mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
John Myers
30956e1139
The local-build approach (single job, no GHCR push) is not feasible because the CI container cannot configure the host Docker daemon's insecure registry list, and container networking prevents access to the local registry on the host loopback. Switch to pull_request_target instead, which runs in the base repo context with write permissions to GHCR. The existing three-job pipeline (build-gateway, build-cluster, e2e) works unchanged. Security: the test:e2e label is a maintainer trust gate — only org members can apply it, signalling the PR code has been reviewed. Add ref input to docker-build.yml and e2e-test.yml so callers can pass github.event.pull_request.head.sha for checkout and image tagging, since github.sha points to the base branch under pull_request_target.