Prevent workflow_run triggers from executing in forked repositories

[Copilot]

workflow_run triggers checked repository ID match but allowed execution in forks since IDs matched within the fork context. This created a security gap where malicious actors could modify workflows in forks and trigger them via workflow_run events.

Changes

• pkg/workflow/role_checks.go: Added !github.event.workflow_run.repository.fork check combined with existing repository ID validation using AND logic
• pkg/workflow/workflow_run_repo_safety_test.go: Added fork detection verification and TestWorkflowRunForkCheckPresent test
• docs/: Updated security documentation to reflect fork prevention

Generated Condition

Before:

if: ((github.event_name != 'workflow_run') || 
     (github.event.workflow_run.repository.id == github.repository_id))

After:

if: ((github.event_name != 'workflow_run') || 
     ((github.event.workflow_run.repository.id == github.repository_id) &&
      (!(github.event.workflow_run.repository.fork))))

The condition now requires both repository ID match (cross-repo protection) and non-fork status (fork protection) for workflow_run events, while allowing all other event types through unchanged.

Original prompt

The compiler should update the generate code for workflow_run trigger to prevent execution when triggered by forked repositories.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions]

Agentic Changeset Generator triggered by this pull request.

[Copilot]

Pull Request Overview

This PR enhances the security of workflow_run triggers by adding fork detection to prevent malicious actors from modifying workflows in forks and triggering them via workflow_run events. The existing repository ID check prevented cross-repository attacks but didn't prevent execution when both the triggering and receiving workflows were in the same fork.

Key Changes:

• Added !github.event.workflow_run.repository.fork check combined with existing repository ID validation using AND logic
• Updated generated conditions to require both repository ID match and non-fork status
• Enhanced test coverage with fork detection verification

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/workflow/role_checks.go	Implements fork detection by adding NotNode check on repository.fork property, combining it with existing repository ID check using AND logic
pkg/workflow/workflow_run_repo_safety_test.go	Adds comprehensive test assertions verifying fork check presence, NOT operator usage, and proper combination with repository ID check via AND operator
docs/src/content/docs/reference/triggers.md	Updates trigger documentation to mention fork validation alongside repository validation
docs/src/content/docs/guides/security.md	Updates security guide with detailed explanation of fork prevention, including code examples and security benefits
.github/workflows/dev-hawk.lock.yml	Regenerated lock file with new fork check in activation job condition
.github/workflows/ci-doctor.lock.yml	Regenerated lock file with new fork check in activation job condition

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.