Commit cff268ff4a for openssl.org
commit cff268ff4a82c861e32ee93082adc4a50831e037
Author: Igor Ustinov <igus@openssl.foundation>
Date: Tue Aug 11 16:50:47 2026 +0200
CI: allow manual workflow_dispatch runs from forks
Several scheduled workflows offer a workflow_dispatch trigger but gate
their jobs on `github.repository == 'openssl/openssl'`. That guard is
meant to stop the nightly cron from running in forks, but it also blocks
manual dispatch there, making the workflow_dispatch trigger useless in
exactly the place it is most needed.
Let a manual dispatch bypass the repository check so a fork owner can run
these workflows on demand, while scheduled runs stay restricted to the
main repository.
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Fri Oct 30 14:12:26 2026
Merged-from: https://github.com/openssl/openssl/pull/32318
diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml
index b84c97819e..23f077af5d 100644
--- a/.github/workflows/coveralls.yml
+++ b/.github/workflows/coveralls.yml
@@ -67,7 +67,7 @@ jobs:
echo "branches<<EOF"$'\n'"$MATRIX"$'\n'EOF >> "$GITHUB_OUTPUT"
coverage:
- if: github.repository == 'openssl/openssl'
+ if: github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch'
needs: define-matrix
permissions:
checks: write # for coverallsapp/github-action to create new checks
diff --git a/.github/workflows/ct-validation-daily.yml b/.github/workflows/ct-validation-daily.yml
index 027e2054a8..8402194d06 100644
--- a/.github/workflows/ct-validation-daily.yml
+++ b/.github/workflows/ct-validation-daily.yml
@@ -69,7 +69,7 @@ permissions:
jobs:
validate-dispatch-inputs:
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
(inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != '')
uses: ./.github/workflows/validate-dispatch-inputs.yml
with:
diff --git a/.github/workflows/interop-tests.yml b/.github/workflows/interop-tests.yml
index ac514d1f70..971a57969e 100644
--- a/.github/workflows/interop-tests.yml
+++ b/.github/workflows/interop-tests.yml
@@ -37,7 +37,7 @@ jobs:
# Only a dispatch carries inputs, so this is skipped on the nightly cron.
validate-dispatch-inputs:
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
(inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != '')
uses: ./.github/workflows/validate-dispatch-inputs.yml
with:
@@ -48,7 +48,7 @@ jobs:
test:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
permissions:
@@ -104,7 +104,7 @@ jobs:
openssh_interop:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
inputs.pr == '' &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
diff --git a/.github/workflows/os-zoo-rolling.yml b/.github/workflows/os-zoo-rolling.yml
index 2ae90743ab..c3cc8f6a5b 100644
--- a/.github/workflows/os-zoo-rolling.yml
+++ b/.github/workflows/os-zoo-rolling.yml
@@ -40,7 +40,7 @@ jobs:
# Only a dispatch carries inputs, so this is skipped on the nightly cron.
validate-dispatch-inputs:
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
(inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != '')
uses: ./.github/workflows/validate-dispatch-inputs.yml
with:
@@ -49,7 +49,7 @@ jobs:
check_run_id: ${{ inputs.check_run_id }}
alpine:
- if: github.repository == 'openssl/openssl'
+ if: github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch'
strategy:
fail-fast: false
matrix:
@@ -88,7 +88,7 @@ jobs:
run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
linux:
- if: github.repository == 'openssl/openssl'
+ if: github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch'
strategy:
fail-fast: false
matrix:
diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml
index 275d565fbf..232ab9380f 100644
--- a/.github/workflows/os-zoo.yml
+++ b/.github/workflows/os-zoo.yml
@@ -41,7 +41,7 @@ jobs:
# Only a dispatch carries inputs, so this is skipped on the nightly cron.
validate-dispatch-inputs:
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
(inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != '')
uses: ./.github/workflows/validate-dispatch-inputs.yml
with:
@@ -52,7 +52,7 @@ jobs:
alpine:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -95,7 +95,7 @@ jobs:
linux:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -178,7 +178,7 @@ jobs:
macos:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -209,7 +209,7 @@ jobs:
windows:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -336,7 +336,7 @@ jobs:
linux-arm64:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-24.04-arm
@@ -359,7 +359,7 @@ jobs:
linux-x86:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -406,6 +406,8 @@ jobs:
linux-ppc64le:
runs-on: linux-ppc64le
needs: [validate-dispatch-inputs]
+ # Self-hosted runner; its label only exists in openssl/openssl, so keep
+ # this job out of forks (a manual dispatch there would hang forever).
if: |
github.repository == 'openssl/openssl' &&
( github.event_name == 'schedule' ||
@@ -433,6 +435,8 @@ jobs:
linux-s390x:
runs-on: linux-s390x
needs: [validate-dispatch-inputs]
+ # Self-hosted runner; its label only exists in openssl/openssl, so keep
+ # this job out of forks (a manual dispatch there would hang forever).
if: |
github.repository == 'openssl/openssl' &&
( github.event_name == 'schedule' ||
@@ -460,6 +464,8 @@ jobs:
linux-riscv64:
runs-on: linux-riscv64
needs: [validate-dispatch-inputs]
+ # Self-hosted runner; its label only exists in openssl/openssl, so keep
+ # this job out of forks (a manual dispatch there would hang forever).
if: |
github.repository == 'openssl/openssl' &&
( github.event_name == 'schedule' ||
@@ -488,7 +494,7 @@ jobs:
runs-on: ubuntu-latest
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
steps:
@@ -532,7 +538,7 @@ jobs:
runs-on: ubuntu-latest
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
steps:
diff --git a/.github/workflows/provider-compatibility.yml b/.github/workflows/provider-compatibility.yml
index 11105e49b8..646c834c7a 100644
--- a/.github/workflows/provider-compatibility.yml
+++ b/.github/workflows/provider-compatibility.yml
@@ -28,7 +28,7 @@ env:
jobs:
fips-releases:
- if: github.repository == 'openssl/openssl'
+ if: github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch'
strategy:
matrix:
release: [
@@ -104,7 +104,7 @@ jobs:
retention-days: 7
development-branches:
- if: github.repository == 'openssl/openssl'
+ if: github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch'
strategy:
matrix:
branch: [
@@ -196,7 +196,7 @@ jobs:
retention-days: 7
cross-testing:
- if: github.repository == 'openssl/openssl'
+ if: github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch'
needs: [fips-releases, development-branches]
runs-on: ubuntu-latest
strategy:
diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml
index 6ea8dc0ec1..c0df6f34bd 100644
--- a/.github/workflows/run-checker-daily.yml
+++ b/.github/workflows/run-checker-daily.yml
@@ -41,7 +41,7 @@ permissions:
jobs:
validate-dispatch-inputs:
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
(inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != '')
uses: ./.github/workflows/validate-dispatch-inputs.yml
with:
@@ -52,7 +52,7 @@ jobs:
run-checker:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -197,7 +197,7 @@ jobs:
run-checker-sctp:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -244,7 +244,7 @@ jobs:
enable_brotli_dynamic:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -274,7 +274,7 @@ jobs:
enable_zstd_dynamic:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -304,7 +304,7 @@ jobs:
enable_brotli_and_zstd_dynamic:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -335,7 +335,7 @@ jobs:
malloc_failure_testing:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -365,7 +365,7 @@ jobs:
enable_brotli_and_asan_ubsan:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -399,7 +399,7 @@ jobs:
enable_zstd_and_asan_ubsan:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -433,7 +433,7 @@ jobs:
enable_tfo:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
strategy:
@@ -459,7 +459,7 @@ jobs:
enable_buildtest:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest
@@ -484,7 +484,7 @@ jobs:
memory_sanitizer_slh_dsa:
needs: [validate-dispatch-inputs]
if: |
- github.repository == 'openssl/openssl' &&
+ (github.repository == 'openssl/openssl' || github.event_name == 'workflow_dispatch') &&
!cancelled() &&
(needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
runs-on: ubuntu-latest