From 16abe7a282487add0c390b3bd284c8c0b087c1f4 Mon Sep 17 00:00:00 2001 From: Nathan Flurry Date: Wed, 9 Sep 2026 17:55:04 -0700 Subject: [PATCH] fix(ci): restrict Docker publishing to the OSS repository --- .github/workflows/publish.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 5913ef76e2..dd8682bb61 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -348,7 +348,8 @@ jobs: # --------------------------------------------------------------------------- docker-images: needs: [context] - if: needs.context.outputs.build_docker == 'true' + # This ID identifies the OSS repository and remains stable across renames. + if: needs.context.outputs.build_docker == 'true' && github.repository_id == '654560183' name: "Docker ${{ matrix.arch_suffix }}" strategy: fail-fast: false @@ -439,6 +440,7 @@ jobs: cache: pnpm - run: pnpm install --frozen-lockfile - uses: ./.github/actions/docker-setup + if: github.repository_id == '654560183' with: docker_username: ${{ secrets.DOCKER_CI_USERNAME }} docker_password: ${{ secrets.DOCKER_CI_ACCESS_TOKEN }} @@ -702,7 +704,7 @@ jobs: --allow-dirty - name: Create Docker multi-arch manifests - if: needs.context.outputs.build_docker == 'true' + if: needs.context.outputs.build_docker == 'true' && github.repository_id == '654560183' run: pnpm --filter=publish exec tsx src/ci/bin.ts docker-manifest --sha ${{ needs.context.outputs.sha }} # ---- release-only tail ---- @@ -719,7 +721,7 @@ jobs: - name: Retag Docker manifests to version - if: needs.context.outputs.trigger == 'release' + if: needs.context.outputs.trigger == 'release' && github.repository_id == '654560183' run: | pnpm --filter=publish exec tsx src/ci/bin.ts docker-retag \ --sha ${{ needs.context.outputs.sha }} \