From bf0ebe1f33e0d8ab67adb137528786d71b5fb79f Mon Sep 17 00:00:00 2001
From: hermes-alby <roland.bewick+hermes@gmail.com>
Date: Tue, 4 Aug 2026 16:14:30 +0700
Subject: [PATCH] ci: support builds for fork pull requests (#2492)

ci: skip macOS signing for untrusted PRs

Co-authored-by: Hermes Agent <hermes-agent@users.noreply.github.com>
---
 .github/workflows/http.yml  | 32 +++++++++++++++++++++++++++++---
 .github/workflows/wails.yml | 30 +++++++++++++++++++++++++++---
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/http.yml b/.github/workflows/http.yml
index 9d01e13d..6a7ef1b7 100644
--- a/.github/workflows/http.yml
+++ b/.github/workflows/http.yml
@@ -25,6 +25,7 @@ on:
 jobs:
   build:
     strategy:
+      fail-fast: false
       matrix:
         build:
           [
@@ -128,7 +129,15 @@ jobs:
         run: go build ${{ env.GOTAGS }} -o build/bin/${{ env.PACKAGE_NAME }}/bin/${{ env.EXEC_NAME }} -ldflags "-X 'github.com/getAlby/hub/version.Tag=${{ env.TAG }}'" cmd/http/main.go
 
       - name: Import Code-Signing Certificates for macOS
-        if: runner.os == 'macOS'
+        if: >-
+          runner.os == 'macOS' &&
+          (
+            !github.event.pull_request ||
+            (
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              github.actor != 'dependabot[bot]'
+            )
+          )
         uses: Apple-Actions/import-codesign-certs@v3
         with:
           # The certificates in a PKCS12 file encoded as a base64 string
@@ -165,7 +174,15 @@ jobs:
         shell: bash
 
       - name: Sign the MacOS binary and libraries
-        if: runner.os == 'macOS'
+        if: >-
+          runner.os == 'macOS' &&
+          (
+            !github.event.pull_request ||
+            (
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              github.actor != 'dependabot[bot]'
+            )
+          )
         run: |
           /usr/bin/codesign -s "Developer ID Application: Alby Inc." -f -v --deep --timestamp --options runtime ./build/bin/${{ env.PACKAGE_NAME }}/bin/${{ env.EXEC_NAME }}
           /usr/bin/codesign -s "Developer ID Application: Alby Inc." -f -v --deep --timestamp --options runtime ./build/bin/${{ env.PACKAGE_NAME }}/lib/*.dylib
@@ -189,7 +206,16 @@ jobs:
           cd ../../..
 
       - name: Notarize the zip file
-        if: runner.os == 'macOS' && inputs.build-release
+        if: >-
+          runner.os == 'macOS' &&
+          inputs.build-release &&
+          (
+            !github.event.pull_request ||
+            (
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              github.actor != 'dependabot[bot]'
+            )
+          )
         run: |
           echo "Notarizing Zip Files"
           gon -log-level=info -log-json ./build/darwin/http/gon-notarize.json
diff --git a/.github/workflows/wails.yml b/.github/workflows/wails.yml
index 71079d7c..c11aadc9 100644
--- a/.github/workflows/wails.yml
+++ b/.github/workflows/wails.yml
@@ -129,7 +129,15 @@ jobs:
         shell: bash
 
       - name: Import Code-Signing Certificates for macOS
-        if: runner.os == 'macOS'
+        if: >-
+          runner.os == 'macOS' &&
+          (
+            !github.event.pull_request ||
+            (
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              github.actor != 'dependabot[bot]'
+            )
+          )
         uses: Apple-Actions/import-codesign-certs@v3
         with:
           # The certificates in a PKCS12 file encoded as a base64 string
@@ -190,7 +198,15 @@ jobs:
           mv ./build/out/${{ env.PACKAGE_NAME }}.tar.bz2 ./build/bin/
 
       - name: Sign the macOS binary
-        if: runner.os == 'macOS'
+        if: >-
+          runner.os == 'macOS' &&
+          (
+            !github.event.pull_request ||
+            (
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              github.actor != 'dependabot[bot]'
+            )
+          )
         run: |
           echo "Signing Package"
           /usr/bin/codesign -s "Developer ID Application: Alby Inc." -f -v --deep --timestamp --options runtime --entitlements ./build/darwin/entitlements.plist "./build/bin/${{ env.EXEC_NAME }}.app"
@@ -222,7 +238,15 @@ jobs:
           EOF
 
       - name: Notarize the DMG image
-        if: runner.os == 'macOS'
+        if: >-
+          runner.os == 'macOS' &&
+          (
+            !github.event.pull_request ||
+            (
+              github.event.pull_request.head.repo.full_name == github.repository &&
+              github.actor != 'dependabot[bot]'
+            )
+          )
         run: |
           echo "Notarizing Zip Files"
           gon -log-level=info -log-json ./build/darwin/gon-notarize.json