From 1bd0ba8a1a644bceb8b043150452bac8360b6e01 Mon Sep 17 00:00:00 2001 From: Joey Perrott Date: Fri, 23 Oct 2026 19:30:56 +0000 Subject: [PATCH] build: guard branch-manager against forks and harden checkout Restores if: github.event.repository.fork == false in .github/workflows/assistant-to-the-branch-manager.yml and adds persist-credentials: false to actions/checkout in .github/workflows/google-internal-tests.yml. --- .github/workflows/assistant-to-the-branch-manager.yml | 2 +- .github/workflows/google-internal-tests.yml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/assistant-to-the-branch-manager.yml b/.github/workflows/assistant-to-the-branch-manager.yml index 4dd142138acd..ec08b8510144 100644 --- a/.github/workflows/assistant-to-the-branch-manager.yml +++ b/.github/workflows/assistant-to-the-branch-manager.yml @@ -13,7 +13,7 @@ permissions: jobs: assistant_to_the_branch_manager: runs-on: ubuntu-latest - if: github.event.pull_request.head.repo.fork == false + if: github.event.repository.fork == false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/google-internal-tests.yml b/.github/workflows/google-internal-tests.yml index 4373cf21fe13..df6550f262ea 100644 --- a/.github/workflows/google-internal-tests.yml +++ b/.github/workflows/google-internal-tests.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: angular/dev-infra/github-actions/google-internal-tests@3b181b7da71ce256d7dc44532ed3df8198f7d853 # main with: run-tests-guide-url: http://go/angular-material-presubmit