(superset) 01/01: security(ci): restrict docs deployment to trusted workflow_run origins

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch security/workflow-run-origin-check
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 5a11444cb476e186a7988529b388c8126b790b23
Author: Claude Code <no...@anthropic.com>
AuthorDate: Fri May 29 19:53:39 2026 -0700

    security(ci): restrict docs deployment to trusted workflow_run origins
    
    Add a repository-origin guard to the docs-deployment workflow so that
    when it is triggered via workflow_run it only proceeds if the triggering
    workflow run originated from this repository.
    
    The existing branches filter on the workflow_run trigger is evaluated
    against the triggering run's head branch, which is insufficient on its
    own to establish that the triggering run came from trusted code. The
    new condition checks
    github.event.workflow_run.head_repository.full_name == github.repository
    before allowing the build-deploy job to proceed, ensuring that runs
    originating from external forks are rejected before checkout.
    
    push and workflow_dispatch triggers are unaffected by this change.
    
    Co-Authored-By: Claude Sonnet 4.6 <no...@anthropic.com>
---
 .github/workflows/superset-docs-deploy.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-docs-deploy.yml b/.github/workflows/superset-docs-deploy.yml
index dbe4deb1839..d4dd52651f2 100644
--- a/.github/workflows/superset-docs-deploy.yml
+++ b/.github/workflows/superset-docs-deploy.yml
@@ -45,7 +45,13 @@ jobs:
           SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
   build-deploy:
     needs: config
-    if: needs.config.outputs.has-secrets
+    # For workflow_run triggers, only deploy when the triggering run originated
+    # from this repository (not a fork), ensuring the checked-out code and any
+    # local actions executed with deploy credentials are trusted.
+    if: >-
+      needs.config.outputs.has-secrets &&
+      (github.event_name != 'workflow_run' ||
+       github.event.workflow_run.head_repository.full_name == github.repository)
     name: Build & Deploy
     runs-on: ubuntu-24.04
     steps: