Change default fork behavior for pull_request triggers to deny-by-default

[Copilot]

Pull request workflows now block forks by default unless explicitly allowed via forks field. Previously, omitting the forks field allowed all forks to trigger workflows.

Changes

• pkg/workflow/filters.go: Modified applyPullRequestForkFilter() to treat missing forks field as empty array (same-repo PRs only)
• pkg/workflow/expressions.go: Updated BuildNotFromFork() to use repository ID comparison instead of full_name for more reliable fork detection
• pkg/workflow/compiler_test.go: Added test case validating default fork filtering behavior and updated test expectations
• pkg/workflow/expressions_test.go: Updated test expectations to use repository ID
• pkg/workflow/schemas/github-workflow.json: Documented forks, draft, and names custom fields

Behavior

# Before: allowed all forks
# After: blocks all forks (same-repo PRs only)
on:
  pull_request:
    types: [opened]

# Explicit opt-in required for forks
on:
  pull_request:
    types: [opened]
    forks: ["*"]              # Allow all
    # or
    forks: ["trusted-org/*"]  # Allow specific patterns

Generated Condition

Workflows without forks field now generate:

if: (github.event_name != 'pull_request') || 
    (github.event.pull_request.head.repo.id == github.repository_id)

Uses repository ID comparison instead of full_name for more reliable matching that is not affected by repository renames. This is consistent with the approach used for workflow_run repository safety checks.

Existing workflows using forks field are unaffected.

Original prompt

Change the default behavior of "forks" for pull request events to disallow them all by default.

Update schema and compiler.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot use repository id instead of full name

[Copilot]

@copilot use repository id instead of full name

Updated to use github.event.pull_request.head.repo.id == github.repository_id instead of full_name comparison. This provides more reliable fork detection that isn't affected by repository renames, consistent with the workflow_run repository safety checks.

Commit: 7e306f0

[Copilot]

Pull Request Overview

This PR changes the fork detection mechanism from repository name comparison to repository ID comparison for improved reliability, and updates the default behavior to disallow forked PRs when no explicit fork configuration is provided.

• Updates fork detection to use repository ID (github.repository_id) instead of full name (github.repository) for more reliable matching
• Changes default behavior to disallow all forked PRs when the forks field is not specified
• Updates all generated workflow files and tests to reflect the new fork detection approach

Reviewed Changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/workflow/expressions.go	Updated BuildNotFromFork() to use repository ID comparison instead of full name
pkg/workflow/filters.go	Modified default fork filter behavior to explicitly disallow forks when no forks field is specified
pkg/workflow/expressions_test.go	Updated test expectations to validate repository ID comparison
pkg/workflow/compiler_test.go	Added test case for default fork behavior and updated existing test expectations
.github/workflows/*.lock.yml	Regenerated workflow files with updated fork detection conditions using repository ID

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.