[cadence] Run build/test on fork exports and surface per-job checks on the PR

The Cadence Build & Test workflow ran its credentialed build/test jobs only on same-repo PRs. On Meta-exported fork PRs (labeled meta-exported + CLA Signed) the cpu-build and cpu-test jobs were excluded from the pull_request_target path, and the jobs that did run there did not appear as checks on the PR because pull_request_target check runs attach to the base SHA.

This routes cpu-build and cpu-test through the same gate as hifi-build and vision-build so all four run on fork exports, and adds export-checks-start/export-checks-finish to mirror per-job check runs onto the PR head SHA so each cadence job shows up as its own check on the export PR, linking to its logs. Same-repo PRs continue to run via pull_request and report checks natively.

Authored with Claude Code.

Author: aliafzal

.github/workflows/build-cadence-runner.yml

@@ -48,7 +48,8 @@ jobs:
           echo "run=${run}" >> "${GITHUB_OUTPUT}"
 
   cpu-build:
-    if: github.event_name != 'pull_request_target'
+    needs: gate
+    if: needs.gate.outputs.run-cadence == 'true'
     uses: pytorch/test-infra/.github/workflows/linux_job_v2.yml@main
     permissions:
       id-token: write
@@ -58,7 +59,7 @@ jobs:
       runner: linux.2xlarge
       docker-image: ci-image:executorch-ubuntu-22.04-clang12
       submodules: recursive
-      ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      ref: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
       timeout: 90
       upload-artifact: cadence-runner-build
       script: |
@@ -74,14 +75,14 @@ jobs:
         cp cmake-out/backends/cadence/cadence_runner "${RUNNER_ARTIFACT_DIR}/"
 
   cpu-test:
-    needs: cpu-build
-    if: github.event_name != 'pull_request_target'
+    needs: [gate, cpu-build]
+    if: needs.gate.outputs.run-cadence == 'true'
     permissions:
       id-token: write
       contents: read
     uses: ./.github/workflows/_test_cadence.yml
     with:
-      ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      ref: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
 
   # Cross-compile cadence_executor_runner for each Cadence Xtensa core, one job
   # per backend so they show as separate lines (no matrix grouping). Shared logic
@@ -108,3 +109,98 @@ jobs:
     with:
       backend: vision
       ref: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.sha || github.sha }}
+
+  # Fork exports run via pull_request_target, whose native check runs attach to
+  # the base SHA and never surface on the PR. Mirror per-job check runs onto the
+  # PR head SHA so each cadence job shows up as its own check on the export PR,
+  # linking to its logs. Same-repo PRs run via pull_request and report natively.
+  export-checks-start:
+    needs: gate
+    if: github.event_name == 'pull_request_target' && needs.gate.outputs.run-cadence == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+    outputs:
+      ids: ${{ steps.create.outputs.ids }}
+    steps:
+      - id: create
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const jobs = ['cpu-build', 'cpu-test', 'hifi-build', 'vision-build'];
+            const ids = {};
+            for (const job of jobs) {
+              const res = await github.rest.checks.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: `cadence (export) / ${job}`,
+                head_sha: context.payload.pull_request.head.sha,
+                status: 'in_progress',
+                details_url: runUrl,
+                output: {
+                  title: 'Running on the export workflow run',
+                  summary: `Mirrored from the pull_request_target run (native checks attach to the base SHA). See ${runUrl}`,
+                },
+              });
+              ids[job] = res.data.id;
+              // Persist after each create so a mid-loop failure still propagates
+              // partial IDs to the finish job (which then updates, not duplicates).
+              core.setOutput('ids', JSON.stringify(ids));
+            }
+
+  export-checks-finish:
+    needs: [gate, cpu-build, cpu-test, hifi-build, vision-build, export-checks-start]
+    if: always() && github.event_name == 'pull_request_target' && needs.gate.outputs.run-cadence == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      actions: read
+    steps:
+      - uses: actions/github-script@v7
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+          IDS: ${{ needs.export-checks-start.outputs.ids }}
+        with:
+          script: |
+            const needs = JSON.parse(process.env.NEEDS);
+            const ids = JSON.parse(process.env.IDS || '{}');
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            const jobs = ['cpu-build', 'cpu-test', 'hifi-build', 'vision-build'];
+            // Link each check to its inner reusable-workflow job for a direct log
+            // link; fall back to the run page when a job name is not matchable.
+            const { data } = await github.rest.actions.listJobsForWorkflowRun({
+              owner, repo, run_id: context.runId, per_page: 100,
+            });
+            const urlFor = (job) => {
+              const m = data.jobs.find(j => j.name === job || j.name.startsWith(`${job} /`));
+              return m ? m.html_url : runUrl;
+            };
+            // Valid check-run conclusions; anything unexpected fails closed.
+            const allowed = ['success', 'failure', 'cancelled', 'skipped', 'timed_out'];
+            for (const job of jobs) {
+              const result = (needs[job] && needs[job].result) || 'unknown';
+              const conclusion = allowed.includes(result) ? result : 'failure';
+              const fields = {
+                owner,
+                repo,
+                status: 'completed',
+                conclusion,
+                details_url: urlFor(job),
+                output: {
+                  title: `${job}: ${result}`,
+                  summary: `Result mirrored from the export workflow run: ${runUrl}`,
+                },
+              };
+              if (ids[job]) {
+                await github.rest.checks.update({ ...fields, check_run_id: ids[job] });
+              } else {
+                await github.rest.checks.create({
+                  ...fields,
+                  name: `cadence (export) / ${job}`,
+                  head_sha: context.payload.pull_request.head.sha,
+                });
+              }
+            }