[upstream staging] Guard release workflows against running from forks - #2
[upstream staging] Guard release workflows against running from forks#2duksh wants to merge 1 commit into
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
wheel-builder.yml triggers on any tag push and pypi-publish.yml chains from its completion, checking only the event type and conclusion. On a fork, pushing a tag therefore runs a full wheel build and then attempts an OIDC trusted publish (and attestation minting), relying entirely on no trusted publisher being configured on PyPI for the fork. Add the same repository_owner guard already used by the scheduled bot workflows: wheel-builder's sdist job (which every other job needs) skips on forks except for pull_request runs, and pypi-publish's publish job requires the pyca owner. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DWoMomNAcBM3e8duJrb2do
048620b to
999f812
Compare
|
Submitted upstream as pyca#15325 — closing this staging PR (validation complete: all 93 runnable jobs green; ppc64le legs unrunnable on forks). Do not delete the branch until the upstream PR resolves. Generated by Claude Code |
2 participants
Summary
Staging PR for upstream submission to pyca/cryptography (do not merge into this fork's
main; the fork's own guards live on the analysis branch). Submit upstream via: pyca/cryptography@main...duksh:cryptography:claude/upstream-publish-owner-guardwheel-builder.yml: owner-guard thesdistjob (every other job needs it, so skipping it skips the workflow);pull_requestruns kept so workflow changes stay testable.pypi-publish.yml: publish job additionally requiresgithub.repository_owner == 'pyca', so forks never attempt an OIDC publish or mint attestations on a tag push.Uses the same
repository_ownerguard pattern the scheduled bot workflows already use.Testing
🤖 Generated with Claude Code
https://claude.ai/code/session_01DWoMomNAcBM3e8duJrb2do
Generated by Claude Code