From 348644a48a87f27b4e2f0b9e3d768336b434f7ed Mon Sep 17 00:00:00 2001 From: Jos Rothman Date: Thu, 5 Nov 2026 19:49:09 +0100 Subject: [PATCH] CI: drop the pull_request trigger The self-hosted runner allows privileged containers; a fork's pull request could otherwise run its own workflow with root on that machine. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cfd5b64..51a6151 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,9 +1,11 @@ name: CI +# Only pushes to this repository, no pull_request: the runner allows privileged +# containers, and a pull request from a fork could otherwise run its own +# workflow with root access on the runner machine. on: push: branches: ["**"] - pull_request: jobs: test-bookworm: