Block fork pull request workflow jobs

[harjotgill]

Summary

• Skip GitHub Actions jobs for pull requests opened from forks.
• Keep push, merge queue, issue, and same-repository pull request behavior unchanged.

Why

Public fork pull requests can run attacker-controlled workflow code. Skipping those jobs prevents those pull requests from reaching repository secrets through GitHub Actions.

Validation

• Parsed the changed workflow files with yq e '.'.

Summary by CodeRabbit

• Chores
  • Optimized GitHub Actions workflow conditions to improve CI/CD pipeline efficiency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: dfe167ae-35ea-4981-84da-5aa390a9633a

📥 Commits

Reviewing files that changed from the base of the PR and between c28558a and 9ad8fb8.

📒 Files selected for processing (1)

• .github/workflows/coverage.yaml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: coverage

🧰 Additional context used

🔀 Multi-repo context coderabbitai/bitbucket

Linked repositories findings

coderabbitai/bitbucket

• Workflows referencing repository secrets (will be protected by the PR's change to skip fork PR jobs):

  • .github/workflows/pnpm-publish.yaml — uses NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} and CODERABBIT_NPM_TOKEN: ${{ secrets.CODERABBIT_NPM_TOKEN }}. [::coderabbitai/bitbucket::.github/workflows/pnpm-publish.yaml:37,45]
  • .github/workflows/node.js.yaml — exposes several secrets (TWINGATE_SERVICE_KEY, BITBUCKET_CLOUD_USERNAME, BITBUCKET_CLOUD_APP_PASSWORD, BITBUCKET_SERVER_URL, BITBUCKET_SERVER_TOKEN). [::coderabbitai/bitbucket::.github/workflows/node.js.yaml:36,51-54]

• No coverage.yaml present in this repo (the PR's modified file .github/workflows/coverage.yaml is not found here). [::coderabbitai/bitbucket::root]

• Codebase contains references to "secrets" in generated API/types (documentation strings), but these are unrelated to workflow execution: src/server/openapi/openapi-typescript.ts and src/server/openapi/swagger.v3.json. [::coderabbitai/bitbucket::src/server/openapi/openapi-typescript.ts:5969,6560] [::coderabbitai/bitbucket::src/server/openapi/swagger.v3.json:48372,51653]

Summary: The repository contains GitHub Actions workflows that consume repository secrets; the PR's change to skip jobs for fork pull requests will prevent those secrets from being exposed to forked-PR workflows. No other cross-repo consumers or shared contracts were found.

🔇 Additional comments (1)

.github/workflows/coverage.yaml (1)

12-12: Good fork-PR job guard implementation.

The condition correctly skips jobs for fork-origin pull_request events while preserving push and same-repo PR behavior.

Also applies to: 32-32

---

📝 Walkthrough

Walkthrough

This PR adds conditional execution guards to two GitHub Actions workflow jobs. Both the coverage and check jobs now include an if: condition to prevent execution when a pull request originates from a fork repository, allowing them to run only for same-repository PRs or non-PR triggers.

Changes

Workflow Job Execution Gating

Layer / File(s)	Summary
Job conditional execution .github/workflows/coverage.yaml	Conditional logic added to both coverage (line 12) and check (line 32) jobs using github.event.pull_request to gate execution based on repository ownership.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 Two jobs now guard the gate with care,
Only branches from home can pass through there,
Forks and strangers kindly wait outside,
While trusted paths flow smooth inside! ✨

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: blocking fork pull request workflow jobs to prevent unauthorized access to repository secrets.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch coderabbit/actions-lockdown-external-prs

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch coderabbit/actions-lockdown-external-prs

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}