Repository navigation
ci(security): skip self-hosted runner jobs for fork PRs - #34
Merged
Merged
Conversation
Public repo PR workflows run on the self-hosted Mac mini. Add a job-level head.repo.full_name == github.repository guard so fork PR code never runs there. Same-repo PRs, pushes and dispatches are unchanged. Edits made with Codex CLI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security: keep fork PRs off the self-hosted Mac mini runner
This repo is public, and its
pull_requestworkflows run on[self-hosted, macOS, ARM64]. Once a fork PR is approved to run (or comes from a past contributor), it can execute arbitrary code on the Mac mini. That runner also serves private deploy workflows that hold Cloudflare, Fly and npm-class secrets. (GitHub guidance)Change: every self-hosted job in a PR-triggered workflow gets a job-level guard:
Existing
if:conditions are kept and combined with&&. Pushes,workflow_dispatch, schedules and same-repo PRs behave exactly as before. Fork PRs see these jobs as skipped, so a maintainer has to re-run them from a branch in this repo.Verification:
actionlintis clean before and after. A YAML parse plus a script check confirms no self-hosted job in a PR-triggered workflow is left unguarded.Still manual (org setting): restrict the self-hosted runner group to private repos and require approval for all outside-collaborator fork PRs. This PR doesn't change org settings.
Tooling: workflow edits were made with Codex CLI. Draft: please review.