feat: pre job fork check

.github/workflows/test_github_runner_manager.yaml

@@ -4,10 +4,47 @@ on:
   pull_request:
 
 jobs:
-  unit-tests-github-runner-manager:
+  application-unit-tests:
+    name: Unit tests for github-runner-manager
     uses: canonical/operator-workflows/.github/workflows/test.yaml@main
     secrets: inherit
     with:
       self-hosted-runner: true
       self-hosted-runner-label: edge
       working-directory: ./github-runner-manager/
+  application-integration-tests:
+    name: Integration tests for github-runner-manager
+    runs-on: [self-hosted, pfe-ci]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.1
+      - name: Setup Astral UV
+        uses: astral-sh/setup-uv@v7
+      - name: Install tox with UV
+        run: uv tool install tox --with tox-uv
+      - name: Run integration tests
+        working-directory: ./github-runner-manager/
+        env:
+          # GitHub configuration
+          INTEGRATION_TOKEN: ${{ secrets.INTEGRATION_TEST_SECRET_ENV_VALUE_1 }}
+          INTEGRATION_TOKEN_ALT: ${{ secrets.INTEGRATION_TEST_SECRET_ENV_VALUE_2 }}
+          # OpenStack configuration
+          OS_AUTH_URL: ${{ vars.INTEGRATION_TEST_OPENSTACK_AUTH_URL }}
+          OS_PROJECT_DOMAIN_NAME: ${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_DOMAIN_NAME }}
+          OS_PROJECT_NAME: ${{ vars.INTEGRATION_TEST_OPENSTACK_PROJECT_NAME }}
+          OS_USER_DOMAIN_NAME: ${{ vars.INTEGRATION_TEST_OPENSTACK_USER_DOMAIN_NAME }}
+          OS_USERNAME: ${{ vars.INTEGRATION_TEST_OPENSTACK_USERNAME }}
+          OS_PASSWORD: ${{ secrets.INTEGRATION_TEST_SECRET_ENV_VALUE_3 }}
+          OS_NETWORK: ${{ vars.INTEGRATION_TEST_OPENSTACK_NETWORK_NAME }}
+          OS_REGION_NAME: ${{ vars.INTEGRATION_TEST_OPENSTACK_REGION_NAME }}
+        run: |
+          tox -e integration -- -v --tb=native -s \
+            --github-repository=${{ vars.INTEGRATION_TEST_PATH_2 }} \
+            --https-proxy="${{ vars.INTEGRATION_TEST_HTTPS_PROXY }}" \
+            --http-proxy="${{ vars.INTEGRATION_TEST_HTTP_PROXY }}" \
+            --no-proxy="${{ vars.INTEGRATION_TEST_NO_PROXY }}" \
+            --openstack-https-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTPS_PROXY }}" \
+            --openstack-http-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_HTTP_PROXY }}" \
+            --openstack-no-proxy="${{ vars.INTEGRATION_TEST_OPENSTACK_NO_PROXY }}" \
+            --openstack-flavor="${{ vars.INTEGRATION_TEST_OPENSTACK_FLAVOR_NAME }}" \
+            --openstack-image-id="${{ vars.INTEGRATION_TEST_IMAGE_ID }}"

config.yaml

@@ -88,15 +88,26 @@ options:
   repo-policy-compliance-token:
     type: string
     description: >-
+      DEPRECATED, please use allow-external-contributor configuration option instead.
       The token to authenticate with the repository-policy-compliance service in order to
       generate one-time-tokens. This option requires the repo-policy-compliance-url to be set.
       If not set, the repository-policy-compliance service will not be used.
   repo-policy-compliance-url:
     type: string
     description: >-
+      DEPRECATED, please use allow-external-contributor configuration option instead
       The URL to the repository-policy-compliance service. This option requires the
       repo-policy-compliance-token to be set. If not set, the repository-policy-compliance service
       will not be used. This option is only supported when using OpenStack Cloud.
+  allow-external-contributor:
+    type: boolean
+    default: True
+    description: >-
+      EXPERIMENTAL
+      Whether to allow runs from forked repository from an external contributor. Enabling this
+      option will enable all runs from forked repositories. By default, runs from contribution
+      authors being in COLLABORATOR, MEMBER or OWNER status is allowed. See
+      https://docs.github.com/en/graphql/reference/enums#commentauthorassociation.
   test-mode:
     type: string
     description: >-

docs/changelog.md

@@ -6,6 +6,11 @@ This changelog documents user-relevant changes to the GitHub runner charm.
 
 - Added timeouts to API calls (Openstack,GitHub,Repo policy compliance) to fix a hanging GitHub runner manager application. 
 
+## 2025-11-30
+
+- Added a new configuration option `allow-external-contributor` as an non-external replacement for
+  `repo-policy-compliance` service.
+
 ## 2025-11-21
 
 - Updated broken links in `docs/how-to/index.md`.

github-runner-manager/pyproject.toml

@@ -3,7 +3,7 @@
 
 [project]
 name = "github-runner-manager"
-version = "0.7.0"
+version = "0.8.0"
 authors = [
     { name = "Canonical IS DevOps", email = "is-devops-team@canonical.com" },
 ]

github-runner-manager/src/github_runner_manager/configuration/base.py

@@ -38,6 +38,11 @@ class ApplicationConfiguration(BaseModel):
     """Main entry point for the Application Configuration.
 
     Attributes:
+        allow_external_contributor: Whether to allow runs from forked repository from an external
+            contributor. Enabling this option will enable all runs from forked repositories. By
+            default, runs from contribution authors being in COLLABORATOR, MEMBER or OWNER status
+            is allowed. See \
+            https://docs.github.com/en/graphql/reference/enums#commentauthorassociation.
         name: Name to identify the manager. Used for metrics.
         extra_labels: Extra labels to add to the runner.
         github_config: GitHub configuration.
@@ -48,6 +53,7 @@ class ApplicationConfiguration(BaseModel):
         reconcile_interval: Seconds to wait between reconciliation.
     """
 
+    allow_external_contributor: bool = False
     name: str
     extra_labels: list[str]
     github_config: github.GitHubConfiguration | None

github-runner-manager/src/github_runner_manager/manager/runner_scaler.py

@@ -136,6 +136,7 @@ def build(  # pylint: disable-msg=too-many-locals
             base_quantity = combination.base_virtual_machines
 
         openstack_runner_manager_config = OpenStackRunnerManagerConfig(
+            allow_external_contributor=application_configuration.allow_external_contributor,
             prefix=application_configuration.openstack_configuration.vm_prefix,
             credentials=application_configuration.openstack_configuration.credentials,
             server_config=server_config,

github-runner-manager/src/github_runner_manager/metrics/events.py

@@ -3,6 +3,7 @@
 
 """Models and functions for the metric events."""
 import logging
+import os
 from pathlib import Path
 from typing import Any, Optional
 
@@ -11,7 +12,7 @@
 from github_runner_manager.errors import IssueMetricEventError
 from github_runner_manager.manager.vm_manager import CodeInformation
 
-METRICS_LOG_PATH = Path("/var/log/github-runner-metrics.log")
+METRICS_LOG_PATH = Path(os.getenv("METRICS_LOG_PATH", "/var/log/github-runner-metrics.log"))
 
 
 logger = logging.getLogger(__name__)

github-runner-manager/src/github_runner_manager/openstack_cloud/models.py

@@ -29,12 +29,15 @@ class OpenStackRunnerManagerConfig:
     """Configuration for OpenStack runner manager.
 
     Attributes:
+        allow_external_contributor: Whether to allow runs from forked repository from an external
+            contributor.
         prefix: The prefix of the runner names.
         credentials: The OpenStack authorization information.
         server_config: The configuration for OpenStack server.
         service_config: The configuration for supporting services.
     """
 
+    allow_external_contributor: bool
     prefix: str
     credentials: OpenStackCredentials
     server_config: OpenStackServerConfig | None

github-runner-manager/src/github_runner_manager/openstack_cloud/openstack_runner_manager.py

@@ -182,6 +182,7 @@ def _generate_cloud_init(self, runner_context: RunnerContext) -> str:
             "metrics_exchange_path": str(METRICS_EXCHANGE_PATH),
             "do_repo_policy_check": False,
             "custom_pre_job_script": service_config.custom_pre_job_script,
+            "allow_external_contributor": self._config.allow_external_contributor,
         }
         repo_policy = self._get_repo_policy_compliance_client()
         if repo_policy is not None:
@@ -196,7 +197,10 @@ def _generate_cloud_init(self, runner_context: RunnerContext) -> str:
         pre_job_contents = jinja.get_template("pre-job.j2").render(pre_job_contents_dict)
 
         use_aproxy = service_config.use_aproxy
-        if not service_config.runner_proxy_config.proxy_address:
+        if (
+            not service_config.runner_proxy_config
+            or not service_config.runner_proxy_config.proxy_address
+        ):
             use_aproxy = False
         aproxy_redirect_ports = service_config.aproxy_redirect_ports
         if not aproxy_redirect_ports:

github-runner-manager/src/github_runner_manager/repo_policy_compliance_client.py

@@ -33,6 +33,10 @@ def __init__(self, url: str, charm_token: str) -> None:
             url: Base URL to the repo policy compliance service.
             charm_token: Charm token configured for the repo policy compliance service.
         """
+        logger.warning(
+            "Repo policy compliance service is marked for deprecation. "
+            "Consider using `allow_external_contributor` option instead."
+        )
         self._session = self._create_session()
         self.base_url = url
         self.token = charm_token

github-runner-manager/src/github_runner_manager/templates/pre-job.j2

@@ -22,6 +22,7 @@ jq -n \
 {% endif %}
 
 {% if do_repo_policy_check %}
+  logger -s "Repo policy check is marked for deprecation. Consider using `allow_external_contributor` instead"
 
     # Log common env variables.
     logger -s "GITHUB_EVENT_NAME: ${GITHUB_EVENT_NAME}, \
@@ -132,6 +133,25 @@ jq -n \
     logger -s "The repository setup check has passed, proceeding to execute jobs"
 {% endif %}
 
+{% if not allow_external_contributor %}
+  # Check author association for events that can be triggered by external contributors
+  # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+  # This does not cover all possible events, only the most common ones that can be triggered by external contributors.
+  if [[ "${GITHUB_EVENT_NAME}" == "pull_request" || "${GITHUB_EVENT_NAME}" == "pull_request_target" || "${GITHUB_EVENT_NAME}" == "pull_request_review" || "${GITHUB_EVENT_NAME}" == "pull_request_review_comment" || "${GITHUB_EVENT_NAME}" == "issue_comment" ]]; then
+    AUTHOR_ASSOCIATION=$(jq -r '.pull_request.author_association // .issue.author_association // .review.author_association // .comment.author_association // empty' "$GITHUB_EVENT_PATH")
+    logger -s "Author association: $AUTHOR_ASSOCIATION"
+
+    if [[ "$AUTHOR_ASSOCIATION" != "OWNER" && "$AUTHOR_ASSOCIATION" != "MEMBER" && "$AUTHOR_ASSOCIATION" != "COLLABORATOR" ]]; then
+      logger -p user.error -s "Insufficient user authorization (author_association). Only OWNER, MEMBER, or COLLABORATOR may run workflows."
+      exit 1
+    fi
+
+    logger -s "The contributor check has passed, proceeding to execute jobs"
+  else
+    logger -s "Skipping contributor check for event: ${GITHUB_EVENT_NAME}"
+  fi
+{% endif %}
+
 if [[ -n "$DOCKERHUB_MIRROR" ]]; then
   logger -s "A private docker registry is setup as a dockerhub mirror for this self-hosted runner."
   logger -s "The docker daemon on this self-hosted runner is configured to use the dockerhub mirror."

github-runner-manager/tests/conftest.py

@@ -3,11 +3,125 @@
 
 """Fixtures for charm tests."""
 
+import os
+
 
 def pytest_addoption(parser):
     """Parse additional pytest options.
 
     Args:
         parser: Pytest parser.
     """
-    parser.addoption("--charm-file", action="store")
+    parser.addoption(
+        "--github-token",
+        action="store",
+        help="GitHub personal access token for integration tests.",
+        default=os.getenv("INTEGRATION_TOKEN"),
+    )
+    parser.addoption(
+        "--github-repository",
+        action="store",
+        help="The GitHub repository in <owner>/<repo> format for integration tests.",
+    )
+    parser.addoption(
+        "--github-token-alt",
+        action="store",
+        help="Alternate GitHub token from a different user for fork testing.",
+        default=os.getenv("INTEGRATION_TOKEN_ALT"),
+    )
+    parser.addoption(
+        "--openstack-auth-url",
+        action="store",
+        help="OpenStack authentication URL for integration tests.",
+        default=os.getenv("OS_AUTH_URL"),
+    )
+    parser.addoption(
+        "--openstack-project-domain-name",
+        action="store",
+        help="OpenStack project domain name for integration tests.",
+        default=os.getenv("OS_PROJECT_DOMAIN_NAME"),
+    )
+    parser.addoption(
+        "--openstack-project",
+        action="store",
+        help="OpenStack project name for integration tests.",
+        default=os.getenv("OS_PROJECT_NAME"),
+    )
+    parser.addoption(
+        "--openstack-user-domain-name",
+        action="store",
+        help="OpenStack user domain name for integration tests.",
+        default=os.getenv("OS_USER_DOMAIN_NAME"),
+    )
+    parser.addoption(
+        "--openstack-username",
+        action="store",
+        help="OpenStack username for integration tests.",
+        default=os.getenv("OS_USERNAME"),
+    )
+    parser.addoption(
+        "--openstack-password",
+        action="store",
+        help="OpenStack password for integration tests.",
+        default=os.getenv("OS_PASSWORD"),
+    )
+    parser.addoption(
+        "--openstack-network",
+        action="store",
+        help="OpenStack network name for integration tests.",
+        default=os.getenv("OS_NETWORK"),
+    )
+    parser.addoption(
+        "--openstack-region",
+        action="store",
+        help="OpenStack region name for integration tests.",
+        default=os.getenv("OS_REGION_NAME"),
+    )
+    parser.addoption(
+        "--https-proxy",
+        action="store",
+        help="HTTPS proxy for runner configuration.",
+        default=os.getenv("HTTPS_PROXY"),
+    )
+    parser.addoption(
+        "--http-proxy",
+        action="store",
+        help="HTTP proxy for runner configuration.",
+        default=os.getenv("HTTP_PROXY"),
+    )
+    parser.addoption(
+        "--no-proxy",
+        action="store",
+        help="No proxy configuration for runner.",
+        default=os.getenv("NO_PROXY"),
+    )
+    parser.addoption(
+        "--openstack-https-proxy",
+        action="store",
+        help="HTTPS proxy for OpenStack runner operations.",
+        default=os.getenv("OPENSTACK_HTTPS_PROXY"),
+    )
+    parser.addoption(
+        "--openstack-http-proxy",
+        action="store",
+        help="HTTP proxy for OpenStack runner operations.",
+        default=os.getenv("OPENSTACK_HTTP_PROXY"),
+    )
+    parser.addoption(
+        "--openstack-no-proxy",
+        action="store",
+        help="No proxy configuration for OpenStack runner operations.",
+        default=os.getenv("OPENSTACK_NO_PROXY"),
+    )
+    parser.addoption(
+        "--openstack-flavor",
+        action="store",
+        help="OpenStack flavor name for runner instances.",
+        default=os.getenv("OPENSTACK_FLAVOR"),
+    )
+    parser.addoption(
+        "--openstack-image-id",
+        action="store",
+        help="OpenStack image ID for runner instances.",
+        default=os.getenv("OPENSTACK_IMAGE_ID"),
+    )

github-runner-manager/tests/integration/__init__.py

@@ -0,0 +1,2 @@
+#  Copyright 2025 Canonical Ltd.
+#  See LICENSE file for licensing details.