[kixelated]

Summary

Works Harden the merge-queue runners. Fork approval and the watch-mode cleanup are done; the runner-group restriction takes its first step here, and the quest is rewritten to what remains.

• Fork approval (done on GitHub, 2026-11-02): set fork-pr-contributor-approval with gh api -X PUT repos/moq-dev/<repo>/actions/permissions/fork-pr-contributor-approval:

  Repository	Before	After
  moq-dev/quest	first_time_contributors	all_external_contributors
  moq-dev/rind	first_time_contributors	all_external_contributors
  moq-dev/rust2	first_time_contributors	all_external_contributors

• Watch-mode cleanup: kixelated/nixos#20, stacked on kixelated/nixos#19. It generates the check launcher, check user and group, qland-<id> network, staging directory, KVM grant and storage tagging only for repositories on quest land serve. Deploying it removes them for moq, quest, rind and rust2 and drops moq's /dev/kvm ACL; moq.pro keeps its own. A new quest-land-watch flake check verifies this.

• Runner groups, first step: the self-hosted job moves into .github/workflows/queue-build.yml (on: workflow_call), which queue.yml calls. Same change in moq-dev/rind#289 and moq-dev/rust2#536.

  • The build job, and the caller job, run only when the event is merge_group. The called job's own guard matters once the group admits that workflow: a pull request's workflow that calls queue-build.yml@main still gets no runner.
  • A reusable workflow's jobs report as Queue build / Build, not Queue. A new Queue job on a hosted runner reports the build's result under the context main's ruleset requires, so no ruleset change is needed. It runs with always(), so a failed or cancelled build fails the context instead of skipping it, since a skipped required context would pass the group. It skips on pull requests as before. quest land watch reads every failing job of the run, so the fixer still gets the build's log.
  • queue.yml calls the file by its local path for now: a merge group calling @main before the file is on main finds no workflow and fails. So this PR's merge group runs the new file itself. Switching to @main is the next step, then the maintainer restricts the group.
  • README's merge-queue paragraph says the Queue check passes only when the build does.

Decisions

Settled by the user in a /quest-complete grill round on 2026-11-03, also recorded in the quest's Plan:

• How should each self-hosted runner group (quest-queue, rind-queue, rust2-queue) be restricted to its queue build?
  • ✅ (1) Reusable workflow (Recommended): move each repository's self-hosted job into a reusable workflow that queue.yml calls at @main and runs only for merge_group, then restrict the group to that workflow at refs/heads/main.
  • (2) Leave the groups unrestricted and rely on one-repository groups plus fork approval.

Choices made without asking

• Applied the fork-approval policy right away rather than at the cutover: the cutover had already registered the runners, so "no later than the cutover" had passed.
• Kept the Queue context name with a hosted reporting job, rather than requiring Queue build / Build in the rulesets. That would need a ruleset change timed with the workflow change, plus renaming the PR-side skip and the workflow_dispatch report.
• Took the restriction in two steps per repository (local call now, @main once it lands), for the bootstrap reason above.
• Did not change any runner group's restricted_to_workflows setting. It's an org admin change, and it would stall the queue if it landed before the @main call.

Left in the quest

The quest's Waiting section holds these:

• Maintainer: once a repository's queue.yml calls queue-build.yml@main on main, restrict its group. For quest: gh api -X PATCH orgs/moq-dev/actions/runner-groups/8 -f name=quest-queue -F restricted_to_workflows=true -f 'selected_workflows[]=moq-dev/quest/.github/workflows/queue-build.yml@refs/heads/main' (rind-queue is 9 and rust2-queue is 10). Check that gh api orgs/moq-dev/actions/runner-groups/<id> shows restricted_to_workflows: true, and that a merge group still runs on the runner. Caveat: GitHub documents workflow restriction for Enterprise Cloud, and moq-dev is on the Team plan, though the api.github.com API takes the fields. If GitHub rejects or drops them, revert and fall back to option (2).
• Maintainer: deploy kixelated/nixos#20 through deploy/quest-land.
• Maintainer: check that the next outside contributor's fork PR waits for approval.

The agent work left is the @main switch in each repository once its first step lands.

Validation

• quest check --base origin/main and just check pass on 3063c8d, including actionlint on both workflows.
• moq-dev/rind and moq-dev/rust2: just check origin/main passes on each PR's head.

Review

Codex (quest review, gpt-6.1-sol, medium), round 1 on 3063c8d against origin/main e5d11d1: no findings. The code change in kixelated/nixos#20 had its own Codex review there.

Follow-ups

• The @main switch and the restriction stay in this quest, not a new one.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9e3fb841-ffd0-4b62-9b95-a33dc6be475f

Commits

Reviewing files that changed from the base of the PR and between acb8682 and 3063c8d.

Files selected for processing: 4

• .github/workflows/queue-build.yml
• .github/workflows/queue.yml
• README.md
• quest/m0/queue-watcher/runners.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.