Restrict GitHub workflows to microsoft/aspire by Copilot · Pull Request #20722 · microsoft/aspire

Copilot · 2026-10-04T14:35:58Z

Description

GitHub Actions jobs should run only in microsoft/aspire, but repository-owner checks also allow other repositories under the same organization, and some jobs have no repository guard.

Use exact repository checks across direct and reusable workflows, including agentic workflow sources and generated locks. Narrow GITHUB_TOKEN permissions on test workflows and update the related CI documentation.

if: ${{ github.repository == 'microsoft/aspire' }}

Remove five tests that asserted literal YAML strings and were changed only to match the new repository conditions. These expectations duplicate configuration rather than exercise workflow behavior. Existing behavioral Node harness tests remain; untouched YAML assertions are outside this cleanup.

Validation on macOS arm64: the following command passed all 41 remaining tests in the three affected classes (0 failed, 0 skipped):

dotnet test --project tests/Infrastructure.Tests/Infrastructure.Tests.csproj --no-launch-profile -- --filter-class '*.BackportWorkflowTests' --filter-class '*.DeploymentTestCommandTests' --filter-class '*.ExtensionWorkflowTests' --filter-not-trait 'quarantined=true' --filter-not-trait 'outerloop=true'

git --no-pager diff --check also passed. These local tests do not validate GitHub Actions repository gating end to end.

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Ankit Jain (radical) · 2026-10-04T14:36:50Z

Copilot do we really need this on every job? Shouldn't it be on every workflow?

Copilot · 2026-10-04T14:39:56Z

Copilot do we really need this on every job? Shouldn't it be on every workflow?

GitHub Actions doesn’t support a workflow-level if; conditions are available on jobs and steps. A single gate job could be used as a dependency, but every runnable job would need to depend on it, and jobs using always() or reusable workflows need careful handling. The per-job checks are explicit and ensure each job is skipped before it consumes a runner or does work.

Ankit Jain (radical) · 2026-10-04T14:59:38Z

Copilot Don't modify the labeler workflows, those are being used as-is.

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Copilot · 2026-10-04T15:03:38Z

Copilot Don't modify the labeler workflows, those are being used as-is.

Reverted all labeler workflow changes to their pre-PR state in ae3b3a7.

github-actions · 2026-10-04T15:10:24Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20722

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20722"

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: radical <1472+radical@users.noreply.github.com>

…flows-to-microsoft-aspire # Conflicts: # .github/workflows/milestone-changelog.lock.yml Co-authored-by: radical <1472+radical@users.noreply.github.com>

Five workflow tests assert literal YAML conditions rather than behavior. Changing the repository guards requires rewriting those expectations without demonstrating that the workflows run correctly. Remove those five tests. Retain behavioral Node harness tests, untouched assertions, and shared helpers. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 401f795f-42c1-4ff5-929a-2b40840c86a6

github-actions · 2026-10-13T16:48:54Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-10-13T17:04:30Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-10-13T17:20:07Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Bring the PR up to current main while preserving its workflow repository guards. The merge resolves cleanly without additional product changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74ccba9f-30ce-4acd-ab34-cde9555081fb

github-actions · 2026-10-14T16:27:03Z

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching '.github/workflows/run-tests.yml' selects ALL

Selection computed for commit ae7ec0b.

github-actions · 2026-10-14T17:01:42Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Copilot AI and others added 6 commits October 4, 2026 03:27

Gate manually triggered workflows

c9a9a98

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Constrain workflow repository guards

c560928

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Guard reusable workflows against fork callers

a8e7754

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Gate remaining workflow jobs

421659b

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Limit GitHub Actions token permissions

259dd50

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Run pull-label polling in source repo

d4acedb

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Copilot AI assigned Copilot and Ankit Jain (radical) Oct 4, 2026

Copilot created this pull request from a session on behalf of Ankit Jain (radical) October 4, 2026 14:35

View session

Copilot started work on behalf of Ankit Jain (radical) October 4, 2026 14:37

View session

Copilot finished work on behalf of Ankit Jain (radical) October 4, 2026 14:40

Copilot AI requested a review from Ankit Jain (radical) October 4, 2026 14:40

Copilot started work on behalf of Ankit Jain (radical) October 4, 2026 15:00

View session

Restore labeler workflow changes

ae3b3a7

Co-authored-by: radical <1472+radical@users.noreply.github.com>

Copilot finished work on behalf of Ankit Jain (radical) October 4, 2026 15:03

github-advanced-security Bot found potential problems Oct 4, 2026

View reviewed changes

Comment thread .github/workflows/polyglot-validation.yml Fixed

github-actions Bot mentioned this pull request Oct 4, 2026

[repo-pulse] Daily Report #16404

Open

Ankit Jain (radical) mentioned this pull request Oct 4, 2026

[automated] CI Shepherd state for the bounded upstream PR trial radical/aspire#127

Open

Ankit Jain (radical) added shepherd-adopted [automated] CI Shepherd may drive this item within the bounded trial. and removed shepherd-adopted [automated] CI Shepherd may drive this item within the bounded trial. labels Oct 4, 2026

Copilot started work on behalf of Ankit Jain (radical) October 5, 2026 17:15

View session

Fix workflow validation guards

64795c4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: radical <1472+radical@users.noreply.github.com>

Copilot finished work on behalf of Ankit Jain (radical) October 5, 2026 17:25

Ankit Jain (radical) removed the shepherd-adopted [automated] CI Shepherd may drive this item within the bounded trial. label Oct 5, 2026

Merge remote-tracking branch 'origin/main' into copilot/restrict-work…

5adfa59

…flows-to-microsoft-aspire # Conflicts: # .github/workflows/milestone-changelog.lock.yml Co-authored-by: radical <1472+radical@users.noreply.github.com>

Copilot finished work on behalf of Ankit Jain (radical) October 10, 2026 05:55

This comment has been minimized.

Sign in to view

Eric Erhardt (eerhardt) approved these changes Oct 13, 2026

View reviewed changes

Ankit Jain (radical) enabled auto-merge (squash) October 13, 2026 16:31

Copilot started work to fix failing Actions workflow(s) on behalf of Ankit Jain (radical) October 13, 2026 16:49

View session

Copilot finished work on behalf of Ankit Jain (radical) October 13, 2026 16:54

Copilot started work to fix failing Actions workflow(s) on behalf of Ankit Jain (radical) October 13, 2026 17:05

View session

Copilot finished work on behalf of Ankit Jain (radical) October 13, 2026 17:08

Copilot started work to fix failing Actions workflow(s) on behalf of Ankit Jain (radical) October 13, 2026 17:21

View session

Copilot finished work on behalf of Ankit Jain (radical) October 13, 2026 17:24

Copilot started work to fix failing Actions workflow(s) on behalf of Ankit Jain (radical) October 13, 2026 17:45

View session

Copilot finished work on behalf of Ankit Jain (radical) October 13, 2026 17:50

Copilot started work to fix failing Actions workflow(s) on behalf of Ankit Jain (radical) October 13, 2026 17:59

View session

Copilot finished work on behalf of Ankit Jain (radical) October 13, 2026 18:03

Ankit Jain (radical) mentioned this pull request Oct 13, 2026

[automated] [Failing test]: KubernetesServiceTests.CreateAsync_RecoveryBudgetIncludesConfirmationRetryDelay fails on Windows #20968

Open

1 task done

Copilot AI mentioned this pull request Oct 13, 2026

Stabilize Kubernetes create-recovery retry-delay tests #20971

Open

4 of 14 tasks

Ankit Jain (radical) unassigned Copilot Oct 14, 2026

Copilot started work to fix failing Actions workflow(s) on behalf of Ankit Jain (radical) October 14, 2026 17:02

View session

Copilot finished work on behalf of Ankit Jain (radical) October 14, 2026 17:06

Ankit Jain (radical) merged commit 6bcd030 into main Oct 14, 2026
869 of 872 checks passed

microsoft-github-policy-service Bot added this to the 17.0 milestone Oct 14, 2026

Ankit Jain (radical) mentioned this pull request Oct 15, 2026

Tracking: Make Aspire CI reliable, actionable, and efficient #18036

Open

Navigation Menu

Repository navigation

Restrict GitHub workflows to microsoft/aspire - #20722

Restrict GitHub workflows to microsoft/aspire#20722
Ankit Jain (radical) merged 14 commits into
mainfrom
copilot/restrict-workflows-to-microsoft-aspire

Copilot AI commented Oct 4, 2026 •

edited by radical

Loading

Uh oh!

Ankit Jain (radical) commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

Ankit Jain (radical) commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Oct 4, 2026 • edited by radical Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

Ankit Jain (radical) commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

Ankit Jain (radical) commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Tests selector

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 4, 2026 •

edited by radical

Loading