Skip to content

Restrict self-hosted runner job to trusted events only #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DeqingSun merged 3 commits into from
Jul 4, 2026
Merged

Restrict self-hosted runner job to trusted events only #189

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3a152e9
Initial plan
Copilot Jul 4, 2026
4183d3d
Restrict self-hosted runner job to trusted events only
Copilot Jul 4, 2026
f68ac95
Add minimal permissions block to limit GITHUB_TOKEN scope
Copilot Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .github/workflows/checkSketches.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,14 @@
name: check sketches

on: [pull_request, push]
on:
pull_request:
push:
branches:
- ch55xduino
workflow_dispatch:

permissions:
contents: read

jobs:

Expand Down Expand Up @@ -59,6 +67,9 @@ jobs:
path: compiled_hex.tar

real_hardware_test_on_self_hosted_runner:
# Only run on trusted events (push to default branch or manual dispatch) to prevent
# untrusted PR code from executing on the self-hosted runner.
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
needs: arduino-cli_compile_all
runs-on: self-hosted

Expand Down
Loading