From 8a0bd61fc46b0a934eb550e9ffa958562a01d441 Mon Sep 17 00:00:00 2001
From: jubnl <jgunther021@gmail.com>
Date: Sat, 11 Jul 2026 20:12:09 +0200
Subject: [PATCH] ci: don't run repo-specific workflows on forks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Guard release, publish, wiki-deploy and issue/PR-triage workflows with a
`github.repository` check so they no-op in forks instead of failing or
acting on the fork's own issues, PRs, tags and registries.

Also skip the Docker Scout scan for pull requests from forks: Docker Hub
secrets are never exposed there, so the login step could not succeed.

Tests and lint stay ungated — they need no secrets and are the gate for
incoming fork PRs.
---
 .github/workflows/close-stale-invalid-titles.yml | 1 +
 .github/workflows/close-stale-wrong-branch.yml   | 1 +
 .github/workflows/close-untitled-issues.yml      | 1 +
 .github/workflows/docker-dev.yml                 | 1 +
 .github/workflows/docker.yml                     | 1 +
 .github/workflows/enforce-target-branch.yml      | 1 +
 .github/workflows/publish-plugin-sdk.yml         | 1 +
 .github/workflows/security.yml                   | 3 +++
 .github/workflows/wiki.yml                       | 1 +
 9 files changed, 11 insertions(+)

diff --git a/.github/workflows/close-stale-invalid-titles.yml b/.github/workflows/close-stale-invalid-titles.yml
index fa9fff4d3..9eb1ce338 100644
--- a/.github/workflows/close-stale-invalid-titles.yml
+++ b/.github/workflows/close-stale-invalid-titles.yml
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   close-stale:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - name: Close stale invalid-title issues
diff --git a/.github/workflows/close-stale-wrong-branch.yml b/.github/workflows/close-stale-wrong-branch.yml
index f0e133d6f..c1a41a3cd 100644
--- a/.github/workflows/close-stale-wrong-branch.yml
+++ b/.github/workflows/close-stale-wrong-branch.yml
@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   close-stale:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - name: Close stale wrong-base-branch PRs
diff --git a/.github/workflows/close-untitled-issues.yml b/.github/workflows/close-untitled-issues.yml
index a9a94e950..0cd817682 100644
--- a/.github/workflows/close-untitled-issues.yml
+++ b/.github/workflows/close-untitled-issues.yml
@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   check-title:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - name: Flag or redirect issue
diff --git a/.github/workflows/docker-dev.yml b/.github/workflows/docker-dev.yml
index 935e30889..d2e3ed070 100644
--- a/.github/workflows/docker-dev.yml
+++ b/.github/workflows/docker-dev.yml
@@ -18,6 +18,7 @@ concurrency:
 
 jobs:
   version-bump:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5014cca77..bd31e32f3 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -33,6 +33,7 @@ concurrency:
 
 jobs:
   version-bump:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
diff --git a/.github/workflows/enforce-target-branch.yml b/.github/workflows/enforce-target-branch.yml
index f549ad631..54e3a0ecb 100644
--- a/.github/workflows/enforce-target-branch.yml
+++ b/.github/workflows/enforce-target-branch.yml
@@ -6,6 +6,7 @@ on:
 
 jobs:
   check-target:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
diff --git a/.github/workflows/publish-plugin-sdk.yml b/.github/workflows/publish-plugin-sdk.yml
index 7be1cb01c..705771351 100644
--- a/.github/workflows/publish-plugin-sdk.yml
+++ b/.github/workflows/publish-plugin-sdk.yml
@@ -14,6 +14,7 @@ permissions:
 
 jobs:
   publish:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     defaults:
       run:
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 88755200a..af22f82a0 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -11,6 +11,9 @@ permissions:
 
 jobs:
   scout:
+    # Docker Hub secrets are not exposed to pull requests from forks, so the
+    # Scout login can never succeed there.
+    if: github.repository == 'mauriceboe/TREK' && github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/wiki.yml b/.github/workflows/wiki.yml
index 3526e38eb..8c6974520 100644
--- a/.github/workflows/wiki.yml
+++ b/.github/workflows/wiki.yml
@@ -17,6 +17,7 @@ concurrency:
 
 jobs:
   deploy:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4