From 81890d7a994ab791c7db8bc93667caf21fc38f45 Mon Sep 17 00:00:00 2001
From: Chinesezjc <jczhai@deepseek.com>
Date: Fri, 24 Jul 2026 16:37:59 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20address=20review=20=E2=80=94=20same-repo?=
 =?UTF-8?q?=20guard,=20keep=20cache=20path=20identical?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Restrict node-24-coverage to same-repo PRs so fork-originated code can
  never reach the self-hosted runner (defense in depth; the repo is
  private with forking disabled today).
- Revert the pnpm cache path to the literal /home/runner/... save-side
  path: actions/cache hashes the path into the cache version, so the ~
  variant could never match the cache saved by the master lane. On
  self-hosted the persistent local pnpm store covers warm installs.
- Drop the incorrect 'does not gate merges' claim: node-24-coverage is
  needed by all-checks-passed. Pool capacity notes moved into comments.
---
 .github/workflows/ci.yml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2e70cab6f..dd60593a85 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,9 +76,14 @@ jobs:
           compression-level: 0
 
   node-24-coverage:
-    if: github.event_name == 'pull_request'
-    # Coverage does not gate merges, so it runs on the in-house pool
-    # (self-hosted, 64-core) instead of the metered enterprise pool.
+    # Same-repo PRs only: this lane runs on an in-house self-hosted runner,
+    # so fork-originated code must never land here. The repo is currently
+    # private with forking disabled; this guard keeps that invariant explicit
+    # if either setting ever changes.
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+    # Runs on the in-house pool (self-hosted, 64-core) instead of the metered
+    # enterprise pool. The pool holds 4 always-on instances plus 4 registered
+    # spares; the runner service is systemd-managed and self-healing.
     runs-on: [self-hosted, linux, x64, vm-backup]
     name: node 24 / coverage
     env:
@@ -91,8 +96,12 @@ jobs:
 
       - uses: actions/cache/restore@v4
         with:
-          # ~ resolves on both hosted (/home/runner) and self-hosted homes
-          path: ~/.local/share/pnpm/store/v11
+          # Path must stay byte-identical to the save-side path in the master
+          # lane: actions/cache hashes the literal path into the cache version,
+          # so any variation (e.g. ~) would never match the saved cache. On
+          # self-hosted this restore simply misses and the persistent local
+          # pnpm store covers warm installs instead.
+          path: /home/runner/.local/share/pnpm/store/v11
           key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-