From 96bcb4746df8a943d211a03f98053dd9f2612c3b Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Thu, 15 Oct 2026 11:09:44 +1000
Subject: [PATCH] fix(ci): never run the mkosi image job for fork PRs on
 self-hosted runners

---
 .github/workflows/image-scripts.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/image-scripts.yml b/.github/workflows/image-scripts.yml
index 61f0753dc..e2c89dd29 100644
--- a/.github/workflows/image-scripts.yml
+++ b/.github/workflows/image-scripts.yml
@@ -36,6 +36,9 @@ jobs:
 
   eks_mkosi_image:
     name: Build mkosi EKS image
+    # A fork PR's code must never run on a persistent self-hosted runner: it
+    # shares disk, caches and credentials with the release jobs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, ci-single]
     concurrency:
       group: eks-mkosi-image-${{ github.ref }}