mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
a9898fdd6c
The publish and docker workflows trigger on workflow_run of CI, which fires for every CI completion — including CI runs for pull requests from forks — and always executes with this repo's secrets, tokens, and the pypi environment. The only gate was CI success, so fork-PR CI runs spawned publish jobs in the upstream context; actions/checkout v7's fork-checkout refusal was the only thing that stopped one on 2026-06-30. A fork PR whose head is an upstream-tagged commit would have passed the tag check and reached the upload with valid OIDC. Both workflows now require the triggering CI run to be a push event, from this repository, with head_branch starting with 'v' — CI's push trigger only matches main/stable/* branches and v* tags, so that is necessarily a tag run (verified: tag-push runs report the tag name as head_branch). Checkouts no longer persist the token while the tree's build backend executes, and publishes are no longer cancellable mid-upload (a half-uploaded release cannot be re-run cleanly because PyPI rejects duplicate files). vendor-js hardening in the same pass: gate on the immutable PR author instead of github.actor, require a same-repo head before pushing to the PR branch with contents:write, and pass github.head_ref through env instead of interpolating it into the script body.