ethpandaops · parithosh · May 20, 2026
diff --git a/.github/workflows/_shared-build.yaml b/.github/workflows/_shared-build.yaml
@@ -3,10 +3,6 @@ name: Reusable build workflow
 on:
   workflow_call:
     inputs:
-      ref:
-        description: 'The branch, tag or SHA to build'
-        required: true
-        type: string
       release:
         description: 'Release version tag for this build'
         default: ''
@@ -15,7 +11,7 @@ on:
       docker:
         description: 'Build docker images'
         default: false
-        required: true
+        required: false
         type: boolean
       docker_repository:
         description: 'Docker Hub Repository'
@@ -40,15 +36,18 @@ on:
         description: 'Docker Hub Token'
         required: false
 
+permissions:
+  contents: read
+
 # shared build jobs
 jobs:
   build_frontend:
     name: Build frontend
     runs-on: ubuntu-latest
+    outputs:
+      artifact_id: ${{ steps.upload_frontend.outputs.artifact-id }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     - name: Set up Node.js
       uses: actions/setup-node@v6
@@ -60,6 +59,7 @@ jobs:
 
     # upload artifacts
     - name: "Upload artifact: frontend"
+      id: upload_frontend
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         path: ./pkg/web/static/
@@ -69,10 +69,10 @@ jobs:
     name: Build linux/amd64 binary
     needs: [build_frontend]
     runs-on: ubuntu-latest
+    outputs:
+      artifact_id: ${{ steps.upload_binary.outputs.artifact-id }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     # setup global dependencies
     - name: Set up go
@@ -84,7 +84,8 @@ jobs:
     - name: Download frontend artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: frontend
+        artifact-ids: ${{ needs.build_frontend.outputs.artifact_id }}
+        merge-multiple: true
         path: ./pkg/web/static
 
     # setup project dependencies
@@ -102,6 +103,7 @@ jobs:
 
     # upload artifacts
     - name: "Upload artifact: assertoor_linux_amd64"
+      id: upload_binary
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         path: ./bin/*
@@ -111,10 +113,10 @@ jobs:
     name: Build linux/arm64 binary
     needs: [build_frontend]
     runs-on: ubuntu-24.04-arm
+    outputs:
+      artifact_id: ${{ steps.upload_binary.outputs.artifact-id }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     # setup global dependencies
     - name: Set up go
@@ -126,7 +128,8 @@ jobs:
     - name: Download frontend artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: frontend
+        artifact-ids: ${{ needs.build_frontend.outputs.artifact_id }}
+        merge-multiple: true
         path: ./pkg/web/static
 
     # setup project dependencies
@@ -144,6 +147,7 @@ jobs:
 
     # upload artifacts
     - name: "Upload artifact: assertoor_linux_arm64"
+      id: upload_binary
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         path: ./bin/*
@@ -155,8 +159,6 @@ jobs:
     runs-on: windows-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     # setup global dependencies
     - name: Set up go
@@ -168,7 +170,8 @@ jobs:
     - name: Download frontend artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: frontend
+        artifact-ids: ${{ needs.build_frontend.outputs.artifact_id }}
+        merge-multiple: true
         path: ./pkg/web/static
 
     # setup project dependencies
@@ -197,8 +200,6 @@ jobs:
     runs-on: macos-26
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     # setup global dependencies
     - name: Set up go
@@ -210,7 +211,8 @@ jobs:
     - name: Download frontend artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: frontend
+        artifact-ids: ${{ needs.build_frontend.outputs.artifact_id }}
+        merge-multiple: true
         path: ./pkg/web/static
 
     # setup project dependencies
@@ -240,8 +242,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     - name: Get build version
       id: vars
@@ -260,7 +260,8 @@ jobs:
     - name: Download build artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: assertoor_linux_amd64
+        artifact-ids: ${{ needs.build_linux_amd64_binary.outputs.artifact_id }}
+        merge-multiple: true
         path: ./bin
 
     # prepare environment
@@ -288,8 +289,6 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
     - name: Get build version
       id: vars
       run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
@@ -307,7 +306,8 @@ jobs:
     - name: Download build artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: assertoor_linux_arm64
+        artifact-ids: ${{ needs.build_linux_arm64_binary.outputs.artifact_id }}
+        merge-multiple: true
         path: ./bin
 
     # prepare environment
@@ -335,8 +335,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
     - name: Get build version
       id: vars
       run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
@@ -367,8 +365,6 @@ jobs:
         tag: ${{ fromJSON(inputs.additional_tags) }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
     - name: Get build version
       id: vars
       run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

diff --git a/.github/workflows/_shared-check.yaml b/.github/workflows/_shared-check.yaml
@@ -2,12 +2,9 @@
 name: Reusable check workflow
 on:
   workflow_call:
-    inputs:
-      ref:
-        description: 'The branch, tag or SHA to check'
-        default: ''
-        required: false
-        type: string
+
+permissions:
+  contents: read
 
 # shared check jobs
 jobs:
@@ -16,8 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     # setup global dependencies
     - name: Set up go
@@ -86,8 +81,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        ref: ${{ inputs.ref }}
 
     - name: Set up Node.js
       uses: actions/setup-node@v6

diff --git a/.github/workflows/build-dev-latest.yml b/.github/workflows/build-dev-latest.yml
@@ -22,7 +22,6 @@ jobs:
     needs: [check_source]
     uses: ./.github/workflows/_shared-build.yaml
     with:
-      ref: ${{ github.sha }}
       release: "snapshot"
       docker: true
       docker_repository: "ethpandaops/assertoor"

diff --git a/.github/workflows/build-dev.yml b/.github/workflows/build-dev.yml
@@ -2,7 +2,7 @@
 name: Build PR
 
 on:
-  pull_request_target:
+  pull_request:
     types: [synchronize]
   workflow_dispatch:
     inputs:
@@ -14,50 +14,54 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   prinfo:
     name: "Get PR info"
     runs-on: ubuntu-latest
     outputs:
       run_builds: ${{ steps.loadinfo.outputs.run_builds }}
-      commit_ref: ${{ steps.loadinfo.outputs.commit_ref }}
       build_docker: ${{ steps.loadinfo.outputs.build_docker }}
       docker_tag: ${{ steps.loadinfo.outputs.docker_tag }}
     steps:
     - name: "Load PR info"
       id: loadinfo
+      env:
+        HAS_DOCKER_IMAGE_LABEL: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'build-docker-image') }}
+        SAME_REPOSITORY_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
+        MANUAL_DOCKER_TAG: ${{ inputs.docker_tag }}
       run: |
-        has_docker_image_label="${{ contains(github.event.pull_request.labels.*.name, 'build-docker-image') }}"
+        has_docker_image_label="$HAS_DOCKER_IMAGE_LABEL"
+        same_repository_pr="$SAME_REPOSITORY_PR"
         run_builds="$has_docker_image_label"
+        build_docker="false"
         echo "docker image label: $has_docker_image_label"
+        echo "same repository PR: $same_repository_pr"
 
         branch_name="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
         echo "branch name: $branch_name"
-
-        commit_repo="$GITHUB_REPOSITORY"
-        commit_ref="${{ github.event.pull_request.head.sha }}"
-        if [[ -z "$commit_ref" ]]; then
-          commit_ref="${{ github.sha }}"
-        fi
-
-        echo "repository: $commit_repo"
-        echo "commit: $commit_ref"
 
-        manual_tag="${{ inputs.docker_tag }}"
+        manual_tag="$MANUAL_DOCKER_TAG"
         if [[ ! -z "$manual_tag" ]]; then
-          has_docker_image_label="true"
           branch_name="$manual_tag"
           run_builds="true"
+          build_docker="true"
+        elif [[ "$has_docker_image_label" == "true" ]] && [[ "$same_repository_pr" == "true" ]]; then
+          build_docker="true"
+        elif [[ "$has_docker_image_label" == "true" ]]; then
+          echo "Skipping docker push for forked PR; dispatch this workflow manually to publish a trusted build."
         fi
 
         if [[ "$branch_name" == "master" ]] || [[ "$branch_name" =~ ^v[0-9] ]]; then
           echo "Invalid branch name! Skipping builds"
           run_builds="false"
+          build_docker="false"
         fi
 
         echo "run_builds=$run_builds" >> $GITHUB_OUTPUT
-        echo "commit_ref=$commit_ref" >> $GITHUB_OUTPUT
-        echo "build_docker=$has_docker_image_label" >> $GITHUB_OUTPUT
+        echo "build_docker=$build_docker" >> $GITHUB_OUTPUT
         docker_tag="${branch_name//\//-}"
         echo "docker_tag=$docker_tag" >> $GITHUB_OUTPUT
 
@@ -66,17 +70,25 @@ jobs:
     needs: [prinfo]
     if: ${{ needs.prinfo.outputs.run_builds == 'true' }}
     uses: ./.github/workflows/_shared-check.yaml
-    with:
-      ref: ${{ needs.prinfo.outputs.commit_ref }}
 
   build_binaries:
     name: "Build Assertoor"
     needs: [prinfo, check_source]
-    if: ${{ needs.prinfo.outputs.run_builds == 'true' }}
+    if: ${{ needs.prinfo.outputs.run_builds == 'true' && needs.prinfo.outputs.build_docker != 'true' }}
+    uses: ./.github/workflows/_shared-build.yaml
+    with:
+      docker: false
+      docker_repository: "ethpandaops/assertoor"
+      docker_tag_prefix: ${{needs.prinfo.outputs.docker_tag}}
+      additional_tags: "['${{needs.prinfo.outputs.docker_tag}}','${{needs.prinfo.outputs.docker_tag}}-latest']"
+
+  build_binaries_and_docker:
+    name: "Build Assertoor and Docker image"
+    needs: [prinfo, check_source]
+    if: ${{ needs.prinfo.outputs.run_builds == 'true' && needs.prinfo.outputs.build_docker == 'true' }}
     uses: ./.github/workflows/_shared-build.yaml
     with:
-      ref: ${{ needs.prinfo.outputs.commit_ref }}
-      docker: ${{ needs.prinfo.outputs.build_docker == 'true' }}
+      docker: true
       docker_repository: "ethpandaops/assertoor"
       docker_tag_prefix: ${{needs.prinfo.outputs.docker_tag}}
       additional_tags: "['${{needs.prinfo.outputs.docker_tag}}','${{needs.prinfo.outputs.docker_tag}}-latest']"

diff --git a/.github/workflows/build-master.yml b/.github/workflows/build-master.yml
@@ -25,7 +25,6 @@ jobs:
     needs: [check_source]
     uses: ./.github/workflows/_shared-build.yaml
     with:
-      ref: ${{ github.sha }}
       release: "snapshot"
       docker: true
       docker_repository: "ethpandaops/assertoor"

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
@@ -16,7 +16,6 @@ jobs:
     name: "Build Assertoor"
     uses: ./.github/workflows/_shared-build.yaml
     with:
-      ref: ${{ github.sha }}
       release: "v${{ inputs.version }}"
       docker: true
       docker_repository: "ethpandaops/assertoor"

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
@@ -10,8 +10,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check_source:
     name: "Run code checks"
     uses: ./.github/workflows/_shared-check.yaml
-