From 61f7939ab7c375c6501c03eff0358b679f3d0250 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin <3811295@gmail.com> Date: Thu, 20 Aug 2026 18:30:21 +0300 Subject: [PATCH] ci(workflows): make E2E breakpoint opt-in via labels only Drop the author-association branch from the "Breakpoint on E2E failure" step condition, so a red end-to-end run only opens an SSH breakpoint when the pull request carries the debug or release label. The dropped branch held an ephemeral CI runner open for up to twenty minutes on every red maintainer-authored pull request, whether or not anyone intended to attach. Trim the step's explanatory comment to match: drop the paragraph about the removed authorship path, including its stale claim that only the debug label affects runner selection, since this workflow has no conditional runs-on to begin with. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin <3811295@gmail.com> --- .github/workflows/pull-requests.yaml | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml index 3a686d550..eedec6239 100644 --- a/.github/workflows/pull-requests.yaml +++ b/.github/workflows/pull-requests.yaml @@ -1121,15 +1121,10 @@ jobs: # ▸ Open an SSH breakpoint to the failing sandbox so maintainers can attach, # inspect Talos/Cozystack state and resume with `breakpoint resume`. # - # Opens when the E2E job fails AND any of: the `debug` label, the - # `release` label (release PRs are bot-created, so their presence - # implies maintainer authorship), or the PR author is a maintainer - # (author_association is OWNER/MEMBER/COLLABORATOR). The maintainer- - # authorship path needs no label and does NOT move the jobs onto - # self-hosted runners — only the `debug` label flips `runs-on`, so a - # maintainer PR opens the breakpoint on the default oracle-vm runner the - # job already uses and simply holds that ephemeral runner. authorized-users - # is kept as a second defense layer controlling who may actually SSH in. + # Opens when the E2E job fails AND the PR carries the `debug` label or + # the `release` label (release PRs are bot-created, so the label + # implies maintainer authorship). authorized-users is kept as a second + # defense layer controlling who may actually SSH in. # # Uses cozystack/breakpoint-action (fork of namespacelabs/breakpoint-action) # pinned by SHA. The fork adds: pause-idle mode (initial grace period for @@ -1147,8 +1142,7 @@ jobs: failure() && vars.BREAKPOINT_ENDPOINT != '' && (contains(github.event.pull_request.labels.*.name, 'debug') - || contains(github.event.pull_request.labels.*.name, 'release') - || contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)) + || contains(github.event.pull_request.labels.*.name, 'release')) # cozystack/breakpoint-action v2-cozy.1 # mode: pause-idle defaults: grace-period=20m, idle-timeout=10m uses: cozystack/breakpoint-action@a6f3a6f87be398ad63b6577351e3398e53f578e4