path: trusted

- name: Reject production main target
env:
TARGET_REF: ${{ inputs.target_ref }}
run: |
set -euo pipefail

case "${TARGET_REF}" in
main|heads/main|refs/heads/main|origin/main|refs/remotes/origin/main)
echo "::error::GitLab Manual CI must not target the production main branch. Use develop, a trusted ci/pr-* branch, a feature branch, a tag, or a SHA for manual validation."
exit 1
;;
esac

- name: Prepare GitLab repository settings
id: gitlab-repo
uses: ./trusted/.github/actions/prepare-gitlab-repo
Expand Down
4 changes: 4 additions & 0 deletions docs/ci.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,10 @@ The workflow accepts these inputs:
| `park_only` | Run only the legacy Benchpark bridge path / legacy Benchpark bridgeのみ実行 | `true` |
| `park_send` | Run the legacy Benchpark bridge send-only path / legacy Benchpark bridge送信系のみ実行 | `true` |

`GitLab Manual CI` is for development and release-candidate validation, not for producing production `main` branch results. The workflow rejects `target_ref` values that name the production `main` branch. Public `main` measurements should be produced by Portal-managed triggers with an explicit `code` / `system` scope and an explicit `RESULT_SERVER` pipeline variable.

`GitLab Manual CI` は開発・release candidate検証用であり、本番 `main` branch結果を作る入口ではありません。このworkflowは本番 `main` branchを指す `target_ref` を拒否します。公開用の `main` 計測は、Portal管理のtriggerから、明示的な `code` / `system` scope と明示的な `RESULT_SERVER` pipeline variable を渡して作成します。

このworkflowは以下を行います。

The workflow:
Expand Down
Loading