[cadence] Run all cadence CI (cpu + xtensa) on pull_request_target

Move every cadence job (cpu-build, cpu-test, hifi-build, vision-build) onto the pull_request_target event and drop the pull_request path, so all jobs run with credentials (OIDC) and post a single graph tied to the PR head, for both same-repo and Meta-exported fork PRs.

Jobs run on push/schedule/workflow_dispatch, and on pull_request_target when the PR is same-repo (trusted) or a fork labeled both CLA Signed and meta-exported. pull_request_target always uses main's copy of the workflow, so this takes effect after landing.

Authored with Claude Code.

Author: aliafzal

.github/workflows/build-cadence-runner.yml

@@ -9,46 +9,29 @@ on:
       - release/*
     tags:
       - ciflow/nightly/*
-  pull_request:
   pull_request_target:
-    types: [labeled]
+    types: [opened, synchronize, reopened, labeled]
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
 jobs:
-  gate:
-    runs-on: ubuntu-latest
-    outputs:
-      run-cadence: ${{ steps.decide.outputs.run }}
-    steps:
-      - id: decide
-        env:
-          EVENT: ${{ github.event_name }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-          HAS_CLA: ${{ contains(github.event.pull_request.labels.*.name, 'CLA Signed') }}
-          HAS_EXPORT: ${{ contains(github.event.pull_request.labels.*.name, 'meta-exported') }}
-        run: |
-          run=false
-          case "${EVENT}" in
-            push|schedule|workflow_dispatch)
-              run=true
-              ;;
-            pull_request)
-              [ "${IS_FORK}" = "false" ] && run=true
-              ;;
-            pull_request_target)
-              if [ "${IS_FORK}" = "true" ] && [ "${HAS_CLA}" = "true" ] && [ "${HAS_EXPORT}" = "true" ]; then
-                run=true
-              fi
-              ;;
-          esac
-          echo "run=${run}" >> "${GITHUB_OUTPUT}"
-
+  # Everything runs via pull_request_target so cpu and all Xtensa backends run
+  # with credentials (OIDC) and post a single graph tied to the PR head. Jobs run
+  # when:
+  #   - push / schedule / workflow_dispatch, OR
+  #   - a pull_request_target that is same-repo (trusted), OR a fork labeled both
+  #     CLA Signed + meta-exported (Meta export -- the only trusted fork case).
+  # pull_request_target always uses main's copy of this workflow, so edits here
+  # only take effect after landing. The run condition is inlined per job (GitHub
+  # Actions has no YAML anchors and env is unavailable in job-level if).
   cpu-build:
-    if: github.event_name != 'pull_request_target'
+    if: >-
+      github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_target' && (github.event.pull_request.head.repo.full_name == github.repository ||
+      (contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))))
     uses: pytorch/test-infra/.github/workflows/linux_job_v2.yml@main
     permissions:
       id-token: write
@@ -58,7 +41,7 @@ jobs:
       runner: linux.2xlarge
       docker-image: ci-image:executorch-ubuntu-22.04-clang12
       submodules: recursive
-      ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
       timeout: 90
       upload-artifact: cadence-runner-build
       script: |
@@ -75,36 +58,43 @@ jobs:
 
   cpu-test:
     needs: cpu-build
-    if: github.event_name != 'pull_request_target'
+    if: >-
+      github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_target' && (github.event.pull_request.head.repo.full_name == github.repository ||
+      (contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))))
     permissions:
       id-token: write
       contents: read
     uses: ./.github/workflows/_test_cadence.yml
     with:
-      ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
 
   # Cross-compile cadence_executor_runner for each Cadence Xtensa core, one job
   # per backend so they show as separate lines (no matrix grouping). Shared logic
   # lives in _xtensa_build.yml. fusion_g3 is omitted until the upstream fusion_g3
   # <-> nnlib-FusionG3 API skew is fixed (its runner does not link).
   hifi-build:
-    needs: gate
-    if: needs.gate.outputs.run-cadence == 'true'
+    if: >-
+      github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_target' && (github.event.pull_request.head.repo.full_name == github.repository ||
+      (contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))))
     permissions:
       id-token: write
       contents: read
     uses: ./.github/workflows/_xtensa_build.yml
     with:
       backend: hifi4
-      ref: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
+      ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
 
   vision-build:
-    needs: gate
-    if: needs.gate.outputs.run-cadence == 'true'
+    if: >-
+      github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request_target' && (github.event.pull_request.head.repo.full_name == github.repository ||
+      (contains(github.event.pull_request.labels.*.name, 'CLA Signed') && contains(github.event.pull_request.labels.*.name, 'meta-exported'))))
     permissions:
       id-token: write
       contents: read
     uses: ./.github/workflows/_xtensa_build.yml
     with:
       backend: vision
-      ref: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
+      ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}