Skip to content

Restrict release workflows to primary rtk-ai/rtk repository #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dm17ryk merged 2 commits into from
Jul 29, 2026
Merged

Restrict release workflows to primary rtk-ai/rtk repository #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5f6d5cf
fix(ci): guard upstream release workflows
dm17ryk Jul 29, 2026
c16a575
refactor(ci): centralize upstream release guard
dm17ryk Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,21 @@ permissions:
pull-requests: write

jobs:
# Intentionally strict: forks must not publish releases or use upstream secrets.
upstream-only:
name: Verify upstream release repository
if: github.repository == 'rtk-ai/rtk'
runs-on: ubuntu-latest
permissions: {}
steps:
- run: echo "Release automation enabled for ${{ github.repository }}"

# ═══════════════════════════════════════════════
# DEVELOP PATH: Pre-release
# ═══════════════════════════════════════════════

pre-release:
needs: upstream-only
if: >-
github.ref == 'refs/heads/develop'
|| (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/master')
Expand Down Expand Up @@ -98,7 +108,10 @@ jobs:
# ═══════════════════════════════════════════════

release-please:
if: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
needs: upstream-only
if: >-
github.ref == 'refs/heads/master'
&& (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
runs-on: ubuntu-latest
outputs:
release_created: ${{ steps.release.outputs.release_created }}
Expand All @@ -122,7 +135,7 @@ jobs:
build-release:
name: Build and upload release assets
needs: release-please
if: ${{ needs.release-please.outputs.release_created == 'true' }}
if: needs.release-please.outputs.release_created == 'true'
uses: ./.github/workflows/release.yml
with:
tag: ${{ needs.release-please.outputs.tag_name }}
Expand All @@ -133,7 +146,7 @@ jobs:
update-latest-tag:
name: Update 'latest' tag
needs: [release-please, build-release]
if: ${{ needs.release-please.outputs.release_created == 'true' }}
if: needs.release-please.outputs.release_created == 'true'
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@v3
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/next-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ permissions: {}

jobs:
update-next-release:
if: github.event.pull_request.merged == true
# Intentionally strict: this job edits the upstream release PR using upstream secrets.
if: github.repository == 'rtk-ai/rtk' && github.event.pull_request.merged == true
runs-on: ubuntu-latest
steps:
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
Expand Down
Loading