From 9d33a76ada17cf85efed212ef381958b4f256941 Mon Sep 17 00:00:00 2001
From: Thales Pereira <31625914+thcp@users.noreply.github.com>
Date: Mon, 31 Aug 2026 17:55:25 +0100
Subject: [PATCH] ci: stop fork pull requests running on the self-hosted
 runners

macos-check.yml and windows-check.yml trigger on pull_request and run on
[self-hosted, macOS, ARM64] and [self-hosted, windows, x64] with no fork
guard, on a public repository.

cargo fmt/build/clippy all execute code the pull request supplies: build.rs,
proc-macro crates, a swapped Cargo.toml dependency or [patch], and the test
bodies themselves. permissions: {} limits what the token can reach; it does
nothing about code execution on the machine.

That machine is the same one that builds, signs and uploads every macOS DMG
and runtime pack. Neither check workflow cleans its workspace and the release
workflows only remove .build and dist, so an implant in ~/.cargo, ~/.npm,
~/.rustup or the persistent _work tree would survive straight into the next
release. GitHub's public-repo default only gates first-time contributors, so
one trivial merged pull request is enough to unlock this for a later one.

Gate both jobs on the pull request coming from this repository. The
workflow_dispatch path is unaffected, so a fork's Rust change can still get
its compiler pass when a maintainer asks for one -- which keeps the reason
the trigger exists (#421: cfg-gated Rust merging without ever being compiled,
because ci.yml is entirely ubuntu-latest).

Refs #511
---
 .github/workflows/macos-check.yml   | 14 ++++++++++++++
 .github/workflows/windows-check.yml |  9 +++++++++
 2 files changed, 23 insertions(+)

diff --git a/.github/workflows/macos-check.yml b/.github/workflows/macos-check.yml
index de670993..57f62d0e 100644
--- a/.github/workflows/macos-check.yml
+++ b/.github/workflows/macos-check.yml
@@ -26,6 +26,20 @@ concurrency:
 
 jobs:
   check:
+    # Never run a fork's code on the self-hosted runner. cargo build/clippy/test
+    # all execute whatever the PR supplies -- build.rs, proc-macro crates, a
+    # swapped Cargo.toml dependency, the test bodies themselves -- and this
+    # runner is the same machine that builds, signs and uploads every macOS
+    # release. Nothing here cleans the workspace, so an implant in ~/.cargo,
+    # ~/.rustup or the persistent _work tree would survive into the next
+    # release. permissions: {} limits the token, not code execution.
+    #
+    # GitHub's public-repo default only gates *first-time* contributors, so one
+    # trivial merged PR is enough to unlock this for a later one. Fork PRs get a
+    # maintainer-triggered workflow_dispatch run instead.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     # Runner must be darwin/arm64 with Xcode CLT and rustup (same requirements
     # as macos-release.yml, which this intentionally does not replace -- this
     # only builds/checks, never signs, packages, or uploads anything).
diff --git a/.github/workflows/windows-check.yml b/.github/workflows/windows-check.yml
index a567d294..e072eb80 100644
--- a/.github/workflows/windows-check.yml
+++ b/.github/workflows/windows-check.yml
@@ -27,6 +27,15 @@ concurrency:
 
 jobs:
   check:
+    # Never run a fork's code on the self-hosted runner -- see the same guard in
+    # macos-check.yml. cargo build/clippy/test execute whatever the PR supplies
+    # (build.rs, proc-macro crates, a swapped Cargo.toml dependency, the test
+    # bodies), nothing here cleans the workspace, and this runner also builds
+    # the Windows release. Fork PRs get a maintainer-triggered
+    # workflow_dispatch run instead.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     # Runner must have rustup and the MSVC toolchain (same requirements as
     # windows-release.yml, which this intentionally does not replace -- this
     # only builds/checks, never packages or uploads anything).