ci: make release conditional on being on the root (non-fork) repo

Author: bsdinis

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
           rustup --version
           rustup toolchain install
       - name: download singular
-        if: matrix.features == 'singular'
+        if: ${{ matrix.features == 'singular' }}
         run: |
           curl -LO https://www.singular.uni-kl.de/ftp/pub/Math/Singular/UNIX/Singular-4-3-2_M1.dmg
       - name: build and test
@@ -121,7 +121,7 @@ jobs:
         run: |
           cargo build
       - name: build verus release
-        if: matrix.features == ''
+        if: ${{ matrix.features == '' }}
         working-directory: ./source
         run: |
           . "$HOME/.cargo/env"
@@ -132,26 +132,26 @@ jobs:
           cp -R ./target-verus/release ../verus-arm64-macos
           cd ..; zip -r verus-arm64-macos.zip ./verus-arm64-macos
       - name: run verus release
-        if: matrix.features == ''
+        if: ${{ matrix.features == '' }}
         working-directory: ./source
         run: |
           ls -Al ./target-verus/release
           ./target-verus/release/verus ../examples/test.rs
       - name: upload verus release artifact
         uses: actions/upload-artifact@v4
-        if: matrix.features == ''
+        if: ${{ matrix.features == '' && github.repository == 'verus-lang/verus' }}
         with:
             name: verus-arm64-macos
             path: verus-arm64-macos.zip
       - name: build docs
-        if: matrix.features == ''
+        if: ${{ matrix.features == '' }}
         working-directory: ./source
         run: |
           . "$HOME/.cargo/env"
           ./tools/docs.sh
       - name: upload verusdoc artifact
         uses: actions/upload-artifact@v4
-        if: matrix.features == ''
+        if: ${{ matrix.features == '' && github.repository == 'verus-lang/verus' }}
         with:
           name: verusdoc
           path: source/doc
@@ -201,6 +201,7 @@ jobs:
           ./target-verus/release/verus ../examples/test.rs
       - name: upload verus release artifact
         uses: actions/upload-artifact@v4
+        if: ${{ github.repository == 'verus-lang/verus' }}
         with:
             name: verus-x86-macos
             path: verus-x86-macos.zip
@@ -245,6 +246,7 @@ jobs:
         shell: powershell
       - name: upload verus release artifact
         uses: actions/upload-artifact@v4
+        if: ${{ github.repository == 'verus-lang/verus' }}
         with:
             name: verus-x86-win
             path: verus-x86-win.zip
@@ -289,6 +291,7 @@ jobs:
           ./target-verus/release/verus ../examples/test.rs
       - name: upload verus release artifact
         uses: actions/upload-artifact@v4
+        if: ${{ github.repository == 'verus-lang/verus' }}
         with:
             name: verus-x86-linux
             path: verus-x86-linux.zip
@@ -318,7 +321,7 @@ jobs:
 
   release:
     needs: [fmt, smoke-test-and-release-linux, smoke-test-and-release-windows, test-and-release-macos, smoke-test-and-release-macos-x86, docs]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'verus-lang/verus' }}
     runs-on: ubuntu-latest
     steps:
       - name: download all artifacts

.github/workflows/release.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
   copy-release:
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'verus-lang/verus' }}
 
     steps:
       - name: Get Release Info
@@ -38,7 +39,7 @@ jobs:
         run: |
           new_release_tag=$(echo $release_tag | sed 's/\/rolling//')
           new_release_name=$(echo $release_name | sed 's/Rolling //')
-          
+
           response=$(curl -s -X POST -H "Authorization: token $GITHUB_TOKEN" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\": \"$new_release_tag\", \"name\": \"$new_release_name\", \"body\": \"$release_tag\"}" \
@@ -54,12 +55,12 @@ jobs:
           new_release_id: ${{ env.new_release_id }}
         run: |
           assets=$(echo $release_assets | jq -c '.[]')
-          
+
           for asset in $assets; do
             asset_url=$(echo $asset | jq -r '.url')
             asset_name=$(echo $asset | jq -r '.name')
             asset_download_url=$(curl -s -H "Authorization: token $GITHUB_TOKEN" $asset_url | jq -r '.browser_download_url')
-            
+
             curl -L -o $asset_name -H "Authorization: token $GITHUB_TOKEN" $asset_download_url
             curl -X POST -H "Authorization: token $GITHUB_TOKEN" \
               -H "Content-Type: application/octet-stream" \