From 3a3f1b0459f8c851feb1eb2d59c0d2b7ecd50175 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 2 Oct 2026 14:25:20 -0700 Subject: [PATCH] ci: release-brew accepts only this repository's tag pushes #4737 pinned release-brew's checkout to the triggering commit. A successful fork PR run with a matching workflow and branch name must not reach the tap credentials. Identical to #4738's copy. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-brew.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-brew.yml b/.github/workflows/release-brew.yml index c04f0b4e6e..d31ca30f36 100644 --- a/.github/workflows/release-brew.yml +++ b/.github/workflows/release-brew.yml @@ -33,7 +33,14 @@ permissions: jobs: publish: name: Publish formula to homebrew-tap - if: ${{ github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'moq-') }} + # workflow_run has the base repository's privileges and this job checks out + # the triggering commit, so accept only a successful tag push in this + # repository: a fork PR can rename a workflow and its branch to match. + if: >- + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'push' && + github.event.workflow_run.head_repository.full_name == github.repository && + startsWith(github.event.workflow_run.head_branch, 'moq-') runs-on: ubuntu-latest steps: