From 2c1cf5a13c66522ea22015760985d822ac2a08e2 Mon Sep 17 00:00:00 2001
From: Gregory Schier <gschier1990@gmail.com>
Date: Sun, 5 Jul 2026 09:41:14 -0700
Subject: [PATCH] Restrict privileged workflows to official repo

---
 .github/workflows/claude.yml              | 49 -----------------------
 .github/workflows/contribution-policy.yml |  1 +
 .github/workflows/flathub.yml             |  1 +
 .github/workflows/release-api-npm.yml     |  1 +
 .github/workflows/release-app.yml         |  1 +
 .github/workflows/release-cli-npm.yml     |  1 +
 .github/workflows/sponsors.yml            |  1 +
 7 files changed, 6 insertions(+), 49 deletions(-)
 delete mode 100644 .github/workflows/claude.yml

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
deleted file mode 100644
index 9471a059..00000000
--- a/.github/workflows/claude.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
diff --git a/.github/workflows/contribution-policy.yml b/.github/workflows/contribution-policy.yml
index 029d8aeb..0567c9fe 100644
--- a/.github/workflows/contribution-policy.yml
+++ b/.github/workflows/contribution-policy.yml
@@ -30,6 +30,7 @@ permissions:
 
 jobs:
   check:
+    if: github.repository == 'mountain-loop/yaak'
     name: Check contribution policy
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/flathub.yml b/.github/workflows/flathub.yml
index 50408223..8af49cf0 100644
--- a/.github/workflows/flathub.yml
+++ b/.github/workflows/flathub.yml
@@ -13,6 +13,7 @@ permissions:
 
 jobs:
   update-flathub:
+    if: github.repository == 'mountain-loop/yaak'
     name: Update Flathub manifest
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/release-api-npm.yml b/.github/workflows/release-api-npm.yml
index 0d243551..cc0f5c30 100644
--- a/.github/workflows/release-api-npm.yml
+++ b/.github/workflows/release-api-npm.yml
@@ -15,6 +15,7 @@ permissions:
 
 jobs:
   publish-npm:
+    if: github.repository == 'mountain-loop/yaak'
     name: Publish @yaakapp/api
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/release-app.yml b/.github/workflows/release-app.yml
index b19d94b8..f3ed4595 100644
--- a/.github/workflows/release-app.yml
+++ b/.github/workflows/release-app.yml
@@ -5,6 +5,7 @@ on:
 
 jobs:
   build-artifacts:
+    if: github.repository == 'mountain-loop/yaak'
     permissions:
       contents: write
 
diff --git a/.github/workflows/release-cli-npm.yml b/.github/workflows/release-cli-npm.yml
index ad7052de..8c457397 100644
--- a/.github/workflows/release-cli-npm.yml
+++ b/.github/workflows/release-cli-npm.yml
@@ -15,6 +15,7 @@ permissions:
 
 jobs:
   prepare-vendored-assets:
+    if: github.repository == 'mountain-loop/yaak'
     name: Prepare vendored plugin assets
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml
index 008b34c8..a68a0054 100644
--- a/.github/workflows/sponsors.yml
+++ b/.github/workflows/sponsors.yml
@@ -7,6 +7,7 @@ permissions:
   contents: write
 jobs:
   deploy:
+    if: github.repository == 'mountain-loop/yaak'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout 🛎️