ci: harden trusted test handoff

Derive PR metadata from GitHub, reject fork builds on shared runners, validate private artifact provenance, and require every rendered LAVA result.

Generated-by: GitHub Copilot (GPT-5.6 Sol, gpt-5.6-sol)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: koenkooi

.github/workflows/Readme.md

@@ -4,7 +4,7 @@ The repository runs policy checks, standalone OpenEmbedded builds and one hardwa
 
 ## Build flow
 
-`pr.yml` and `push.yml` call `build-openembedded.yml`. Build jobs use the `[self-hosted, qcom-u2404, amd64]` project runner pool and reuse `/efs/qli/meta-qcom/downloads` and `/efs/qli/meta-qcom/sstate-cache`. Each job has an isolated temporary build directory; only the OpenEmbedded downloads and sstate caches are shared.
+`pr.yml` and `push.yml` call `build-openembedded.yml`. Build jobs use the `[self-hosted, qcom-u2404, amd64]` project runner pool and reuse `/efs/qli/meta-qcom/downloads` and `/efs/qli/meta-qcom/sstate-cache`. Each job has an isolated temporary build directory; only the OpenEmbedded downloads and sstate caches are shared. Pull requests from forks are rejected because untrusted fork code must not execute on credential-bearing self-hosted runners or write to shared caches; a maintainer must reproduce the change on a repository branch.
 
 The standalone matrix builds every recipe in this layer for `qemuarm`, `qemuarm64` and `qemux86-64` with `DISTRO = "nodistro"`. The RB3 Gen 2 job combines the checked-out meta-ai revision with meta-qcom and meta-qcom-distro, installs the AI runtime packages into `qcom-multimedia-image`, and reuses meta-qcom's compile and private artifact actions.
 
@@ -14,7 +14,7 @@ Kas and cross-repository actions are pinned to reviewed commits. Kas lockfiles p
 
 ## LAVA flow
 
-`test-pr.yml` runs from the default branch after `Build on PR` completes. The pull request build has no LAVA or reporting credentials; the trusted `workflow_run` downloads the original event and build URL artifacts without executing pull request code. It passes only `LAVATOKEN` to `test.yml` and only `TEST_REPORTING_APP_TOKEN` to `publish-results.yml`.
+`test-pr.yml` runs from the default branch after `Build on PR` completes. The pull request build has no LAVA or reporting credentials. The trusted `workflow_run` resolves pull request metadata through the GitHub API, creates its own event artifact, and accepts only a build URL matching the triggering repository, run ID and attempt. It passes only `LAVATOKEN` to `test.yml` and only `TEST_REPORTING_APP_TOKEN` to `publish-results.yml`.
 
 `test.yml` reuses meta-qcom's pinned LAVA-plan and result-summary actions. It boots the RB3 Gen 2 image first, then runs the pinned meta-qcom-distro pre-merge plan. Matrix failures are recorded individually and collapsed into explicit required results, so a skipped or incomplete test cannot appear successful.
 

.github/workflows/pr.yml

@@ -14,16 +14,16 @@ permissions:
   contents: read
 
 jobs:
-  event-file:
-    name: "Upload event file"
+  fork-policy:
+    name: Fork build policy
+    if: github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
     steps:
-      - name: Upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: Event File
-          path: ${{ github.event_path }}
-          if-no-files-found: error
+      - name: Require a repository branch
+        run: |
+          echo "OpenEmbedded builds do not execute fork code on Qualcomm self-hosted runners."
+          echo "A maintainer must reproduce the change on a branch in ${GITHUB_REPOSITORY}."
+          exit 1
 
   pr-to-workflow-dependency:
     name: "PR to workflow dependency"
@@ -38,6 +38,7 @@ jobs:
       pr_number: ${{ github.event.pull_request.number }}
 
   build-pr:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       actions: read
       contents: read

.github/workflows/test-openembedded-distro.yml

@@ -59,6 +59,7 @@ jobs:
       contents: read
     outputs:
       artifact_id: ${{ steps.lava-test-plans.outputs.artifact_id }}
+      job_count: ${{ steps.require-jobs.outputs.job_count }}
       jobmatrix: ${{ steps.lava-test-plans.outputs.jobmatrix }}
     steps:
       - name: Render boot jobs
@@ -78,13 +79,16 @@ jobs:
           pr_url: ${{ inputs.pr_url }}
 
       - name: Require rendered boot jobs
+        id: require-jobs
         env:
           ARTIFACT_ID: ${{ steps.lava-test-plans.outputs.artifact_id }}
           JOB_MATRIX: ${{ steps.lava-test-plans.outputs.jobmatrix }}
         run: |
           test -n "$ARTIFACT_ID"
           test -n "$JOB_MATRIX"
-          test "$(jq '.target | length' <<< "$JOB_MATRIX")" -gt 0
+          JOB_COUNT=$(jq '.target | length' <<< "$JOB_MATRIX")
+          test "$JOB_COUNT" -gt 0
+          echo "job_count=$JOB_COUNT" >> "$GITHUB_OUTPUT"
 
   submit-boot-job:
     name: Boot ${{ matrix.target.name }}
@@ -121,14 +125,14 @@ jobs:
         uses: qualcomm-linux/github-action-matrix-outputs-write@59fdd8db9c91b623ec1111b9c081435b1533f529 # v3
         with:
           matrix-step-name: submit-boot-job-${{ inputs.distro_name }}
-          matrix-key: ${{ matrix.target.name }}-${{ inputs.distro_name }}
-          artifact-name: submit-boot-job-${{ inputs.distro_name }}-${{ matrix.target.name }}
+          matrix-key: ${{ matrix.target.result_file }}
+          artifact-name: submit-boot-job-${{ inputs.distro_name }}-${{ matrix.target.result_file }}
           outputs: |
             result: ${{ steps.submit.outcome }}
 
   boot-job-result:
     name: Require boot jobs
-    needs: submit-boot-job
+    needs: [prepare-boot-jobs, submit-boot-job]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -149,6 +153,7 @@ jobs:
       - name: Require successful boot jobs
         id: result
         env:
+          EXPECTED_RESULTS: ${{ needs.prepare-boot-jobs.outputs.job_count }}
           MATRIX_RESULTS: ${{ steps.matrix.outputs.result }}
         run: |
           ci/assert-matrix-results.py
@@ -164,6 +169,7 @@ jobs:
       contents: read
     outputs:
       artifact_id: ${{ steps.lava-test-plans.outputs.artifact_id }}
+      job_count: ${{ steps.require-jobs.outputs.job_count }}
       jobmatrix: ${{ steps.lava-test-plans.outputs.jobmatrix }}
     steps:
       - name: Render pre-merge jobs
@@ -183,13 +189,16 @@ jobs:
           pr_url: ${{ inputs.pr_url }}
 
       - name: Require rendered pre-merge jobs
+        id: require-jobs
         env:
           ARTIFACT_ID: ${{ steps.lava-test-plans.outputs.artifact_id }}
           JOB_MATRIX: ${{ steps.lava-test-plans.outputs.jobmatrix }}
         run: |
           test -n "$ARTIFACT_ID"
           test -n "$JOB_MATRIX"
-          test "$(jq '.target | length' <<< "$JOB_MATRIX")" -gt 0
+          JOB_COUNT=$(jq '.target | length' <<< "$JOB_MATRIX")
+          test "$JOB_COUNT" -gt 0
+          echo "job_count=$JOB_COUNT" >> "$GITHUB_OUTPUT"
 
   submit-premerge-job:
     name: Pre-merge ${{ matrix.target.name }}
@@ -226,14 +235,14 @@ jobs:
         uses: qualcomm-linux/github-action-matrix-outputs-write@59fdd8db9c91b623ec1111b9c081435b1533f529 # v3
         with:
           matrix-step-name: submit-premerge-job-${{ inputs.distro_name }}
-          matrix-key: ${{ matrix.target.name }}-${{ inputs.distro_name }}
-          artifact-name: submit-premerge-job-${{ inputs.distro_name }}-${{ matrix.target.name }}
+          matrix-key: ${{ matrix.target.result_file }}
+          artifact-name: submit-premerge-job-${{ inputs.distro_name }}-${{ matrix.target.result_file }}
           outputs: |
             result: ${{ steps.submit.outcome }}
 
   premerge-job-result:
     name: Require pre-merge jobs
-    needs: submit-premerge-job
+    needs: [prepare-premerge-jobs, submit-premerge-job]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -251,6 +260,7 @@ jobs:
 
       - name: Require successful pre-merge jobs
         env:
+          EXPECTED_RESULTS: ${{ needs.prepare-premerge-jobs.outputs.job_count }}
           MATRIX_RESULTS: ${{ steps.matrix.outputs.result }}
         run: ci/assert-matrix-results.py
 

.github/workflows/test-pr.yml

@@ -2,8 +2,9 @@ name: Test PR build
 run-name: "LAVA: ${{ github.event.workflow_run.display_title }}"
 
 on:
-  # The build executes PR code without LAVA or reporting secrets. This trusted
-  # base-branch workflow consumes only its event and build URL artifacts.
+  # The build executes repository-branch PR code without LAVA or reporting
+  # secrets. This trusted base-branch workflow derives metadata from GitHub and
+  # accepts only the triggering run's expected private artifact URL.
   workflow_run: # zizmor: ignore[dangerous-triggers]
     workflows: ["Build on PR"]
     types: [completed]
@@ -32,21 +33,66 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Download originating event
+      - name: Query matching pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }}
+        run: |
+          HEAD_OWNER=${HEAD_REPOSITORY%%/*}
+          gh api \
+            --method GET \
+            "repos/${GITHUB_REPOSITORY}/pulls" \
+            -f state=open \
+            -f "head=${HEAD_OWNER}:${HEAD_BRANCH}" > pulls.json
+
+      - name: Resolve pull request
+        id: event
+        env:
+          EXPECTED_BASE_REPOSITORY: ${{ github.repository }}
+          EXPECTED_HEAD_REF: ${{ github.event.workflow_run.head_branch }}
+          EXPECTED_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }}
+          EXPECTED_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: ci/resolve-pr-event.py pulls.json trusted-event/event.json
+
+      - name: Upload trusted event
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: Trusted Event File
+          path: trusted-event/event.json
+          if-no-files-found: error
+
+  validate-build-artifact:
+    name: Validate build artifact
+    needs: determine-target
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Download hardware build URL
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: Event File
-          path: originating-event
+          name: build-url_rb3gen2-core-kit_qcom-distro
+          path: validated-build
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ github.token }}
 
-      - name: Resolve pull request
-        id: event
-        run: ci/resolve-pr-event.py originating-event/event.json
+      - name: Require this run's private artifact URL
+        env:
+          EXPECTED_URL: https://qli-prod-artifacts.qualcomm.com/qcom-prd-gh-artifacts/${{ github.repository }}/${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
+        run: |
+          ci/validate-build-url.py \
+            validated-build/build-url_rb3gen2-core-kit_qcom-distro \
+            "$EXPECTED_URL"
 
   test:
     name: Run LAVA tests
-    needs: determine-target
+    needs: [determine-target, validate-build-artifact]
     if: github.event.workflow_run.conclusion == 'success' && needs.determine-target.outputs.branch == 'main'
     permissions:
       actions: read
@@ -110,13 +156,13 @@ jobs:
       TEST_REPORTING_APP_TOKEN: ${{ secrets.TEST_REPORTING_APP_TOKEN }}
     with:
       commit: ${{ needs.determine-target.outputs.head_sha }}
-      event_file: artifacts/Event File/event.json
+      event_file: artifacts/Trusted Event File/event.json
       event_name: pull_request
       workflow_id: ${{ github.event.workflow_run.id }}
 
   test-pr-successful:
     name: PR LAVA successful
-    needs: [determine-target, test, comment, publish]
+    needs: [determine-target, validate-build-artifact, test, comment, publish]
     if: always()
     runs-on: ubuntu-latest
     permissions:
@@ -132,9 +178,11 @@ jobs:
           DETERMINE_RESULT: ${{ needs.determine-target.result }}
           PUBLISH_RESULT: ${{ needs.publish.result }}
           TEST_RESULT: ${{ needs.test.result }}
+          VALIDATE_RESULT: ${{ needs.validate-build-artifact.result }}
         run: |
           ci/assert-job-results.sh \
             "determine-target=${DETERMINE_RESULT}" \
+            "validate-build-artifact=${VALIDATE_RESULT}" \
             "test=${TEST_RESULT}" \
             "comment=${COMMENT_RESULT}" \
             "publish=${PUBLISH_RESULT}"

ci/assert-matrix-results.py

@@ -19,10 +19,29 @@ def main() -> int:
         print(f"MATRIX_RESULTS is not valid JSON: {error}", file=sys.stderr)
         return 1
 
-    if not isinstance(results, dict) or not results:
+    if not isinstance(results, dict) or not isinstance(results.get("result"), dict):
+        print("MATRIX_RESULTS must contain a result object.", file=sys.stderr)
+        return 1
+
+    results = results["result"]
+    if not results:
         print("MATRIX_RESULTS must contain at least one job result.", file=sys.stderr)
         return 1
 
+    expected_results = os.environ.get("EXPECTED_RESULTS", "")
+    if expected_results:
+        try:
+            expected_count = int(expected_results)
+        except ValueError:
+            print("EXPECTED_RESULTS must be an integer.", file=sys.stderr)
+            return 1
+        if len(results) != expected_count:
+            print(
+                f"Expected {expected_count} matrix results, received {len(results)}.",
+                file=sys.stderr,
+            )
+            return 1
+
     failed = False
     for job, result in sorted(results.items()):
         if result != "success":

ci/oe-check-layer.sh

@@ -33,4 +33,5 @@ exec yocto-check-layer \
     meta-ai \
     --no-auto \
     --dependency "$WORK_DIR/oe-core/meta" \
+    --dependency "$WORK_DIR/meta-openembedded/meta-oe" \
     --no-auto-dependency

ci/resolve-pr-event.py

@@ -9,23 +9,44 @@
 
 
 def main() -> int:
-    if len(sys.argv) != 2:
-        print(f"Usage: {sys.argv[0]} EVENT_FILE", file=sys.stderr)
+    if len(sys.argv) != 3:
+        print(f"Usage: {sys.argv[0]} PULLS_FILE TRUSTED_EVENT_FILE", file=sys.stderr)
         return 1
 
     output_path = os.environ.get("GITHUB_OUTPUT")
     if not output_path:
         print("GITHUB_OUTPUT is empty.", file=sys.stderr)
         return 1
 
-    with open(sys.argv[1], encoding="utf-8") as event_file:
-        event = json.load(event_file)
+    expected = {
+        "base_repository": os.environ.get("EXPECTED_BASE_REPOSITORY", ""),
+        "head_ref": os.environ.get("EXPECTED_HEAD_REF", ""),
+        "head_repository": os.environ.get("EXPECTED_HEAD_REPOSITORY", ""),
+        "head_sha": os.environ.get("EXPECTED_HEAD_SHA", ""),
+    }
+    if not all(expected.values()):
+        print("Expected workflow_run metadata is incomplete.", file=sys.stderr)
+        return 1
 
-    pull_request = event.get("pull_request")
-    if not isinstance(pull_request, dict):
-        print("The event does not contain a pull_request object.", file=sys.stderr)
+    with open(sys.argv[1], encoding="utf-8") as pulls_file:
+        pulls = json.load(pulls_file)
+
+    matching_pulls = [
+        pull
+        for pull in pulls
+        if pull["base"]["repo"]["full_name"] == expected["base_repository"]
+        and pull["head"]["ref"] == expected["head_ref"]
+        and pull["head"]["repo"]["full_name"] == expected["head_repository"]
+        and pull["head"]["sha"] == expected["head_sha"]
+    ]
+    if len(matching_pulls) != 1:
+        print(
+            f"Expected one pull request matching the workflow run, found {len(matching_pulls)}.",
+            file=sys.stderr,
+        )
         return 1
 
+    pull_request = matching_pulls[0]
     values = {
         "branch": pull_request["base"]["ref"],
         "head_sha": pull_request["head"]["sha"],
@@ -40,6 +61,16 @@ def main() -> int:
                 return 1
             output.write(f"{name}={value}\n")
 
+    trusted_event_path = Path(sys.argv[2])
+    trusted_event_path.parent.mkdir(parents=True, exist_ok=True)
+    trusted_event_path.write_text(
+        json.dumps(
+            {"number": pull_request["number"], "pull_request": pull_request},
+            separators=(",", ":"),
+        ),
+        encoding="utf-8",
+    )
+
     return 0