From 999f812abe22a3d0cc54feff8ffc0ad2a4956e8e Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 24 Jul 2026 04:08:33 +0000 Subject: [PATCH] Guard release workflows against running from forks wheel-builder.yml triggers on any tag push and pypi-publish.yml chains from its completion, checking only the event type and conclusion. On a fork, pushing a tag therefore runs a full wheel build and then attempts an OIDC trusted publish (and attestation minting), relying entirely on no trusted publisher being configured on PyPI for the fork. Add the same repository_owner guard already used by the scheduled bot workflows: wheel-builder's sdist job (which every other job needs) skips on forks except for pull_request runs, and pypi-publish's publish job requires the pyca owner. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01DWoMomNAcBM3e8duJrb2do --- .github/workflows/pypi-publish.yml | 4 +++- .github/workflows/wheel-builder.yml | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index db46ceeae941..c7a4eefbcdb6 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -27,7 +27,9 @@ jobs: # We're not actually verifying that the triggering push event was for a # tag, because github doesn't expose enough information to do so. # wheel-builder.yml currently only has push events for tags. - if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success') + # The repository_owner check keeps forks from attempting a publish (or + # requesting OIDC tokens/attestations) if a tag is ever pushed to one. + if: github.repository_owner == 'pyca' && (github.event_name == 'workflow_dispatch' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success')) permissions: id-token: "write" attestations: "write" diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml index a0cb2413f251..45df58033158 100644 --- a/.github/workflows/wheel-builder.yml +++ b/.github/workflows/wheel-builder.yml @@ -27,6 +27,10 @@ jobs: sdist: runs-on: ubuntu-latest name: sdists + # Keep forks from running release builds on tag pushes or dispatches + # (pull_request runs are kept so workflow changes stay testable). All + # other jobs need this one, so skipping it skips the entire workflow. + if: github.repository_owner == 'pyca' || github.event_name == 'pull_request' steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: