From aa948c892d9969dd2095a4cfdc0388a4aaa1195d Mon Sep 17 00:00:00 2001 From: cluny85 Date: Mon, 16 Jun 2025 14:28:20 +0200 Subject: [PATCH] Fix: Restrict publish workflow to repository owner The publish workflow was previously triggered on any tag push. This commit restricts the workflow to only run when the tag is pushed by the repository owner, preventing unauthorized publishing. It also adds `issues:write` permissions for future use. --- .github/workflows/publish.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 45a6ab2..ef59b57 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -11,6 +11,9 @@ on: pull_request: branches: [ master ] +permissions: + issues: write + jobs: build-and-check: runs-on: ubuntu-latest @@ -39,7 +42,7 @@ jobs: name: "📦 Publish Custom Node to registry" needs: build-and-check runs-on: ubuntu-latest - if: startsWith(github.ref, 'refs/tags/') + if: ${{ github.repository_owner == 'cluny85' && startsWith(github.ref, 'refs/tags/') }} steps: - name: Checkout code uses: actions/checkout@v4