From 7a44064f3cb0d2872eeec3a3795397638fadeaaa Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Thu, 27 Aug 2026 20:48:52 -0600 Subject: [PATCH 1/2] security(ci): skip fork OpenTofu workflows --- .github/workflows/opentofu.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml index ac978a0..5d94503 100644 --- a/.github/workflows/opentofu.yml +++ b/.github/workflows/opentofu.yml @@ -15,7 +15,7 @@ permissions: jobs: opentofu: + if: >- + github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main - with: - gcp-workload-identity-provider: projects/920734942788/locations/global/workloadIdentityPools/github/providers/github - gcp-service-account: terraformer@makeitworkcloud.iam.gserviceaccount.com From aa37726d389b7cb4e682edce49cb686fa4bfd03e Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Thu, 27 Aug 2026 20:54:59 -0600 Subject: [PATCH 2/2] fix(ci): retain GCP workload identity inputs --- .github/workflows/opentofu.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml index 5d94503..d841d7b 100644 --- a/.github/workflows/opentofu.yml +++ b/.github/workflows/opentofu.yml @@ -19,3 +19,6 @@ jobs: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main + with: + gcp-workload-identity-provider: projects/920734942788/locations/global/workloadIdentityPools/github/providers/github + gcp-service-account: terraformer@makeitworkcloud.iam.gserviceaccount.com