Repository navigation
ci: make the workflows safe to run in the internal repo - #1167
Merged
Merged
Conversation
The internal repo for stellar-rpc runs the same workflow files. The integration tests now check out the repo that holds the workflow, as in stellar-horizon, so the internal repo tests its own commits. CodeQL, the Socket scans, the sprint automation, the soroban-env bump and the load test run only in stellar/stellar-rpc. Code scanning in the internal repo would need GitHub Code Security, the Socket token reaches the internal repo and would send results for unreleased fixes, the internal repo has no project app secrets, the bump PRs belong in this repo, and the AWS role the load test assumes trusts only this repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Issues and pull requests closed in the internal repo should get their completed sprint too. The job needs the project app's organization secrets to be shared with the internal repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shaptic
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The internal repo for stellar-rpc runs the same workflow files, so the workflows have to behave correctly there too.
job.workflow_repository, which is the repo that holds the workflow, instead ofstellar/stellar-rpc, and therpc_git_refdescription says so. Without this, the internal repo would test this repo's commits instead of its own. stellar-core calls this workflow from its own repo and still getsstellar/stellar-rpc.stellar/stellar-rpc. The Socket API token reaches the internal repo, so its scans send Socket results for whatever its default branch holds, unreleased fixes included.stellar/stellar-rpc. In the internal repo it opens bump PRs of its own, but those belong in this repo and reach the internal repo when it syncs.stellar/stellar-rpc, because the AWS role its legs assume trusts only this repo.stellar/stellar-rpc. In the internal repo it fails on every run, because code scanning there would need GitHub Code Security.Nothing changes in this repo: the conditions are always true here, and
job.workflow_repositoryisstellar/stellar-rpc.🤖 Generated with Claude Code