From 991823816a68fa038b5f0a83a1a0ba067e03d265 Mon Sep 17 00:00:00 2001 From: mintaka Date: Wed, 16 Sep 2026 22:04:52 -0400 Subject: [PATCH] ci(release): gate release-pr to the main ref (RIG-3813) `release.yml` accepts `workflow_dispatch` from any ref, but `release-pr` was the one sensitive job in the file with no `if:` guard. It holds `contents: write` + `pull-requests: write`, mints the release-please App token, and is the sole `vX.Y.Z` tag minter. release-please also defaults its `target-branch` to the repository default branch, so the dispatched ref did not scope what the job acted on: a dispatch from a feature branch would cut a real release from `main`. Gate it the way `publish-image`, `release-assets`, `release-image` and `publish-runner-image` already are, and pin `target-branch: main` explicitly so the release branch is stated rather than inferred. Every job in the file now carries an explicit guard. This also makes the dispatch-only `agent-image-arm64-spike` job safe to run from a non-main ref, which it was not before: the two jobs share the workflow, so any dispatch previously started `release-pr` alongside the spike. Scope: this governs future dispatches. Re-running a historical run replays that run's own workflow definition, so the guard cannot retroactively cover a pre-existing run. Co-authored-by: Matt Wilkinson --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e2de881..a5f774db 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -79,6 +79,10 @@ jobs: release-pr: name: release-pr runs-on: ubuntu-latest + # workflow_dispatch accepts any ref, and release-please defaults its + # target-branch to the default branch. Require main so no other ref can + # cut a release. + if: github.ref == 'refs/heads/main' # Cut/refresh the standing Release PR and, on its merge commit, the vX.Y.Z # tag + GitHub Release. The Release is created as a DRAFT here and is # published only later by release-assets, once every asset is attached. @@ -118,6 +122,9 @@ jobs: token: ${{ steps.app-token.outputs.token }} config-file: release-please-config.json manifest-file: .release-please-manifest.json + # Pinned, not left to the action's default-branch default, so the + # branch it releases from is stated rather than inferred. + target-branch: main publish-image: name: publish-image