From 2b46c766ff126ea183a865f0ff74cac5f41b5264 Mon Sep 17 00:00:00 2001
From: "Ralf W. Grosse-Kunstleve" <rgrossekunst@nvidia.com>
Date: Wed, 19 Aug 2026 15:03:46 -0700
Subject: [PATCH 1/2] CI: guard public-only automation outside NVIDIA

Skip the remaining CI and coverage roots, including their always-run aggregators, outside NVIDIA. Prevent the public triage labeler from mutating private issues.
---
 .github/workflows/ci.yml          | 5 ++++-
 .github/workflows/coverage.yml    | 3 ++-
 .github/workflows/triagelabel.yml | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2aadf222306..b17a3fe19d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,7 @@ on:
 
 jobs:
   ci-vars:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       CUDA_BUILD_VER: ${{ steps.get-vars.outputs.cuda_build_ver }}
@@ -47,6 +48,7 @@ jobs:
           echo "cuda_prev_build_ver=$cuda_prev_build_ver" >> $GITHUB_OUTPUT
 
   should-skip:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       skip: ${{ steps.get-should-skip.outputs.skip }}
@@ -89,6 +91,7 @@ jobs:
   # unconditionally run everything because there is no meaningful "changed
   # paths" baseline for those events.
   detect-changes:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       bindings: ${{ steps.compose.outputs.bindings }}
@@ -535,7 +538,7 @@ jobs:
 
   checks:
     name: Check job status
-    if: always()
+    if: ${{ always() && github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     needs:
       - should-skip
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index fc234999fca..bea9d118991 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -17,6 +17,7 @@ env:
 
 jobs:
   coverage-vars:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       CUDA_VER: ${{ steps.get-vars.outputs.cuda_ver }}
@@ -467,7 +468,7 @@ jobs:
     name: Combine Coverage and Deploy
     needs: [coverage-linux, coverage-windows]
     runs-on: ubuntu-latest
-    if: always()
+    if: ${{ always() && github.repository_owner == 'nvidia' }}
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/triagelabel.yml b/.github/workflows/triagelabel.yml
index 300efad36a2..a1e7eafe190 100644
--- a/.github/workflows/triagelabel.yml
+++ b/.github/workflows/triagelabel.yml
@@ -12,6 +12,7 @@ on:
 
 jobs:
   triage:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write

From b2c77f3bf8524b23c8c1c78ab0ea4bd91c6d3913 Mon Sep 17 00:00:00 2001
From: "Ralf W. Grosse-Kunstleve" <rgrossekunst@nvidia.com>
Date: Wed, 19 Aug 2026 15:04:03 -0700
Subject: [PATCH 2/2] CI: guard public release workflows outside NVIDIA

Gate the release workflow roots so inherited definitions cannot create draft releases or reach external publishing operations in the private repository.
---
 .github/workflows/release-cuda-pathfinder.yml | 1 +
 .github/workflows/release.yml                 | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/release-cuda-pathfinder.yml b/.github/workflows/release-cuda-pathfinder.yml
index f3d1952e9ec..d3a5e7dad7e 100644
--- a/.github/workflows/release-cuda-pathfinder.yml
+++ b/.github/workflows/release-cuda-pathfinder.yml
@@ -33,6 +33,7 @@ jobs:
   # Collect release metadata, find the CI run, create a draft release.
   # --------------------------------------------------------------------------
   prepare:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4f2c54f4509..1fd0ec23431 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -76,6 +76,7 @@ defaults:
 
 jobs:
   determine-run-id:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       run-id: ${{ steps.lookup-run-id.outputs.run-id }}
@@ -103,6 +104,7 @@ jobs:
           echo "run-id=$RUN_ID" >> "$GITHUB_OUTPUT"
 
   check-tag:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source
@@ -154,6 +156,7 @@ jobs:
           fi
 
   check-release-notes:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source