Restrict release workflows to primary rtk-ai/rtk repository

[dm17ryk]

Summary by Sourcery

Guard release and pre-release workflows so they only run in the main rtk-ai/rtk repository.

CI:

• Restrict pre-release, release-please, and related asset/tag jobs to run only when triggered from the rtk-ai/rtk repository.
• Ensure the next-release workflow only updates on merged PRs in the primary rtk-ai/rtk repository.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR tightens CI release workflows so they only run in the canonical upstream repository and adds repository guards to all release-related jobs.

Flow diagram for guarded CI release workflows

flowchart TD
  A[GitHub_event] --> B{github.repository == rtk-ai/rtk}
  B -->|false| X[Skip_release_jobs]
  B -->|true| C{Branch_and_event_check}

  C -->|pre-release: develop or workflow_dispatch on non-master| D[pre-release_job]
  D --> E{needs.pre-release.outputs.tag != ''}
  E -->|true and repo_match| F[build-prerelease_job]
  E -->|false| X

  C -->|release-please: master and push or workflow_dispatch| G[release-please_job]
  G --> H{needs.release-please.outputs.release_created == 'true'}
  H -->|true and repo_match| I[build-release_job]
  H -->|true and repo_match| J[update-latest-tag_job]
  H -->|false| X

  A --> K{PR_merged}
  K -->|true and repo_match| L[update-next-release_job]
  K -->|false| X

Loading

File-Level Changes

Change	Details	Files
Guard pre-release job so it only runs on the canonical upstream repo and valid refs/events.	Add github.repository == 'rtk-ai/rtk' guard to pre-release job condition. Keep existing develop branch and workflow_dispatch conditions but nest them under the repository check.	.github/workflows/cd.yml
Guard pre-release build job to only execute in upstream repo when a tag has been generated.	Extend build-prerelease job condition to require github.repository == 'rtk-ai/rtk' alongside non-empty tag output from pre-release.	.github/workflows/cd.yml
Restrict release-please job and downstream release jobs to only run in the upstream repo.	Add github.repository == 'rtk-ai/rtk' to release-please job condition, alongside master branch and event checks. Add github.repository == 'rtk-ai/rtk' guard to build-release job condition while preserving the release_created output check. Add github.repository == 'rtk-ai/rtk' guard to update-latest-tag job condition while preserving the release_created output check.	.github/workflows/cd.yml
Prevent next-release workflow from running for PR merges outside the upstream repo.	Add github.repository == 'rtk-ai/rtk' to the update-next-release job condition while preserving the merged == true check.	.github/workflows/next-release.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[dm17ryk]

@sourcery-ai title

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The github.repository == 'rtk-ai/rtk' guard is repeated in several jobs; consider extracting it into a single reusable condition (e.g., via a top-level if on the workflow or a composite expression) to avoid duplication and keep future updates simpler.
• If you want to allow workflows to run on forks of rtk-ai/rtk, you might want to relax the repository check (e.g., using startsWith(github.repository, 'rtk-ai/rtk')) or a configurable list of allowed repositories instead of a strict equality.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `github.repository == 'rtk-ai/rtk'` guard is repeated in several jobs; consider extracting it into a single reusable condition (e.g., via a top-level `if` on the workflow or a composite expression) to avoid duplication and keep future updates simpler.
- If you want to allow workflows to run on forks of `rtk-ai/rtk`, you might want to relax the repository check (e.g., using `startsWith(github.repository, 'rtk-ai/rtk')`) or a configurable list of allowed repositories instead of a strict equality.

## Individual Comments

### Comment 1
<location path=".github/workflows/cd.yml" line_range="23-24" />
<code_context>
     if: >-
-      github.ref == 'refs/heads/develop'
-      || (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/master')
+      github.repository == 'rtk-ai/rtk'
+      && (
+        github.ref == 'refs/heads/develop'
+        || (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/master')
+      )
     runs-on: ubuntu-latest
</code_context>
<issue_to_address>
**suggestion:** Consider centralizing the `github.repository == 'rtk-ai/rtk'` check to avoid duplication and future drift.

The same repository guard now appears in several `if:` conditions in this workflow and others (`build-prerelease`, `release-please`, `build-release`, `update-latest-tag`). Repeating it increases the risk that one instance is updated while others are missed. Consider defining a single canonical repo value (e.g., via `env` or `vars`) or constraining the workflow at a higher level, and then referencing that in all conditions so future changes only need to be made in one place.

Suggested implementation:

```
  pre-release:
    if: >-
      github.repository == env.CANONICAL_REPO
      && (
        github.ref == 'refs/heads/develop'
        || (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/master')
      )
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
  build-prerelease:
    name: Build pre-release
    needs: pre-release
    if: github.repository == env.CANONICAL_REPO && needs.pre-release.outputs.tag != ''
    uses: ./.github/workflows/release.yml
    with:
      tag: ${{ needs.pre-release.outputs.tag }}

```

1. At the top of `.github/workflows/cd.yml` (workflow root), define a canonical repo env, for example:
   ```yaml
   env:
     CANONICAL_REPO: rtk-ai/rtk
   ```
   so that `env.CANONICAL_REPO` is available to all jobs.
2. In the other workflows you mentioned (`build-prerelease`, `release-please`, `build-release`, `update-latest-tag`) update any `if: github.repository == 'rtk-ai/rtk'` conditions to instead use `github.repository == env.CANONICAL_REPO` (or whatever name you choose), and ensure the same `env` definition is present at the workflow or job level.
3. If you prefer to constrain at a higher level, you can also add a top-level job `if: github.repository == env.CANONICAL_REPO` and remove per-job repository checks where appropriate.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}