From 0f1ffd515711514097249a6b51f78e60c9f96013 Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:47:00 -0400 Subject: [PATCH 1/3] security: add same-repo PR guard to base120.yml P1 mitigation from runner fleet wargame (2026-07-23). Adds `if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository` to 2 job(s) running on self-hosted runners. This blocks fork PRs from triggering CI on persistent self-hosted runners while preserving CI for same-repo branches. Fork PRs will rely on post-merge validation (push to main) instead. --- .github/workflows/base120.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/base120.yml b/.github/workflows/base120.yml index 980a327..d2d50e4 100644 --- a/.github/workflows/base120.yml +++ b/.github/workflows/base120.yml @@ -14,6 +14,7 @@ on: jobs: mirror-guard: + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: [self-hosted, Linux, X64, wsl, base120] steps: - uses: actions/checkout@v6.0.3 @@ -25,6 +26,7 @@ jobs: fi test: + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: [self-hosted, Linux, X64, wsl, base120] steps: - uses: actions/checkout@v6.0.3 From 399b6bea9a8eefe28478c75d8f4f52c5c93654c2 Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:47:01 -0400 Subject: [PATCH 2/3] security: add same-repo PR guard to ci.yml P1 mitigation from runner fleet wargame (2026-07-23). Adds `if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository` to 1 job(s) running on self-hosted runners. This blocks fork PRs from triggering CI on persistent self-hosted runners while preserving CI for same-repo branches. Fork PRs will rely on post-merge validation (push to main) instead. --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 378b01c..2f89d51 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,7 @@ on: jobs: test: + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: [self-hosted, Linux, X64, wsl, base120] strategy: matrix: From 1af66216595b6e73eaf3c6c3a3598f80bd8912a2 Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:47:02 -0400 Subject: [PATCH 3/3] security: add same-repo PR guard to guardrails.yml P1 mitigation from runner fleet wargame (2026-07-23). Adds `if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository` to 1 job(s) running on self-hosted runners. This blocks fork PRs from triggering CI on persistent self-hosted runners while preserving CI for same-repo branches. Fork PRs will rely on post-merge validation (push to main) instead. --- .github/workflows/guardrails.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/guardrails.yml b/.github/workflows/guardrails.yml index 5fea8e7..04d8679 100644 --- a/.github/workflows/guardrails.yml +++ b/.github/workflows/guardrails.yml @@ -11,6 +11,7 @@ on: jobs: corpus: + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: [self-hosted, Linux, X64, wsl, base120] steps: - uses: actions/checkout@v6.0.3