[NathanFlurry]

• Fail every publish run outside rivet-dev/rivet in the context job, before anything builds or uploads. The check uses the repository's immutable ID, so it survives renames.
• Restrict Docker image publishing, manifest creation, and release retagging to the same repository ID.
• Skip the API docs sync and API docs check workflows outside rivet-dev/rivet, like the other docs sync workflows.
• Prevent copied workflows in other repositories from publishing npm packages, crates, R2 artifacts, or Docker images.

[railway-app]

🚅 Environment actors-pr-5690 in rivet-frontend has no services deployed.

[the-company-company]

✅ No issues found

_{Reviewed commit 16abe7a.}

[claude]

Review

Verified 654560183 against gh api repos/rivet-dev/actors — it matches this repo's actual immutable ID, so the gate is correctly targeted.

Correctness

• Coverage looks complete: all four Docker-touching points are gated — the docker-images job itself, its docker-setup (login) step, the publish job's own docker-setup step, the manifest-creation step, and the retag step.
• The publish job treats needs.docker-images.result == 'skipped' as acceptable, so non-OSS runs correctly fall through to a docker-less publish rather than failing the whole workflow.
• Using github.repository_id (immutable, survives renames) rather than github.repository (a renamable string) is the right choice for this kind of gate.

Minor / non-blocking

• The literal 654560183 is duplicated across 4 conditions with no named reference. A repo-level Actions variable (vars.OSS_REPOSITORY_ID) would let the four if:s read vars.OSS_REPOSITORY_ID instead of a bare magic number (job-level if: supports vars but not workflow env, so a plain top-level env: entry like DEPOT_PROJECT_ID above can't be reused here as-is). Not required — the explanatory comment on the first occurrence is enough to keep this readable.
• Scope check: this only restricts Docker Hub publishing, per the stated goal. Other steps with real credentials later in the same publish job (R2 upload, crates.io publish) aren't restricted by repository ID. That's likely fine since npm's trusted publishing and crates.io tokens have their own scoping/OIDC bindings Docker Hub username/password auth lacks, but worth confirming that's the actual reasoning rather than an oversight.

Testing

• This is CI config with no automated test surface; the change is inherently only verifiable by observing a real workflow run in a non-OSS-ID context (fork or copy) and confirming the Docker jobs/steps skip. Nothing further to add given the nature of the change.

Overall a small, well-targeted fix — approve.

[github-actions]

📟 Pip-Boy · 59375d8

📦 Packages

Skipped: this PR doesn't change any published package.

🧹 Rust dependencies

Skipped: this PR doesn't change any Rust code or dependencies.

🦀 Binaries

Skipped: this PR doesn't change any Rust code.

⏱ Timing

job	wall time	slowest step
changes	19s	checkout · 13s
zizmor	10s	setup-uv · 3s
report	19s	setup-node · 5s
⏭ native · ${{ matrix.target }} · ${{ matrix.platform }}	—	skipped
⏭ footprint	—	skipped
⏭ self-test	—	skipped
⏭ hygiene	—	skipped

🔭 Full CI trace for this commit

One OpenTelemetry trace of Rust CI, frontend, and Pip-Boy for 59375d8: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha 59375d86b5873703e218fc77cace8448b37a3d5b

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/rivet checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.