From e6a95293f0e7a6a21e77b36154b2ee548ca7d4f9 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Sat, 7 Nov 2026 12:31:08 +0000
Subject: [PATCH 1/2] fix(security): autofix Using unsafe GitHub Actions
 trigger may allow privilege escalation via CI/CD

---
 .github/workflows/deploy-website.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 17070490..ba9da8ff 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -31,9 +31,6 @@ on:
   # head_branch is the tag the release named, so this selects relay releases
   # (`nostream@X.Y.Z`) and leaves the website ones, which the Release workflow
   # skips as `skipped`, alone.
-  workflow_run:
-    workflows: ["Release"]
-    types: [completed]
   workflow_dispatch:
 
 jobs:
@@ -57,11 +54,6 @@ jobs:
     # the site's build-time version and changelog worth redeploying.
     if: >-
       ${{ startsWith(github.event.release.tag_name, 'nostream-website@') ||
-      (github.event_name == 'workflow_run' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      (startsWith(github.event.workflow_run.head_branch || '', 'nostream@') ||
-      (github.event.workflow_run.event == 'workflow_dispatch' &&
-      github.event.workflow_run.head_branch == 'main'))) ||
       (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
     name: Build and deploy to Cloudflare Workers
     runs-on: ubuntu-latest

From 382d1f697d1314674c5a1b494b45e23d64c12352 Mon Sep 17 00:00:00 2001
From: chappie-daemon <phoenix@ricardocabral.io>
Date: Sat, 7 Nov 2026 07:42:43 -0500
Subject: [PATCH 2/2] ci(website): keep the relay deploy trigger and assert run
 provenance

Removing workflow_run does not harden the deploy, it deletes it: the website
environment admits only main and nostream-website@*, and a release event is
checked against the tag, so nostream@X.Y.Z is refused there whatever the job
does. That is the constraint the trigger exists for, and dropping it re-creates
the staleness fixed on 2026-11-05.

The reported escalation is closed instead by requiring the triggering run to
belong to this repository (head_repository.full_name == github.repository),
which a fork's Release workflow can never satisfy, alongside the existing
conclusion and branch-prefix checks.
---
 .github/workflows/deploy-website.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index ba9da8ff..a706a549 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -31,6 +31,18 @@ on:
   # head_branch is the tag the release named, so this selects relay releases
   # (`nostream@X.Y.Z`) and leaves the website ones, which the Release workflow
   # skips as `skipped`, alone.
+  #
+  # This trigger is not removable, whatever a scanner reports. The `website`
+  # environment admits only `main` and `nostream-website@*`, and a deployment is
+  # checked against its own run's ref, so a `release: published` run for
+  # `nostream@X.Y.Z` is refused at the environment — measured on the policy
+  # itself, not assumed. `workflow_run` runs on the default branch, which the
+  # policy admits. The escalation it is reported for is closed by the
+  # head_repository assertion in the job `if` below: a Release run from a fork
+  # can never reach this deploy.
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
   workflow_dispatch:
 
 jobs:
@@ -54,6 +66,12 @@ jobs:
     # the site's build-time version and changelog worth redeploying.
     if: >-
       ${{ startsWith(github.event.release.tag_name, 'nostream-website@') ||
+      (github.event_name == 'workflow_run' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      github.event.workflow_run.conclusion == 'success' &&
+      (startsWith(github.event.workflow_run.head_branch || '', 'nostream@') ||
+      (github.event.workflow_run.event == 'workflow_dispatch' &&
+      github.event.workflow_run.head_branch == 'main'))) ||
       (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
     name: Build and deploy to Cloudflare Workers
     runs-on: ubuntu-latest