From 2f429ee2bfd2e75a79f4aa35c4dd48a934cdae6b Mon Sep 17 00:00:00 2001
From: Nathan Flurry <git@nathanflurry.com>
Date: Wed, 9 Sep 2026 17:55:04 -0700
Subject: [PATCH 1/2] fix(ci): restrict Docker publishing to the OSS repository

---
 .github/workflows/publish.yaml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index f3f6b2ce99..13ee6a565e 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -338,7 +338,8 @@ jobs:
   # ---------------------------------------------------------------------------
   docker-images:
     needs: [context]
-    if: needs.context.outputs.build_docker == 'true'
+    # This ID identifies the OSS repository and remains stable across renames.
+    if: needs.context.outputs.build_docker == 'true' && github.repository_id == '654560183'
     name: "Docker ${{ matrix.arch_suffix }}"
     strategy:
       fail-fast: false
@@ -429,6 +430,7 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - uses: ./.github/actions/docker-setup
+        if: github.repository_id == '654560183'
         with:
           docker_username: ${{ secrets.DOCKER_CI_USERNAME }}
           docker_password: ${{ secrets.DOCKER_CI_ACCESS_TOKEN }}
@@ -673,7 +675,7 @@ jobs:
             --allow-dirty
 
       - name: Create Docker multi-arch manifests
-        if: needs.context.outputs.build_docker == 'true'
+        if: needs.context.outputs.build_docker == 'true' && github.repository_id == '654560183'
         run: pnpm --filter=publish exec tsx src/ci/bin.ts docker-manifest --sha ${{ needs.context.outputs.sha }}
 
       # ---- release-only tail ----
@@ -690,7 +692,7 @@ jobs:
 
 
       - name: Retag Docker manifests to version
-        if: needs.context.outputs.trigger == 'release'
+        if: needs.context.outputs.trigger == 'release' && github.repository_id == '654560183'
         run: |
           pnpm --filter=publish exec tsx src/ci/bin.ts docker-retag \
             --sha ${{ needs.context.outputs.sha }} \

From 59375d86b5873703e218fc77cace8448b37a3d5b Mon Sep 17 00:00:00 2001
From: Nathan Flurry <git@nathanflurry.com>
Date: Sun, 25 Oct 2026 19:16:45 -0700
Subject: [PATCH 2/2] ci: fail publish runs outside the OSS repository before
 anything builds

---
 .github/workflows/docs-api-check.yml | 1 +
 .github/workflows/docs-sync-api.yml  | 1 +
 .github/workflows/publish.yaml       | 9 +++++++++
 3 files changed, 11 insertions(+)

diff --git a/.github/workflows/docs-api-check.yml b/.github/workflows/docs-api-check.yml
index 17bcec2317..e0cd6945a0 100644
--- a/.github/workflows/docs-api-check.yml
+++ b/.github/workflows/docs-api-check.yml
@@ -26,6 +26,7 @@ concurrency:
 jobs:
   generated-up-to-date:
     name: API Reference / Generated Pages Up To Date
+    if: github.repository == 'rivet-dev/rivet'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/docs-sync-api.yml b/.github/workflows/docs-sync-api.yml
index 286d236751..cea4d4c72e 100644
--- a/.github/workflows/docs-sync-api.yml
+++ b/.github/workflows/docs-sync-api.yml
@@ -25,6 +25,7 @@ on:
 
 jobs:
   sync:
+    if: github.repository == 'rivet-dev/rivet'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 13ee6a565e..840b0a9e94 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -84,6 +84,15 @@ jobs:
       build_wasm: ${{ steps.ctx.outputs.build_wasm }}
       build_docker: ${{ steps.ctx.outputs.build_docker }}
     steps:
+      # Every build and publish job needs this one, so failing here stops the
+      # whole run before anything is built or uploaded. 654560183 is the
+      # immutable ID of rivet-dev/rivet, so a copy of this workflow in any other
+      # repository never publishes.
+      - name: Refuse to publish outside the OSS repository
+        if: github.repository_id != '654560183'
+        run: |
+          echo "::error::publish.yaml only publishes from rivet-dev/rivet (repository ID 654560183), not ${{ github.repository }}."
+          exit 1
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1