fix(ci): keep fork image builds off the shared Quay repos (#5290)

* fix(ci): keep fork image builds off the shared Quay repos

Forks must set QUAY_RHDH_IMAGE_REPO / QUAY_E2E_RUNNER_IMAGE_REPO to their
own namespace; unconfigured scheduled and push runs are skipped.

* fix(ci): fail fork Quay guard before checkout

Reject any rhdh-community/* destination and skip the clone on rejected runs.

Author: zdrapela

.github/workflows/next-build-image.yaml

@@ -37,11 +37,15 @@ concurrency:
 
 env:
   REGISTRY: quay.io
-  REGISTRY_IMAGE: rhdh-community/rhdh
+  # Forks: set repo variable QUAY_RHDH_IMAGE_REPO to your own Quay repo (namespace/repo)
+  # and secrets QUAY_USERNAME/QUAY_TOKEN scoped to that namespace (not rhdh-community).
+  # See CONTRIBUTING.md ("Testing image builds from a fork").
+  REGISTRY_IMAGE: ${{ vars.QUAY_RHDH_IMAGE_REPO || 'rhdh-community/rhdh' }}
 
 jobs:
   build-image:
     name: Build Image
+    if: github.repository == 'redhat-developer/rhdh' || vars.QUAY_RHDH_IMAGE_REPO != '' || github.event_name == 'workflow_dispatch'
     env:
       HAS_QUAY_AUTH: ${{ secrets.QUAY_USERNAME != '' && secrets.QUAY_TOKEN != '' }}
     strategy:
@@ -56,6 +60,12 @@ jobs:
       contents: read
       packages: write
     steps:
+      - name: Guard against pushing to shared repo from a fork
+        if: github.repository != 'redhat-developer/rhdh' && startsWith(env.REGISTRY_IMAGE, 'rhdh-community/')
+        run: |
+          echo "::error::Forks must set repository variable QUAY_RHDH_IMAGE_REPO to a Quay repo outside the rhdh-community namespace."
+          exit 1
+
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -165,6 +175,7 @@ jobs:
           retention-days: 1
 
   merge:
+      if: github.repository == 'redhat-developer/rhdh' || vars.QUAY_RHDH_IMAGE_REPO != '' || github.event_name == 'workflow_dispatch'
       runs-on: ubuntu-latest
       needs:
         - build-image
@@ -175,6 +186,12 @@ jobs:
       env:
         HAS_QUAY_AUTH: ${{ secrets.QUAY_USERNAME != '' && secrets.QUAY_TOKEN != '' }}
       steps:
+        - name: Guard against pushing to shared repo from a fork
+          if: github.repository != 'redhat-developer/rhdh' && startsWith(env.REGISTRY_IMAGE, 'rhdh-community/')
+          run: |
+            echo "::error::Forks must set repository variable QUAY_RHDH_IMAGE_REPO to a Quay repo outside the rhdh-community namespace."
+            exit 1
+
         - name: Login to Quay
           uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
           with:

.github/workflows/push-e2e-runner.yaml

@@ -25,11 +25,15 @@ concurrency:
 
 env:
   REGISTRY: quay.io
-  REGISTRY_IMAGE: rhdh-community/rhdh-e2e-runner
+  # Forks: set repo variable QUAY_E2E_RUNNER_IMAGE_REPO to your own Quay repo (namespace/repo)
+  # and secrets QUAY_USERNAME/QUAY_TOKEN scoped to that namespace (not rhdh-community).
+  # See CONTRIBUTING.md ("Testing image builds from a fork").
+  REGISTRY_IMAGE: ${{ vars.QUAY_E2E_RUNNER_IMAGE_REPO || 'rhdh-community/rhdh-e2e-runner' }}
 
 jobs:
   build-image:
     name: Build e2e-runner (${{ matrix.os }})
+    if: github.event_name == 'pull_request' || github.repository == 'redhat-developer/rhdh' || vars.QUAY_E2E_RUNNER_IMAGE_REPO != '' || github.event_name == 'workflow_dispatch'
     env:
       HAS_QUAY_AUTH: ${{ secrets.QUAY_USERNAME != '' && secrets.QUAY_TOKEN != '' }}
     strategy:
@@ -45,6 +49,12 @@ jobs:
       packages: write
 
     steps:
+      - name: Guard against pushing to shared repo from a fork
+        if: github.event_name != 'pull_request' && github.repository != 'redhat-developer/rhdh' && startsWith(env.REGISTRY_IMAGE, 'rhdh-community/')
+        run: |
+          echo "::error::Forks must set repository variable QUAY_E2E_RUNNER_IMAGE_REPO to a Quay repo outside the rhdh-community namespace."
+          exit 1
+
       - name: Checkout Repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -131,7 +141,7 @@ jobs:
 
   merge:
     name: Create multi-arch manifest
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && (github.repository == 'redhat-developer/rhdh' || vars.QUAY_E2E_RUNNER_IMAGE_REPO != '' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     needs: build-image
@@ -140,6 +150,12 @@ jobs:
       packages: write
 
     steps:
+      - name: Guard against pushing to shared repo from a fork
+        if: github.repository != 'redhat-developer/rhdh' && startsWith(env.REGISTRY_IMAGE, 'rhdh-community/')
+        run: |
+          echo "::error::Forks must set repository variable QUAY_E2E_RUNNER_IMAGE_REPO to a Quay repo outside the rhdh-community namespace."
+          exit 1
+
       - name: Checkout Repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

CONTRIBUTING.md

@@ -148,6 +148,23 @@ If you want to submit code changes to the project, here are some guidelines:
 
    Go to the original repository and click on **New Pull Request**. Provide a clear description of your changes, including any issues your PR fixes, acceptance criteria, and any special notes to the reviewers.
 
+### Testing image builds from a fork
+
+The image-push workflows default to `quay.io/rhdh-community/rhdh` and `quay.io/rhdh-community/rhdh-e2e-runner`. Forks that set `QUAY_USERNAME`/`QUAY_TOKEN` without retargeting those repos can overwrite shared tags such as `:next`.
+
+To test image builds from a fork:
+
+1. Create a Quay repository in **your** namespace (not `rhdh-community`).
+2. Set a repository variable (Settings → Secrets and variables → Actions → Variables):
+   - `QUAY_RHDH_IMAGE_REPO` = `<your-namespace>/<repo>` for [next-build-image.yaml](.github/workflows/next-build-image.yaml)
+   - `QUAY_E2E_RUNNER_IMAGE_REPO` = `<your-namespace>/<repo>` for [push-e2e-runner.yaml](.github/workflows/push-e2e-runner.yaml)
+
+   Do not set either variable under the `rhdh-community/` namespace. Forks that do so are rejected.
+3. Set secrets `QUAY_USERNAME` and `QUAY_TOKEN` for a robot account scoped to **that** namespace only.
+4. Run the workflow via **Actions → Run workflow** (`workflow_dispatch`), or push/schedule once the variable is set.
+
+Without `QUAY_RHDH_IMAGE_REPO` / `QUAY_E2E_RUNNER_IMAGE_REPO`, scheduled and push runs on a fork are skipped. A manual run without the variable fails with an error rather than pushing to the shared production image.
+
 ## Commit Messages
 
 Follow the [Conventional Commits](https://www.conventionalcommits.org/) specification: