[robnester-rh]

Keep the website build available to forked copies while restricting GitHub Pages deployment to the canonical policy-builder repository.

Co-Authored-By: Codex codex@openai.com
Ref: EC-2232

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: e7d3ce3f-c9ed-474e-90b1-5bf80a8737a6

📥 Commits

Reviewing files that changed from the base of the PR and between aac4eac and 922a59f.

📒 Files selected for processing: 1

• .github/workflows/publish.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The publish workflow now runs the deploy job only when the repository is conforma/policy-builder.

Changes: Deployment gate

Layer / File(s)	Summary
Restrict deployment by repository .github/workflows/publish.yaml	The deploy job has a repository condition. It runs only for conforma/policy-builder.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to 922a5

Fork builds remain available while deployment is restricted to the canonical repository. No actionable merge risk remains.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly identifies the change: preventing website deployment from fork executions.
Description check		The description accurately explains that forked copies can build the website while GitHub Pages deployment is restricted to the canonical repository.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

---

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

---

Powered by Qodo

[qodo-for-conforma]

PR Summary by Qodo

Restrict website deployment to the canonical repository

⚙️ Configuration changes 🕐 Less than 5 minutes

---

AI Description

• Keep website builds available when the publish workflow runs in forks.
• Skip GitHub Pages deployment unless the repository is conforma/policy-builder.

Diagram

graph TD
  T["Push or manual"] --> B["Website build"] --> G{"Canonical repository?"} -->|Yes| D["Pages deployment"]
  G -->|No| S["Skip deployment"]

Loading

High-Level Assessment

The job-level repository guard is appropriate: it prevents deployment from forks while leaving the shared build job unchanged. Guarding the entire workflow would unnecessarily prevent those builds.

Files changed (1) +1 / -0

Other (1) +1 / -0

publish.yamlGate Pages deployment on the canonical repository +1/-0

Gate Pages deployment on the canonical repository

• Adds a repository condition to the deploy job so it runs only in conforma/policy-builder. The preceding website build remains available in forks.

.github/workflows/publish.yaml