From d16868835d4aa994e88f00626e3240b66d59591b Mon Sep 17 00:00:00 2001
From: Andres Freund <andres@anarazel.de>
Date: Wed, 3 Jun 2026 21:03:53 -0400
Subject: [PATCH v10a 3/3] ci: Make CI workflow as opt-in as possible

While workflows in new forks are disabled by default, existing forks that pull
new changes into the repository will automatically start running CI. That may
not be desired. There however is no way native to Actions to prevent this.

This commit changes it so that each repository that wants real CI to run needs
to explicitly opt into doing so, by creating the 'PG_CI_ENABLED' repository
variable with the value 1.

To make that less confusing, emit a summary whenever we skip running CI, with
a message explaining how to enable CI.
---
 .github/workflows/pg-ci.yml | 33 +++++++++++++++++++++++++++++++++
 src/tools/ci/README         | 11 ++++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pg-ci.yml b/.github/workflows/pg-ci.yml
index 60ea5bacded..eaf32c756e2 100644
--- a/.github/workflows/pg-ci.yml
+++ b/.github/workflows/pg-ci.yml
@@ -133,12 +133,45 @@ env:
 
 jobs:
 
+  # Job: Warn if not enabled
+  #
+  # Do not run CI unless the repository owner opts in, to avoid resource waste
+  # in all the forks of postgres (new forks have workflows disabled by
+  # default, but old ones don't). Unfortunately there's no explicit way to do
+  # so.
+  #
+  # To make that more visible, emit a summary explaining how CI can be enabled
+  # and how the entire workflow, including this warning, can be disabled.
+  warn-not-enabled:
+    name: Warn if not enabled
+    if: ${{vars.PG_CI_ENABLED != '1'}}
+    runs-on: ubuntu-slim
+    steps:
+      - name: Warn
+        env:
+          MSG: |
+            > [!CAUTION]
+            > CI is not enabled in this repository
+            >
+            > To enable, go to ${{github.server_url}}/${{github.repository}}/settings/variables/actions
+            > and create a new variable named PG_CI_ENABLED, with the value 1.
+            >
+            > To avoid seeing this message over and over, go to
+            > ${{github.server_url}}/${{github.repository}}/actions/workflows/pg-ci.yml
+            > and click on the three dots at the top right and choose "Disable workflow"
+        run: |
+          echo "$MSG" >> "$GITHUB_STEP_SUMMARY"
+
+
   # Job: Determine enabled jobs
   #
   # Parses "ci-os-only: ..." from the commit message and exposes flags
   # consumed by the jobs' `if:` conditions.
   setup:
     name: Determine enabled jobs
+    # Only run if repo owner opted in. If this task is skipped due to the if,
+    # none of it's depending tasks run either.
+    if: ${{vars.PG_CI_ENABLED == '1'}}
     runs-on: *linux_runs_on
     timeout-minutes: 1
     outputs:
diff --git a/src/tools/ci/README b/src/tools/ci/README
index 99e006f7e77..d72cce5b6bc 100644
--- a/src/tools/ci/README
+++ b/src/tools/ci/README
@@ -20,7 +20,7 @@ Configuring CI on personal repositories
 Currently postgres contains CI support utilizing GitHub Actions.
 
 
-Configuring CI use in a GitHub repository
+Configuring CI use of a GitHub repository
 =========================================
 
 The GitHub Actions based CI workflow may or may not be active by default,
@@ -33,6 +33,15 @@ and click on the '...' on the top right and choose 'Disable workflow'.
 To enable the workflow, go to the same page and click on "Enable workflow" at
 the top.
 
+However, to avoid issues with the thousands of forks of the postgres/postgres
+repository starting to run CI the next time the forks re-synchronize with the
+postgres/postgres, each repository needs to explicitly opt-in to actually run
+the full CI tests.
+
+To opt into CI, go to
+https://github.com/<username>/<reponame>//settings/variables/actions and
+create a new variable named PG_CI_ENABLED, with the value 1.
+
 
 Viewing CI results in a GitHub repository
 ==========================================
-- 
2.54.0.380.gc69baaf57b