Skip to content

ci(workflows): guard privileged workflows against running in forks - #6249

Closed
maphew wants to merge 1 commit into
Kilo-Org:mainfrom
maphew:fix/workflow-fork-guard
Closed

maphew wants to merge 1 commit into
Kilo-Org:mainfrom
maphew:fix/workflow-fork-guard

Conversation

@maphew

@maphew maphew commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds if: github.repository == 'Kilo-Org/cloud' to the jobs of workflows that must only run in the canonical repository, combining with existing if: conditions where present. Mirrors the long-standing Kilo-Org/kilocode convention.

Guarded (44 jobs across 17 files): auto-docs, bump-openclaw, check-md-table-padding, codeql, deploy-production, deploy-staging, deploy-workers, deploy-kiloclaw, extension-store-release, kilo-app-release, promote-vercel-deployment, push-dev-kiloclaw, redeploy-web, sbom, setup-smoke, stage-vercel-deployment, stale-prs.

Intentionally not guarded: ci.yml, extension-ci.yml, kilo-app-ci.yml, mobile-native-build.yml, chromatic.yml, trufflehog.yml. For pull_request events github.repository is the base repo, so a guard there is a no-op for normal CI and would only turn an approved fork-PR run into a wall of skipped jobs. Kilocode likewise does not guard its test/typecheck workflows. See #6248 for the rationale and scope.

The action_required runs on fork PRs are GitHub's Settings → Actions → General → Fork pull request workflows gate and cannot be changed from workflow code; this PR does not affect them.

Closes #6248

Verification

  • git diff --check is clean and the changed files contain no tabs.
  • Reviewed the full diff: 36 new if: guards plus 8 existing if: lines extended with the repo check; no structural or formatting changes.
  • Could not run pnpm format/pnpm format:check, actionlint, or a YAML parse in this environment: there is no node_modules and no YAML parser available. Behavior is unchanged for every event in Kilo-Org/cloud (the guard only evaluates false when the run executes inside a fork), but please let CI validate the YAML.

Visual Changes

N/A

Reviewer Notes

  • To actually stop fork-PR runs (rather than keep them approval-gated), a maintainer needs the repo settings change noted above.
  • check-md-table-padding.yml is guarded to match its kilocode counterpart; the guard still passes for base-repo PRs.

Comment thread .github/workflows/check-md-table-padding.yml
Comment thread .github/workflows/setup-smoke.yml
@kilo-code-bot

kilo-code-bot Bot commented Sep 16, 2026 •

Copy link
Copy Markdown
Contributor

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Full re-review of the 17 workflow files that add github.repository == 'Kilo-Org/cloud' job guards at HEAD 3dd3d76a5665c79352fc4b6fe54ab806614731cf; every guard is well-formed, prepended with && to any existing condition, and behavior-neutral for canonical-repo runs, so no new findings were raised.

Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Verification Notes

  • HEAD 3dd3d76a5665c79352fc4b6fe54ab806614731cf confirmed before and after analysis.
  • The previous review SHA fafd2bd is not an ancestor of HEAD, so the incremental range was unavailable and a full review of the PR diff was used. A net diff between the two heads touches only unrelated main changes in cloud-agent-e2e-tests.yml; the 17 guard files are otherwise unchanged from the previously approved revision.
  • All 36 new guards and 8 extended if: conditions are well-formed: no job has a duplicate if: key, and the repo check is always prepended with &&.
  • github.repository resolves to the base repo for pull_request events, so no upstream or fork PR loses a status check; for push/schedule/workflow_dispatch in a fork the guard correctly skips the job.
  • All callers of the guarded reusable workflows (stage-vercel-deployment.yml, promote-vercel-deployment.yml, deploy-workers.yml, deploy-kiloclaw.yml) are in-repo ./.github/workflows/... references, so the guards cannot break cross-repo workflow_call.
  • The two active pull_request no-op suggestions and the outdated trigger-wording suggestion are resolved in-file (check-md-table-padding.yml:12-13, setup-smoke.yml:28-29); no new inline comments were posted.
  • The kilocode-landing SEO rules, the markdown-image rule, and the memory-leak check do not apply to this PR (workflow YAML only, no landing pages, no runtime code).
Previous Review Summaries (7 snapshots, latest commit fafd2bd)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit fafd2bd)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Re-reviewed the 17 workflow files that add github.repository == 'Kilo-Org/cloud' job guards at HEAD fafd2bd66841ad139e6912da6781b70033de2359; the guard lines are unchanged from the previously approved revision (the rebase only pulled in unrelated main changes), so no new findings were raised.

Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Verification Notes

  • HEAD fafd2bd66841ad139e6912da6781b70033de2359 confirmed before and after analysis.
  • Incremental range was unavailable (the branch was rebased, so 46c5cbe is not an ancestor of HEAD); the net diff of the PR's 17 files between the two heads contains no github.repository guard changes, only unrelated main updates.
  • All callers of the guarded reusable workflows (stage-vercel-deployment.yml, promote-vercel-deployment.yml, deploy-workers.yml, deploy-kiloclaw.yml, kilo-app-ci.yml) are in-repo ./.github/workflows/... references, so the guards cannot break cross-repo workflow_call.
  • github.repository resolves to the base repo for pull_request events, so no fork PR loses a status check; for push/schedule/workflow_dispatch in a fork the guard correctly skips the job.
  • No new inline comments were posted; the two active pull_request no-op suggestions remain covered by the in-file comments added earlier.
  • The kilocode-landing SEO rules, the markdown-image rule, and the memory-leak check do not apply to this PR (workflow YAML only, no landing pages, no runtime code).

Previous review (commit 46c5cbe)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Re-reviewed the 17 workflow files that add github.repository == 'Kilo-Org/cloud' job guards at HEAD 46c5cbe; the guards stay behavior-neutral for canonical-repo runs and the previously reported comment inaccuracies are now fixed, so no new findings were raised.

Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Verification Notes

  • HEAD 46c5cbeeb5955c444097ec2ca7db521ded8332ca confirmed before and after analysis.
  • Full re-review was used because the incremental revision range was unavailable (local fetch returned HTTP 429).
  • All guards prepend the repo check with && to any existing if: expression; no job has a duplicate if: key and no YAML structure changed.
  • github.repository resolves to the base repo for pull_request events, so no fork PR loses a status check; for push/schedule/workflow_dispatch in a fork the guard correctly skips the job.
  • All callers of the guarded reusable workflows (stage-vercel-deployment.yml, promote-vercel-deployment.yml, deploy-workers.yml, deploy-kiloclaw.yml) are in-repo ./.github/workflows/... references, so the guards cannot break cross-repo workflow_call.
  • The earlier comment findings are resolved: check-md-table-padding.yml:13 now reads skips manual dispatch runs in forks (accurate for its pull_request + workflow_dispatch triggers) and setup-smoke.yml:28-29 documents the pull_request no-op. No new inline comments were posted.

Previous review (commit ed1bcb3)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only incremental change since the prior review is a one-line comment correction in .github/workflows/check-md-table-padding.yml, which fixes the previously reported trigger-reference inaccuracy; no new issues were introduced.

Files Reviewed (1 file)
  • .github/workflows/check-md-table-padding.yml - 0 issues (previously reported comment inaccuracy now resolved)

Verification Notes

  • HEAD ed1bcb383bc608f71b755c97cd89afdc0158c662 confirmed before and after analysis.
  • Incremental diff since cabdd36cca38e575223e12415d9258de53ac995f touches only the guard comment on line 13, now reading skips manual dispatch runs in forks.
  • The corrected wording is accurate: the workflow declares only pull_request (base-repo context, so the guard is a no-op) and workflow_dispatch triggers, so the guard does skip manual-dispatch runs launched from a fork.
  • No other files changed; findings from unchanged files are not carried forward in incremental mode. No new inline comments were posted.

Previous review (commit cabdd36)

Status: 1 Issues Found | Recommendation: Address before merge

Executive Summary

The 17 fork guards remain functionally correct and behavior-neutral for canonical-repo runs; the only new finding is an inaccurate trigger reference in a comment added by this PR.

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 1
Issue Details (click to expand)

SUGGESTION

File Line Issue
.github/workflows/check-md-table-padding.yml 13 Added comment says the guard "skips schedule/dispatch runs in forks", but this workflow has no schedule trigger (only pull_request and workflow_dispatch)

Verification Notes

  • HEAD cabdd36cca38e575223e12415d9258de53ac995f confirmed before and after analysis.
  • All 36 new guards and 8 extended if: conditions are well-formed; no job block has a duplicate if: key, and the repo check is always prepended with && to the existing condition.
  • No reusable workflow changed here is called from another repository (all callers are ./.github/workflows/...), so the guards cannot break cross-repo workflow_call invocations.
  • Behavior for canonical-repo runs is unchanged; github.repository resolves to the base repo for pull_request events, so no fork PR loses a status check.
  • The two earlier pull_request no-op observations are now documented in-file and are not re-raised.
  • The kilocode-landing SEO rules and the memory-leak check do not apply to this PR (workflow YAML only, no landing pages or runtime code).

Fix these issues in Kilo Cloud

Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml - 1 suggestion
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Previous review (commit ece9425)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Re-reviewed the 17 workflow files that add github.repository == 'Kilo-Org/cloud' job guards; the guards are consistent, do not create duplicate if: keys, and do not change behavior for canonical-repo runs, and the two earlier pull_request no-op observations are now documented in-file.

Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Previous review (commit 3c6fc28)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The fork-guard changes are limited to job-level if conditions in 17 workflow files; the two follow-up comment additions resolve the earlier pull_request no-op observations, and no new issues were found in the changed lines.

Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Previous review (commit a546d1f)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 2
Issue Details (click to expand)

SUGGESTION

File Line Issue
.github/workflows/check-md-table-padding.yml 12 Guard is inert for the pull_request trigger; only gates workflow_dispatch
.github/workflows/setup-smoke.yml 28 Guard does not cover the pull_request path; only affects schedule/workflow_dispatch
Files Reviewed (17 files)
  • .github/workflows/auto-docs.yml
  • .github/workflows/bump-openclaw.yml
  • .github/workflows/check-md-table-padding.yml - 1 suggestion
  • .github/workflows/codeql.yml
  • .github/workflows/deploy-kiloclaw.yml
  • .github/workflows/deploy-production.yml
  • .github/workflows/deploy-staging.yml
  • .github/workflows/deploy-workers.yml
  • .github/workflows/extension-store-release.yml
  • .github/workflows/kilo-app-release.yml
  • .github/workflows/promote-vercel-deployment.yml
  • .github/workflows/push-dev-kiloclaw.yml
  • .github/workflows/redeploy-web.yml
  • .github/workflows/sbom.yml
  • .github/workflows/setup-smoke.yml - 1 suggestion
  • .github/workflows/stage-vercel-deployment.yml
  • .github/workflows/stale-prs.yaml

Notes

  • All 44 added/extended guards use the same condition and are consistent: no job ends up with two if: keys, every job in the affected workflows is guarded, and all callers of the reusable workflows (stage-vercel-deployment.yml, promote-vercel-deployment.yml, deploy-workers.yml, deploy-kiloclaw.yml) live in the base repo, so the guards are a no-op for Kilo-Org/cloud runs.
  • The two findings above are non-blocking: the guards are harmless, they simply do not stop fork-PR runs for the workflows that also trigger on pull_request.

Fix these issues in Kilo Cloud


Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0

Review guidance: REVIEW.md from base branch main

@maphew
maphew force-pushed the fix/workflow-fork-guard branch 4 times, most recently from ece9425 to cabdd36 Compare September 22, 2026 20:39
Comment thread .github/workflows/check-md-table-padding.yml Outdated
@maphew
maphew force-pushed the fix/workflow-fork-guard branch 2 times, most recently from a6a40da to fafd2bd Compare September 23, 2026 20:00
Adds if: github.repository == 'Kilo-Org/cloud' to the jobs of workflows that must only run in the canonical repository, combining with existing if: conditions where present. Mirrors the long-standing Kilo-Org/kilocode convention.

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
@maphew
maphew force-pushed the fix/workflow-fork-guard branch from fafd2bd to 3dd3d76 Compare September 25, 2026 04:34
@maphew

maphew commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #6786, which covers the same 17 workflows with per-job rationale comments and is already rebased onto current main. Closing this older revision to keep one canonical PR for #6248.

@maphew maphew closed this Sep 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci: guard privileged workflows so they cannot run in forks

1 participant