From 9ece01e61e71208cd7fb80a388ed1081c4230b3b Mon Sep 17 00:00:00 2001
From: Fabio Rehm <fgrehm@gmail.com>
Date: Fri, 11 Sep 2026 09:22:57 -0300
Subject: [PATCH] Guard scheduled workflows against forks (#3480)

GitHub runs cron workflows in forks on the default branch. The nightly
publish train, the iOS simulator E2E suite and the marketplace
validation then run in every fork regardless of secrets or runner
access. Gate scheduled runs on github.repository == 'get-bb/bb';
workflow_dispatch, push and pull_request triggers are unaffected.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/marketplace-v2-live.yml |  5 +++++
 .github/workflows/mobile-e2e.yml          |  9 +++++++--
 .github/workflows/publish-bb-app.yml      | 10 ++++++++++
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/marketplace-v2-live.yml b/.github/workflows/marketplace-v2-live.yml
index a27638ad17..037a07dd38 100644
--- a/.github/workflows/marketplace-v2-live.yml
+++ b/.github/workflows/marketplace-v2-live.yml
@@ -11,6 +11,11 @@ permissions:
 jobs:
   validate:
     name: Parse the live v2 marketplace
+    # Scheduled runs are restricted to the canonical repository so that forks,
+    # on which GitHub happily runs cron workflows, do not run the validation
+    # against the upstream marketplace for no benefit. Manual dispatch keeps
+    # working in forks.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'get-bb/bb' }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
diff --git a/.github/workflows/mobile-e2e.yml b/.github/workflows/mobile-e2e.yml
index bb2af6f107..737bc1e976 100644
--- a/.github/workflows/mobile-e2e.yml
+++ b/.github/workflows/mobile-e2e.yml
@@ -53,9 +53,14 @@ env:
 jobs:
   ios:
     name: iOS simulator flows
+    # Scheduled (nightly) runs are restricted to the canonical repository so
+    # that forks, on which GitHub happily runs cron workflows, do not burn
+    # macOS runner time they do not have. Label gating and manual dispatch
+    # keep working in forks.
     if: >-
-      github.event_name != 'pull_request' ||
-      contains(github.event.pull_request.labels.*.name, 'mobile-e2e')
+      github.repository == 'get-bb/bb'
+      && (github.event_name != 'pull_request'
+      || contains(github.event.pull_request.labels.*.name, 'mobile-e2e'))
     runs-on: blacksmith-6vcpu-macos-15
     timeout-minutes: 90
 
diff --git a/.github/workflows/publish-bb-app.yml b/.github/workflows/publish-bb-app.yml
index 4df91f84e0..5e3949bdce 100644
--- a/.github/workflows/publish-bb-app.yml
+++ b/.github/workflows/publish-bb-app.yml
@@ -50,6 +50,12 @@ env:
 jobs:
   publish:
     name: Publish bb-app
+    # Scheduled (nightly) runs are restricted to the canonical repository so
+    # that forks, on which GitHub happily runs cron workflows, do not execute
+    # release jobs that publish to npm, reset the desktop-nightly release and
+    # need signing or notarization secrets they will never have. Manual
+    # workflow_dispatch runs keep working in forks.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'get-bb/bb' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: npm-release
@@ -372,6 +378,10 @@ jobs:
   # docs/bb-release-process.md#publishing-the-plugin-sdk.
   publish-plugin-sdk:
     name: Publish @get-bb/plugin-sdk
+    # Same fork guard as the publish job: this job also runs on the schedule
+    # trigger, while the nightly desktop, iOS and release-publish jobs stay
+    # behind `needs` chains rooted at it.
+    if: ${{ github.event_name != 'schedule' || github.repository == 'get-bb/bb' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: npm-release