[kixelated]

Problem

The rust2-queue runner group admits any workflow in moq-dev/rust2, so a PR's own workflow, such as an approved fork run, could reach the self-hosted runner. GitHub matches a runner group's selected workflow by its exact ref with no wildcard, and a merge group runs queue.yml from its own gh-readonly-queue/main/pr-<n>-<sha> branch, so the group can't be restricted to queue.yml itself.

Approach

First step of the reusable-workflow restriction the maintainer picked on 2026-11-03 (moq-dev/quest#439, quest runners.md):

• The self-hosted job moves unchanged into .github/workflows/queue-build.yml (on: workflow_call). Its job runs only when the caller's event is merge_group, so a pull request's workflow that calls it still gets no runner.
• queue.yml calls it by its local path for now, so this PR's own merge group runs the new file.
• A reusable workflow's jobs report as Queue build / Build, so a new Queue job on a hosted runner reports the build's result under the context main's ruleset requires. It runs with always() so a failed or cancelled build fails the context rather than skipping it; it skips on pull requests as before.

Next, once this is on main: switch the call to moq-dev/rust2/.github/workflows/queue-build.yml@main (a merge group calling @main before the file lands would find no workflow), then the maintainer restricts the group to that workflow at refs/heads/main.

Impact

No public API change. The required Queue context keeps its name; the build now also shows as Queue build / Build.

Alternatives

• Leave the group unrestricted and rely on the one-repository group plus fork approval for every outside contributor (the maintainer declined it: an approval is a click given by mistake).
• Require Queue build / Build in the ruleset instead of a reporting job: needs a ruleset change timed with the workflow change, and the PR-side skip and workflow_dispatch report would need the new name too.

Follow-ups

The @main switch and the restriction, tracked in moq-dev/quest's runners quest.

Validation

just check origin/main passes, including actionlint.

Review

Codex (quest review, gpt-6.1-sol, medium), round 1 on f5ae018 against origin/main 93df389: no findings.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: af78c4d8-ad1c-4b34-a7a6-4beae1eef4d0

Commits

Reviewing files that changed from the base of the PR and between 93df389 and f5ae018.

Files selected for processing: 2

• .github/workflows/queue-build.yml
• .github/workflows/queue.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.