From 50109afaa33383741fc6fa4333f07145bb5782c3 Mon Sep 17 00:00:00 2001
From: aleekaz <alexandr.kazmin@nodemaven.com>
Date: Mon, 5 Oct 2026 21:46:53 +0300
Subject: [PATCH] ci: skip the release job on pull requests from forks

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b1e3f1f..34589883 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -477,6 +477,8 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     needs: [manylinux, musllinux, windows, macos, android, sdist, tests, pypy311, style]
+    # Fork PRs get no id-token, so attestation and the publish dry-run can't run there.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       # Use to sign the release artifacts
       id-token: write