From 9fd6727d6e13434e672ad6ff31da31903ac0d0e5 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 14 Sep 2026 10:05:58 -0600 Subject: [PATCH 1/2] fix: add skip publish on fork pr builds Signed-off-by: Sean Tronsen --- .../build-publish-container-goreleaser.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-publish-container-goreleaser.yml b/.github/workflows/build-publish-container-goreleaser.yml index 8d763fc..8138ec8 100644 --- a/.github/workflows/build-publish-container-goreleaser.yml +++ b/.github/workflows/build-publish-container-goreleaser.yml @@ -49,7 +49,17 @@ jobs: driver-opts: | image=moby/buildkit:master network=host + - name: Check if fork PR + run: | + if [[ "${{ github.event_name }}" == "pull_request" && \ + "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then + echo "SKIP_CONTAINER_PUBLISH=true" >> "${GITHUB_ENV}" + echo "::warning title=Fork PR - Container Publish Skipped::Containers will be built but not published for fork PRs due to GitHub security restrictions." + else + echo "SKIP_CONTAINER_PUBLISH=false" >> "${GITHUB_ENV}" + fi - name: Docker Login + if: env.SKIP_CONTAINER_PUBLISH == 'false' uses: docker/login-action@v3 with: registry: ghcr.io @@ -88,9 +98,10 @@ jobs: GITHUB_TOKEN: ${{ github.token }} with: version: '~> 2' - args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }} + args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }} id: goreleaser - name: Process goreleaser output + if: env.SKIP_CONTAINER_PUBLISH == 'false' id: process_goreleaser_output run: | node - <<'EOF' @@ -102,10 +113,12 @@ jobs: EOF echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}" - name: Attest Binaries + if: env.SKIP_CONTAINER_PUBLISH == 'false' uses: actions/attest-build-provenance@v4.1.0 with: subject-path: dist/** - name: generate build provenance + if: env.SKIP_CONTAINER_PUBLISH == 'false' uses: actions/attest-build-provenance@v4.1.0 with: subject-name: ${{ inputs.registry_subject_name }} From d8304beb7737c9e557f41f0e3e6c48f7173e5d96 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 15 Sep 2026 08:37:40 -0600 Subject: [PATCH 2/2] fix: disable attestation and provenance in pr builds Signed-off-by: Sean Tronsen --- .github/workflows/build-publish-container-goreleaser.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-publish-container-goreleaser.yml b/.github/workflows/build-publish-container-goreleaser.yml index 8138ec8..be5da86 100644 --- a/.github/workflows/build-publish-container-goreleaser.yml +++ b/.github/workflows/build-publish-container-goreleaser.yml @@ -113,12 +113,12 @@ jobs: EOF echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}" - name: Attest Binaries - if: env.SKIP_CONTAINER_PUBLISH == 'false' + if: ${{ (env.SKIP_CONTAINER_PUBLISH == 'false') && (inputs.is_pr_build == false) }} uses: actions/attest-build-provenance@v4.1.0 with: subject-path: dist/** - name: generate build provenance - if: env.SKIP_CONTAINER_PUBLISH == 'false' + if: ${{ (env.SKIP_CONTAINER_PUBLISH == 'false') && (inputs.is_pr_build == false) }} uses: actions/attest-build-provenance@v4.1.0 with: subject-name: ${{ inputs.registry_subject_name }}