From 1f37221f9aeee6f22dd23207407f4452f9c35f56 Mon Sep 17 00:00:00 2001
From: Patrik Korytar <patrik.korytar@gmail.com>
Date: Mon, 29 Jun 2026 12:21:28 +0200
Subject: [PATCH] Prevent Mend workflow in fork repos to be run

---
 .github/workflows/gradle-snapshot.yml | 3 +--
 .github/workflows/maven-snapshot.yml  | 3 +--
 .github/workflows/mend-ci.yml         | 7 ++++++-
 .github/workflows/sbt-snapshot.yml    | 3 +--
 README.md                             | 4 +++-
 5 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/gradle-snapshot.yml b/.github/workflows/gradle-snapshot.yml
index 8d3216d..600d4fd 100644
--- a/.github/workflows/gradle-snapshot.yml
+++ b/.github/workflows/gradle-snapshot.yml
@@ -4,8 +4,7 @@ on:
   workflow_call:
     inputs:
       project_name:
-        # format: <organisation>/<project_name>
-        description: "The project name to run the job. Prevent forks to run snapshot job"
+        description: "Name in <organisation>/<project_name> format. Prevents forks to run the job"
         required: true
         type: string
       java_version:
diff --git a/.github/workflows/maven-snapshot.yml b/.github/workflows/maven-snapshot.yml
index a243f3b..44b2481 100644
--- a/.github/workflows/maven-snapshot.yml
+++ b/.github/workflows/maven-snapshot.yml
@@ -5,8 +5,7 @@ on:
     # Map the inputs that the caller needs to provide
     inputs:
       project_name:
-        # format: <organisation>/<project_name>
-        description: 'The project name to run the job. Prevent forks to run snapshot job'
+        description: 'Name in <organisation>/<project_name> format. Prevents forks to run the job'
         required: true
         type: string
       java_version:
diff --git a/.github/workflows/mend-ci.yml b/.github/workflows/mend-ci.yml
index 9b35c1c..249ef5d 100644
--- a/.github/workflows/mend-ci.yml
+++ b/.github/workflows/mend-ci.yml
@@ -3,6 +3,10 @@ name: Mend CLI scan
 on:
   workflow_call:
     inputs:
+      project_name:
+        description: "Name in <organisation>/<project_name> format. Prevents forks to run the job"
+        required: true
+        type: string
       SCA:
         required: true
         type: boolean
@@ -47,7 +51,8 @@ on:
         required: true
 
 jobs:
-  build-and-scan:
+  scan:
+    if: github.repository == inputs.project_name
     runs-on: ubuntu-latest
 
     env:
diff --git a/.github/workflows/sbt-snapshot.yml b/.github/workflows/sbt-snapshot.yml
index f433c29..95e1b4e 100644
--- a/.github/workflows/sbt-snapshot.yml
+++ b/.github/workflows/sbt-snapshot.yml
@@ -4,8 +4,7 @@ on:
   workflow_call:
     inputs:
       project_name:
-        # format: <organisation>/<project_name>
-        description: "The project name to run the job. Prevent forks to run snapshot job"
+        description: "Name in <organisation>/<project_name> format. Prevents forks to run the job"
         required: true
         type: string
       fetch_all_commits:
diff --git a/README.md b/README.md
index b6cae9a..d76288b 100644
--- a/README.md
+++ b/README.md
@@ -122,6 +122,8 @@ Workflows run in the context of the PR from a fork do not have access to the sec
 
 To exclude paths from being scanned, specify `SCA_EXCLUDES` and/or `SAST_EXCLUDES` values, in the comma-separated paths format: `'dir1/**,dir2/file.txt'`.
 
+`project_name` **must** be set by the caller (format: <organisation>/<project_name>).
+
 <details>
 <summary>Example of push to main and cronjob usage</summary>
 
@@ -247,7 +249,7 @@ Workflow for deploying snapshot versions to Maven Central. Gated to the upstream
 - **Tasks**: Deploy our SNAPSHOT version of our project to Maven Central
   Optionally builds and pushes a Quarkus Jib image to Quay.io.
 - **Inputs**: The following inputs are available to be overridden
-  * project_name :  **Must** be set by te caller.
+  * project_name :  **Must** be set by the caller (format: <organisation>/<project_name>).
   * java_version (default: `21`)
   * snapshot_deploy_command (default `mvn -B -V deploy`)
   * fetch_all_commits (default: `false`)