.github/workflows/kubernetes-controller.yml (1)

158-173: ⚠️ Potential issue | 🔴 Critical

Exclude PR events from the publish eligibility check.

On pull_request events, REF resolves to github.head_ref (Line 52). A PR branch named kubernetes/controller/v1.2.3 will match the version regex here and set should_publish=true, allowing the publish job (Line 295) to run on unmerged PR code. Add a guard condition to skip this check for PRs, as the CLI workflow already does.

Suggested fix

       - name: Determine publish eligibility
+        if: ${{ github.event_name != 'pull_request' }}
         id: branch-check
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           REF: ${{ env.REF }}
         with:
           script: |
             const ref = process.env.REF;
             const defaultBranch = context.payload.repository?.default_branch || 'main';
             // Publish for: main or release tags.
             // Release branches (releases/v*) only build+test.
             core.setOutput(
               'should_publish',
               ref === defaultBranch ||
               /^kubernetes\/controller\/v\d+\.\d+(\.\d+)?(-.*)?$/.test(ref)
             );

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/kubernetes-controller.yml around lines 158 - 173, The
branch-check step (id: branch-check) sets the output should_publish based only
on REF and a version-regex, which causes pull_request events (where REF is
github.head_ref) to incorrectly mark PR branches like
kubernetes/controller/v1.2.3 as publishable; update the script to first detect
the event type (e.g., context.eventName or github.event_name) and short-circuit
so that when the event is "pull_request" it sets should_publish to false (or
skips the regex check), otherwise proceed with the existing defaultBranch/ref vs
/^kubernetes\/controller\/v\d+\.\d+(\.\d+)?(-.*)?$/ test — modify the
branch-check step to include this guard so publish cannot run on unmerged PR
code.

.github/workflows/cli.yml (1)

124-133: ⚠️ Potential issue | 🟠 Major

Use the ref being built when deciding publish eligibility.

This step checks GITHUB_REF_NAME, but the workflow otherwise builds from env.REF (Lines 48 and 77). Under workflow_call, a caller can override ref; with the current code, the publish decision is made from the GitHub context ref instead of the actual ref being built. Reuse env.REF here for consistency.

Suggested fix

       - name: Determine if this is a push-eligible branch
         if: ${{ github.event_name != 'pull_request' }}
         id: branch-check
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          REF: ${{ env.REF }}
         with:
           script: |
+            const ref = process.env.REF;
             core.setOutput(
               "should_push_oci_image",
-              process.env.GITHUB_REF_NAME === context.payload.repository.default_branch ||
-              /^cli\/v\d+\.\d+(\.\d+)?(-.*)?$/.test(process.env.GITHUB_REF_NAME)
+              ref === context.payload.repository.default_branch ||
+              /^cli\/v\d+\.\d+(\.\d+)?(-.*)?$/.test(ref)
             )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/cli.yml around lines 124 - 133, The publish eligibility
check in the GitHub Action step with id "branch-check" uses
process.env.GITHUB_REF_NAME but the workflow builds from env.REF when callers
can override the ref; update the script used by actions/github-script (the
core.setOutput call that sets "should_push_oci_image") to use process.env.REF
instead of process.env.GITHUB_REF_NAME while keeping the existing comparison
against context.payload.repository.default_branch and the
/^cli\/v\d+\.\d+(\.\d+)?(-.*)?$/ regex so the decision reflects the actual ref
being built.