Skip to content

[SPIKE] Gate secret-dependent workflows for fork PRs#1732

Closed
vivekr-splunk wants to merge 1 commit intodevelopfrom
spike/fork-pr-secret-guard
Closed

[SPIKE] Gate secret-dependent workflows for fork PRs#1732
vivekr-splunk wants to merge 1 commit intodevelopfrom
spike/fork-pr-secret-guard

Conversation

@vivekr-splunk
Copy link
Collaborator

@vivekr-splunk vivekr-splunk commented Feb 26, 2026

Summary

This spike updates PR workflows so external fork PRs do not fail on missing secrets.

What changed

  • Added trust guards for secret-dependent jobs in:
    • .github/workflows/build-test-push-workflow.yml
    • .github/workflows/distroless-build-test-push-workflow.yml
    • .github/workflows/prodsec-workflow.yml
  • Coveralls/FOSSA and AWS/ECR dependent jobs now run only for:
    • push events, or
    • pull requests where head.repo.full_name == github.repository

Expected behavior

  • External contributors from forks: non-secret checks run; secret-dependent jobs are skipped.
  • Internal PRs and branch pushes: full pipeline remains active.

Notes

This is intentionally a spike PR to validate required-check behavior with branch protection settings.

@github-actions github-actions bot locked and limited conversation to collaborators Feb 26, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant