ci(workflows): guard privileged workflows against running in forks

.github/workflows/auto-docs.yml

@@ -25,6 +25,7 @@ concurrency:
 
 jobs:
   call-valtown:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ubuntu-latest
     timeout-minutes: 5
 

.github/workflows/bump-openclaw.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   check:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 10
     steps:

.github/workflows/check-md-table-padding.yml

@@ -9,6 +9,9 @@ on:
 jobs:
   check:
     name: Check markdown table padding
+    # Canonical-repo guard: no-op for pull_request (runs in the base-repo
+    # context, where validation is desired); skips manual dispatch runs in forks.
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/codeql.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 30
     strategy:

.github/workflows/deploy-kiloclaw.yml

@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   deploy:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 30
     name: Deploy KiloClaw
@@ -251,7 +252,7 @@ jobs:
   # when its content was last built, so we don't pull a large unchanged image.
   attest-sbom:
     needs: deploy
-    if: needs.deploy.outputs.image-built == 'true' && needs.deploy.outputs.image-digest != ''
+    if: github.repository == 'Kilo-Org/cloud' && needs.deploy.outputs.image-built == 'true' && needs.deploy.outputs.image-digest != ''
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     name: Attest image SBOM
@@ -291,6 +292,7 @@ jobs:
   # continue-on-error ensures a dev push failure never blocks prod.
   push-dev-image:
     needs: [deploy]
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 10
     name: Push Dev Image

.github/workflows/deploy-production.yml

@@ -20,6 +20,7 @@ env:
 
 jobs:
   check-production-db-startup:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     environment: production
@@ -50,6 +51,7 @@ jobs:
         run: NODE_ENV=production pnpm exec tsx scripts/check-production-db-startup.ts
 
   run-migrations:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     environment: production
@@ -80,6 +82,7 @@ jobs:
         run: NODE_ENV=production pnpm run drizzle migrate
 
   stage-app:
+    if: github.repository == 'Kilo-Org/cloud'
     uses: ./.github/workflows/stage-vercel-deployment.yml
     with:
       target_environment: production
@@ -88,6 +91,7 @@ jobs:
       VERCEL_PROJECT_TOKEN: ${{ secrets.VERCEL_TOKEN_APP }}
 
   stage-global-app:
+    if: github.repository == 'Kilo-Org/cloud'
     uses: ./.github/workflows/stage-vercel-deployment.yml
     with:
       target_environment: production
@@ -96,6 +100,7 @@ jobs:
       VERCEL_PROJECT_TOKEN: ${{ secrets.VERCEL_TOKEN_GLOBAL_APP }}
 
   promote-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: [stage-app, check-production-db-startup, run-migrations]
     uses: ./.github/workflows/promote-vercel-deployment.yml
     with:
@@ -106,6 +111,7 @@ jobs:
       VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
 
   promote-global-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: [stage-global-app, check-production-db-startup, run-migrations]
     uses: ./.github/workflows/promote-vercel-deployment.yml
     with:
@@ -114,6 +120,7 @@ jobs:
       VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
 
   resolve-worker-base:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 5
     outputs:
@@ -153,6 +160,7 @@ jobs:
       ]
     if: >-
       ${{
+        github.repository == 'Kilo-Org/cloud' &&
         !cancelled() &&
         needs.check-production-db-startup.result == 'success' &&
         needs.run-migrations.result == 'success' &&
@@ -168,6 +176,7 @@ jobs:
     secrets: inherit
 
   detect-gastown-wasteland-changes:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: resolve-worker-base
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 5
@@ -244,6 +253,7 @@ jobs:
       ]
     if: >-
       ${{
+        github.repository == 'Kilo-Org/cloud' &&
         !cancelled() &&
         needs.check-production-db-startup.result == 'success' &&
         needs.run-migrations.result == 'success' &&
@@ -300,6 +310,7 @@ jobs:
         run: pnpm --filter cloudflare-gastown sentry:sourcemaps
 
   deploy-kiloclaw:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: [check-production-db-startup, run-migrations]
     # Ceiling for the reusable workflow's GITHUB_TOKEN (a called workflow cannot
     # exceed the caller). The reusable workflow restricts further per job — only

.github/workflows/deploy-staging.yml

@@ -16,6 +16,7 @@ concurrency:
 
 jobs:
   check-staging-db-startup:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     environment: staging
@@ -46,6 +47,7 @@ jobs:
         run: NODE_ENV=production pnpm exec tsx scripts/check-production-db-startup.ts
 
   run-migrations:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     environment: staging
@@ -76,6 +78,7 @@ jobs:
         run: NODE_ENV=production pnpm run drizzle migrate
 
   deploy-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: [check-staging-db-startup, run-migrations]
     uses: ./.github/workflows/stage-vercel-deployment.yml
     with:
@@ -85,6 +88,7 @@ jobs:
       VERCEL_PROJECT_TOKEN: ${{ secrets.VERCEL_TOKEN_APP }}
 
   deploy-global-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: [check-staging-db-startup, run-migrations]
     uses: ./.github/workflows/stage-vercel-deployment.yml
     with:
@@ -94,6 +98,7 @@ jobs:
       VERCEL_PROJECT_TOKEN: ${{ secrets.VERCEL_TOKEN_GLOBAL_APP }}
 
   deploy-workers:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: [check-staging-db-startup, run-migrations, deploy-app, deploy-global-app]
     uses: ./.github/workflows/deploy-workers.yml
     with:

.github/workflows/deploy-workers.yml

@@ -42,7 +42,7 @@ concurrency:
 
 jobs:
   deploy-manual:
-    if: inputs.worker != ''
+    if: github.repository == 'Kilo-Org/cloud' && inputs.worker != ''
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     name: Deploy ${{ inputs.worker }}
@@ -76,7 +76,7 @@ jobs:
           command: ${{ inputs.target_environment == 'production' && 'deploy' || format('deploy --env {0}', inputs.target_environment) }}
 
   detect-changes:
-    if: inputs.worker == '' && (inputs.base_sha != '' || inputs.target_environment != 'production')
+    if: github.repository == 'Kilo-Org/cloud' && inputs.worker == '' && (inputs.base_sha != '' || inputs.target_environment != 'production')
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 5
     outputs:
@@ -213,7 +213,7 @@ jobs:
 
   deploy-changed:
     needs: detect-changes
-    if: needs.detect-changes.outputs.matrix != '[]' && needs.detect-changes.outputs.matrix != ''
+    if: github.repository == 'Kilo-Org/cloud' && needs.detect-changes.outputs.matrix != '[]' && needs.detect-changes.outputs.matrix != ''
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     environment: ${{ inputs.target_environment }}

.github/workflows/extension-store-release.yml

@@ -18,6 +18,7 @@ permissions:
 
 jobs:
   build-artifacts:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 30
     env:
@@ -87,7 +88,7 @@ jobs:
     needs: build-artifacts
     # Only a main dispatch bumps: a branch dispatch would open a PR carrying
     # unrelated commits.
-    if: github.ref == 'refs/heads/main'
+    if: github.repository == 'Kilo-Org/cloud' && github.ref == 'refs/heads/main'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 10
     permissions:

.github/workflows/kilo-app-release.yml

@@ -29,6 +29,7 @@ permissions:
 
 jobs:
   check-changes:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 5
     permissions:
@@ -86,11 +87,12 @@ jobs:
           fi
 
   validate:
+    if: github.repository == 'Kilo-Org/cloud'
     uses: ./.github/workflows/kilo-app-ci.yml
 
   preflight:
     needs: [check-changes]
-    if: needs.check-changes.outputs.should_build == 'true' && github.ref == 'refs/heads/main'
+    if: github.repository == 'Kilo-Org/cloud' && needs.check-changes.outputs.should_build == 'true' && github.ref == 'refs/heads/main'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     permissions:
@@ -155,7 +157,7 @@ jobs:
 
   build-and-submit:
     needs: [check-changes, validate, preflight]
-    if: needs.check-changes.outputs.should_build == 'true' && github.ref == 'refs/heads/main'
+    if: github.repository == 'Kilo-Org/cloud' && needs.check-changes.outputs.should_build == 'true' && github.ref == 'refs/heads/main'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 60
     steps:
@@ -241,7 +243,7 @@ jobs:
   # The build number is not bumped here; EAS auto-increments it remotely.
   bump-version:
     needs: [check-changes]
-    if: needs.check-changes.outputs.should_build == 'true' && github.ref == 'refs/heads/main'
+    if: github.repository == 'Kilo-Org/cloud' && needs.check-changes.outputs.should_build == 'true' && github.ref == 'refs/heads/main'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 10
     permissions:

.github/workflows/promote-vercel-deployment.yml

@@ -30,6 +30,7 @@ permissions:
 
 jobs:
   promote:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 15
     environment: production

.github/workflows/push-dev-kiloclaw.yml

@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   push-dev:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 30
     name: Build & Push Dev Image

.github/workflows/redeploy-web.yml

@@ -12,6 +12,7 @@ concurrency:
 
 jobs:
   verify-main:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 5
 
@@ -24,6 +25,7 @@ jobs:
           fi
 
   stage-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: verify-main
     uses: ./.github/workflows/stage-vercel-deployment.yml
     with:
@@ -33,6 +35,7 @@ jobs:
       VERCEL_PROJECT_TOKEN: ${{ secrets.VERCEL_TOKEN_APP }}
 
   stage-global-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: verify-main
     uses: ./.github/workflows/stage-vercel-deployment.yml
     with:
@@ -42,6 +45,7 @@ jobs:
       VERCEL_PROJECT_TOKEN: ${{ secrets.VERCEL_TOKEN_GLOBAL_APP }}
 
   promote-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: stage-app
     uses: ./.github/workflows/promote-vercel-deployment.yml
     with:
@@ -52,6 +56,7 @@ jobs:
       VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
 
   promote-global-app:
+    if: github.repository == 'Kilo-Org/cloud'
     needs: stage-global-app
     uses: ./.github/workflows/promote-vercel-deployment.yml
     with:

.github/workflows/sbom.yml

@@ -22,6 +22,7 @@ permissions:
 
 jobs:
   source-sbom:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 10
     name: Source dependency SBOM

.github/workflows/setup-smoke.yml

@@ -25,6 +25,9 @@ concurrency:
 
 jobs:
   setup-smoke:
+    # Canonical-repo guard: no-op for pull_request (runs in the base-repo
+    # context, where validation is desired); skips schedule/dispatch runs in forks.
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_LARGE_LABEL || 'ubuntu-24.04-8core' }}
     timeout-minutes: 45
 

.github/workflows/stage-vercel-deployment.yml

@@ -25,6 +25,7 @@ permissions:
 
 jobs:
   stage:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     timeout-minutes: 30
     environment: ${{ inputs.target_environment }}

.github/workflows/stale-prs.yaml

@@ -6,6 +6,7 @@ on:
 
 jobs:
   stale:
+    if: github.repository == 'Kilo-Org/cloud'
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}
     permissions:
       issues: write