Fix: Restrict publish workflow to repository owner

The publish workflow was previously triggered on any tag push. This commit restricts the workflow to only run when the tag is pushed by the repository owner, preventing unauthorized publishing. It also adds `issues:write` permissions for future use.
2025-06-16 14:28:20 +02:00
1 changed files with 4 additions and 1 deletions
@@ -11,6 +11,9 @@ on:
  pull_request:
    branches: [ master ]

+permissions:
+  issues: write
+
 jobs:
  build-and-check:
    runs-on: ubuntu-latest
@@ -39,7 +42,7 @@ jobs:
    name: "📦 Publish Custom Node to registry"
    needs: build-and-check
    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
+    if: ${{ github.repository_owner == 'cluny85' && startsWith(github.ref, 'refs/tags/') }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4