From 13a9f6402fb77a31499bf758b56ca42b79936706 Mon Sep 17 00:00:00 2001
From: Ogulcan Celik <ogulcancelik@gmail.com>
Date: Fri, 28 Aug 2026 18:05:29 +0300
Subject: ci: restrict release workflows to canonical repository

---
 .github/workflows/preview.yml | 5 +++--
 .github/workflows/release.yml | 6 ++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index e5e8c3f7..f2314dcf 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -21,6 +21,7 @@ concurrency:
 
 jobs:
   preflight:
+    if: github.repository == 'herdrdev/herdr'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -118,7 +119,7 @@ jobs:
 
   build:
     needs: preflight
-    if: needs.preflight.outputs.should_publish == 'true'
+    if: github.repository == 'herdrdev/herdr' && needs.preflight.outputs.should_publish == 'true'
     permissions:
       contents: read
     strategy:
@@ -284,7 +285,7 @@ jobs:
 
   publish:
     needs: [preflight, build]
-    if: needs.preflight.outputs.should_publish == 'true'
+    if: github.repository == 'herdrdev/herdr' && needs.preflight.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     concurrency:
       group: docs-publish-master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1318e138..a7cc3558 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,7 @@ env:
 
 jobs:
   flake-check:
+    if: github.repository == 'herdrdev/herdr'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -36,6 +37,7 @@ jobs:
           nix flake check --all-systems --no-build --print-build-logs
 
   build:
+    if: github.repository == 'herdrdev/herdr'
     permissions:
       contents: read
     strategy:
@@ -181,6 +183,7 @@ jobs:
           path: ${{ matrix.name }}
 
   validate-release-inputs:
+    if: github.repository == 'herdrdev/herdr'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -204,6 +207,7 @@ jobs:
 
   release:
     needs: [build, flake-check, validate-release-inputs]
+    if: github.repository == 'herdrdev/herdr'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -232,6 +236,7 @@ jobs:
 
   close-released-issues:
     needs: release
+    if: github.repository == 'herdrdev/herdr'
     runs-on: ubuntu-latest
     continue-on-error: true
     permissions:
@@ -368,6 +373,7 @@ jobs:
 
   update-latest-json:
     needs: release
+    if: github.repository == 'herdrdev/herdr'
     runs-on: ubuntu-latest
     concurrency:
       group: docs-publish-master
-- 
cgit v1.2.3