From 01ed3b7589459373543a916aefcd43ce5de0bd90 Mon Sep 17 00:00:00 2001 From: Joey Perrott Date: Fri, 23 Oct 2026 19:16:55 +0000 Subject: [PATCH] build: guard branch-manager against forks and harden checkout Restores if: github.event.repository.fork == false in .github/workflows/assistant-to-the-branch-manager.yml and adds persist-credentials: false to actions/checkout in .github/workflows/google-internal-tests.yml. --- .github/workflows/assistant-to-the-branch-manager.yml | 2 +- .github/workflows/google-internal-tests.yml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/assistant-to-the-branch-manager.yml b/.github/workflows/assistant-to-the-branch-manager.yml index b6eeb86fd64d..ff81d4b6d279 100644 --- a/.github/workflows/assistant-to-the-branch-manager.yml +++ b/.github/workflows/assistant-to-the-branch-manager.yml @@ -13,7 +13,7 @@ permissions: jobs: assistant_to_the_branch_manager: runs-on: ubuntu-latest - if: github.event.pull_request.head.repo.fork == false + if: github.event.repository.fork == false steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: diff --git a/.github/workflows/google-internal-tests.yml b/.github/workflows/google-internal-tests.yml index be0d08a0e206..c9a8c2143d5f 100644 --- a/.github/workflows/google-internal-tests.yml +++ b/.github/workflows/google-internal-tests.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: angular/dev-infra/github-actions/google-internal-tests@9ea19241c41afc4579f2bc6983327f6b98ef3025 # main with: run-tests-guide-url: http://go/angular-material-presubmit