From 7428e597ea3ab2bb58c8c52290a78db2d712d598 Mon Sep 17 00:00:00 2001 From: Faizan Saiyed Date: Thu, 8 Oct 2026 15:18:27 +0530 Subject: [PATCH] fix(ci): restrict branch image publishes to release refs --- .github/workflows/build-branch.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build-branch.yml b/.github/workflows/build-branch.yml index b6eaaced2839..bbb4d8026b03 100644 --- a/.github/workflows/build-branch.yml +++ b/.github/workflows/build-branch.yml @@ -49,6 +49,10 @@ env: jobs: branch_build_setup: + # Public release image tags must only be produced from known release refs. + # Manual dispatch otherwise permits arbitrary branches to reach the public + # Docker Hub namespace through the shared build action. + if: ${{ github.ref_name == 'master' || github.ref_name == 'preview' || github.ref_name == 'canary' || (github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && github.event.inputs.build_type == 'Release') }} name: Build Setup runs-on: ubuntu-24.04 outputs: