From 485413cd99804b313f456988ddc7840ef5a61832 Mon Sep 17 00:00:00 2001 From: Nick Pellegrino Date: Wed, 23 Sep 2026 12:12:32 -0400 Subject: [PATCH 1/2] ci: block fork runs from privileged enclave builds --- .github/workflows/docker.yml | 5 +++-- .github/workflows/eif-build.yml | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 57d7861..ca26455 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -6,8 +6,8 @@ on: jobs: enclave: - # Only run if the Go workflow succeeded - if: ${{ github.event.workflow_run.conclusion == 'success' }} + # Only build successful Go runs from this repository. + if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }} permissions: id-token: write # for AWS OIDC authentication runs-on: ubuntu-latest @@ -19,6 +19,7 @@ jobs: - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v7 with: go-version: "1.27.0" + cache: false - name: docker set publish env vars env: # Trigger metadata is bound into the environment rather than interpolated diff --git a/.github/workflows/eif-build.yml b/.github/workflows/eif-build.yml index 5597273..40fb73a 100644 --- a/.github/workflows/eif-build.yml +++ b/.github/workflows/eif-build.yml @@ -71,6 +71,7 @@ jobs: if: | (github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'main' && !startsWith(github.event.workflow_run.head_commit.message, '[skip-build]'))) permissions: From 584a783709e7ec797da24dd651255f8f6c0752bc Mon Sep 17 00:00:00 2001 From: Nick Pellegrino Date: Wed, 23 Sep 2026 12:50:33 -0400 Subject: [PATCH 2/2] ci: retain default Go caching --- .github/workflows/docker.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index ca26455..65a0577 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -19,7 +19,6 @@ jobs: - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v7 with: go-version: "1.27.0" - cache: false - name: docker set publish env vars env: # Trigger metadata is bound into the environment rather than interpolated