Guard bundle publishing against fork execution

[robnester-rh]

Restrict the policy bundle publishing job to the canonical repository so forked copies skip before attempting registry authentication or bundle publication.

Validation: git diff --check

Co-Authored-By: Codex codex@openai.com
Ref: EC-2232

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: e7ea63f3-0e6c-4b18-b30b-103269efde61

📥 Commits

Reviewing files that changed from the base of the PR and between aac25e9 and de0ea50.

📒 Files selected for processing: 1

• .github/workflows/push-bundles.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The push-policy-bundles job now runs only when github.repository equals conforma/policy. Its triggers, steps, and configuration are unchanged.

Changes: Bundle Publishing Guard

Layer / File(s)	Summary
Restrict bundle publishing to the target repository .github/workflows/push-bundles.yaml	A job-level condition restricts push-policy-bundles to runs in conforma/policy.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: dheerajodha, simonbaird

Merge Risk: ⚪ Minimal · up to de0ea

The bundle publishing job now runs only in the canonical repository, so forks skip it before attempting registry authentication or pushing bundles. No merge-blocking risk was found.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: preventing fork executions from publishing policy bundles.
Description check		The description explains what the change does, why it is needed, provides validation information, and references ticket EC-2232. The content satisfies the required What, Why, and Tickets information.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

---

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

---

Powered by Qodo

[qodo-for-conforma]

PR Summary by Qodo

Skip policy bundle publishing in forked repositories

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

---

AI Description

• Restrict the bundle publishing job to conforma/policy.
• Skip forked workflows before they attempt registry authentication or publish bundles.

Diagram

graph TD
  A["Workflow trigger"] --> B{"Canonical repository?"} -->|Yes| C["Publishing job"] --> D["Registry push"]
  B -->|No| E["Skip job"]

Loading

High-Level Assessment

The job-level repository condition is the appropriate guard: it skips the entire publishing job in forks, rather than relying on checks inside the publishing steps.

Files changed (1) +1 / -0

Bug fix (1) +1 / -0

push-bundles.yamlRestrict bundle publishing to the canonical repository +1/-0

Restrict bundle publishing to the canonical repository

• Adds a job-level repository condition so forks skip the publishing job before its registry credentials or publication step are used.

.github/workflows/push-bundles.yaml

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Single-line CI guard addition to a recently-active workflow file; the CI workflow change and protected-path flags lift the score above low, but the trivial change size, returning author, and clean regression history keep it at moderate.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/push-bundles.yaml — The PR modifies a file under the protected .github/ path. The PR body explains the rationale (restrict the publishing job to the canonical repository to prevent fork execution) and references EC-2232. Human approval is always required for protected-path changes, regardless of context.

[fullsend-ai-retro]

Retro: PR #1907 — Guard bundle publishing against fork execution

Outcome: clean workflow, no proposals filed.

What happened

PR #1907 was a 1-file, +1/-0 change to .github/workflows/push-bundles.yaml restricting the push-policy-bundles job to conforma/policy. Timeline:

• 15:23 — Human author (robnester-rh, with Codex co-author) opened the PR on branch EC-2232-push-bundles-guard (Jira-ref style, not the agent/{issue}-{slug} convention).
• 15:24 — Third-party review bots (CodeRabbit, Qodo) posted walkthroughs; no issues.
• 15:40–15:41 — fullsend-ai-review posted risk-assessment (moderate, 2/5) and one Medium [protected-path] finding noting the .github/ change requires human approval. Hidden fullsend:review-findings-v2 state decoded to {"version":2,"findings":[]} — i.e. no code-level findings; the Medium is purely the policy gate.
• 15:44 — st3penta (CONTRIBUTOR) approved.
• 16:01 — simonbaird (MEMBER) approved and the PR merged (~38 min total open).

Agents repo discovered from the Review job log: fullsend-ai/agents@0cc4bf8e91bc644c3ffdb2ae158d91131cbf8495. Only one agent stage ran (Review, job 115938516331, ~17 min). No /fs-* commands, no rework, no fix dispatch, no post-merge regressions observed.

Assessment against the optimization goals

• Review quality: The protected-path gate correctly fired on a .github/workflows/ edit. No false positives, no missed issues (the change is a 1-line condition and both human reviewers approved without comments).
• Rework rate: Zero iterations.
• Token cost / time: The Review agent took ~17 minutes to produce output whose only finding is the mandatory protected-path gate on a 1-line YAML change with an empty findings-v2 payload. This is a single observation and insufficient evidence of a recurring pattern.
• Autonomy readiness: Protected-path gating is the explicit design — human approval on .github/ changes is intentional, not a readiness gap. Both approvers approved without comments, consistent with the small, well-scoped nature of the diff.

Judge scores

• 2/5 — Review runtime on protected-path-only diffs — summary-only. The Review agent ran ~17 min on a 1-line GitHub Actions edit whose only output was the mandatory human-approval gate; findings-v2 was empty. A short-circuit could reduce latency, but with a single data point this scores at the rubric default for isolated observations and is not eligible for filing without evidence of recurrence.
• 1/5 — Branch does not follow agent/{issue}-{slug} — summary-only. Cosmetic; the branch uses the Jira-ref style EC-2232-* because this is a human-authored PR, not an agent-dispatched one. No action warranted.

Filed proposals

None. The workflow functioned as designed and no candidate reached the 4/5 threshold required by the Conforma retro filing policy.