From a3a32bdd72f3b86c43975dcb6ed9a592de13bbb4 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Tue, 21 Jul 2026 16:09:46 +1000 Subject: [PATCH] Rebase: require a same-repo head branch (fork noise guard) Mirrors action-translation#130; see the PAT rollout review. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/rebase-translations.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/rebase-translations.yml b/.github/workflows/rebase-translations.yml index b108906..dc53a70 100644 --- a/.github/workflows/rebase-translations.yml +++ b/.github/workflows/rebase-translations.yml @@ -25,8 +25,13 @@ jobs: # Keep this in step with `isTranslationBranch` in the action's src/branch-naming.ts # — this `if` decides whether the job runs, that predicate decides which open PRs # it then rebases, so a prefix matching only one of them is a no-op run. + # The head-repo check is belt-and-braces: fork PRs never receive secrets, so + # the PAT is not exposed either way — but a merged fork PR whose branch happens + # to match a prefix would otherwise start this job with an empty token and fail + # red. Same-repo branches matching these prefixes only come from the tooling. if: > github.event.pull_request.merged == true && + github.event.pull_request.head.repo.full_name == github.repository && (startsWith(github.event.pull_request.head.ref, 'translation-sync-') || startsWith(github.event.pull_request.head.ref, 'resync/')) runs-on: ubuntu-latest