fix(ci): prevent workflows from running on forks#13216
Conversation
Add a top-level job condition github.repository == 'warpdotdev/warp' to workflows that reference self-hosted runners, secrets, or internal reusable workflows which are not available on fork repositories. This prevents failing workflow runs on forks. Fixes warpdotdev#12396
github-actions
Bot
added
the
external-contributor
|
I'm starting a first review of this pull request. You can view the conversation on Warp. I reviewed this pull request and requested human review from: Comment Powered by Oz |
![oz-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR adds repository guards to GitHub Actions workflows that use self-hosted runners, inherited secrets, write permissions, or internal reusable workflows so those jobs are skipped when the workflow definition is running from a forked repository.
Concerns
No blocking concerns found. The attached spec context does not include an approved spec to validate against, and the workflow changes do not introduce security concerns.
Verdict
Found: 0 critical, 0 important, 0 suggestions
Approve
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
1 participant
Summary
Add a top-level job-level condition
github.repository == 'warpdotdev/warp'to all workflows that use self-hosted runners, secrets, or internal reusable workflows, preventing them from failing when triggered on fork repositories.Changes
Workflows gated (14 files):
ci.yml- added condition to theparamsentry job (all other jobs depend on it and are skipped transitively)sync-pr-checks.yml,check_approvals.yml,repo-sync.yml,close_stale_fix_prs.yml,warp_cleanup_fix_prs.yml- pull-request triggered maintenance workflowspopulate_build_cache.yml- push/schedule triggered cache workflowcut_new_releases.yml,feature_flag_cleanup.yml- release/maintenance workflowsupdate-dedupe-local.yml,update-triage-local.yml,update-pr-review-local.yml- scheduled triage workflowslabel_external_contributors.yml- contributor labelingstale_requested_changes_prs.yml- stale PR managementWorkflows left unchanged (already safe via only
workflow_dispatch/workflow_calltriggers):changelog_draft.yml,cut_new_release_candidate.yml,create_release.yml,delete_release.yml,docubot_reply_to_comment.ymlFixes #12396