From 2a04d099d7a3eedad240f47600db51d37369f05e Mon Sep 17 00:00:00 2001
From: Nick Pellegrino <nick@cloudx.io>
Date: Wed, 23 Sep 2026 12:12:28 -0400
Subject: [PATCH 1/2] ci: block fork runs from privileged enclave builds

---
 .github/workflows/docker.yml    | 5 +++--
 .github/workflows/eif-build.yml | 9 +++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2b3ad62..3bf0867 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -15,8 +15,8 @@ on:
 
 jobs:
   enclave:
-    # Only run if the Go workflow succeeded
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    # Only build successful Go runs from this repository or manual dispatches.
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository) }}
     permissions:
       id-token: write # for AWS OIDC authentication
     runs-on: ubuntu-latest
@@ -28,6 +28,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v7
         with:
           go-version: "1.27.0"
+          cache: false
       - name: docker set architecture env vars
         env:
           ARCHITECTURE: ${{ github.event.inputs.architecture || 'arm64' }}
diff --git a/.github/workflows/eif-build.yml b/.github/workflows/eif-build.yml
index 955a2c5..f93486f 100644
--- a/.github/workflows/eif-build.yml
+++ b/.github/workflows/eif-build.yml
@@ -64,10 +64,10 @@ jobs:
     name: Build EIF on Nitro EC2
     runs-on: ubuntu-latest
     # Publication is gated in docker.yml: automated Docker Build runs push an
-    # image only for a push to this repository's default branch, and every
-    # Docker Build run is bound to this repository, so the image's source is not
-    # re-checked here. Manual publication and measurement remain the
-    # workflow_dispatch paths of the two workflows.
+    # image only for a push to this repository's default branch. The repository
+    # check below also rejects upstream runs from forks as defence in depth.
+    # Manual publication and measurement remain the workflow_dispatch paths
+    # of the two workflows.
     # The [skip-build] marker is matched with startsWith, not contains: a squash
     # merge puts the entire PR description in the commit body, so contains also
     # matches any PR whose description merely mentions the marker in prose. The
@@ -75,6 +75,7 @@ jobs:
     if: |
       (github.event_name == 'workflow_dispatch' ||
        (github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
         github.event.workflow_run.head_branch == 'main' &&
         !startsWith(github.event.workflow_run.head_commit.message, '[skip-build]')))
     permissions:

From 24b87fb0aae0caa796bc4ebc9595de9ea8bd5526 Mon Sep 17 00:00:00 2001
From: Nick Pellegrino <nick@cloudx.io>
Date: Wed, 23 Sep 2026 12:50:29 -0400
Subject: [PATCH 2/2] ci: retain default Go caching

---
 .github/workflows/docker.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3bf0867..bbd625b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -28,7 +28,6 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v7
         with:
           go-version: "1.27.0"
-          cache: false
       - name: docker set architecture env vars
         env:
           ARCHITECTURE: ${{ github.event.inputs.architecture || 'arm64' }}