From c9a9a98d12a8f050b87c0e1cb09a6c885f38206d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 03:27:29 +0000
Subject: [PATCH 01/11] Gate manually triggered workflows

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .github/workflows/copilot-setup-steps.yml  |  1 +
 .github/workflows/labeler-promote.yml      |  4 ++--
 .github/workflows/labeler-train.yml        | 12 ++++++------
 .github/workflows/release-github-tasks.yml |  1 +
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index a344b122b9d..2c70e8db030 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -14,6 +14,7 @@ on:
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
   copilot-setup-steps:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ github.repository_owner == 'microsoft' && '8-core-ubuntu-latest' || 'ubuntu-latest' }}
 
     permissions:
diff --git a/.github/workflows/labeler-promote.yml b/.github/workflows/labeler-promote.yml
index de703e8af50..5933288f606 100644
--- a/.github/workflows/labeler-promote.yml
+++ b/.github/workflows/labeler-promote.yml
@@ -28,7 +28,7 @@ permissions: {}
 
 jobs:
   promote-issues:
-    if: ${{ inputs.issues }}
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.issues }}
     runs-on: ubuntu-latest
     permissions:
       actions: write # The promotion action deletes the active GitHub Actions cache.
@@ -41,7 +41,7 @@ jobs:
           backup_key: ${{ inputs.backup_key }}
 
   promote-pulls:
-    if: ${{ inputs.pulls }}
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.pulls }}
     runs-on: ubuntu-latest
     permissions:
       actions: write # The promotion action deletes the active GitHub Actions cache.
diff --git a/.github/workflows/labeler-train.yml b/.github/workflows/labeler-train.yml
index 861e5360085..b6e10d855ad 100644
--- a/.github/workflows/labeler-train.yml
+++ b/.github/workflows/labeler-train.yml
@@ -51,7 +51,7 @@ env:
 
 jobs:
   download-issues:
-    if: ${{ contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
+    if: ${{ github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
     runs-on: ubuntu-latest
     permissions:
       issues: read
@@ -71,7 +71,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
   download-pulls:
-    if: ${{ contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
+    if: ${{ github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
@@ -91,7 +91,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
   train-issues:
-    if: ${{ always() && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-issues.result) }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-issues.result) }}
     runs-on: ubuntu-latest
     permissions: {}
     needs: download-issues
@@ -104,7 +104,7 @@ jobs:
           model_cache_key: ${{ env.CACHE_KEY }}
 
   train-pulls:
-    if: ${{ always() && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-pulls.result) }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-pulls.result) }}
     runs-on: ubuntu-latest
     permissions: {}
     needs: download-pulls
@@ -117,7 +117,7 @@ jobs:
           model_cache_key: ${{ env.CACHE_KEY }}
 
   test-issues:
-    if: ${{ always() && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-issues.result) }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-issues.result) }}
     runs-on: ubuntu-latest
     permissions:
       issues: read
@@ -139,7 +139,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
   test-pulls:
-    if: ${{ always() && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-pulls.result) }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-pulls.result) }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
diff --git a/.github/workflows/release-github-tasks.yml b/.github/workflows/release-github-tasks.yml
index 4ab8f0b3c7d..9b1a06e2ac4 100644
--- a/.github/workflows/release-github-tasks.yml
+++ b/.github/workflows/release-github-tasks.yml
@@ -97,6 +97,7 @@ jobs:
   # `skip_*` inputs so partial-failure re-runs still behave the same way.
   release:
     name: Release Tasks
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     # Authorization uses github.token; release operations use the App token.
     permissions:

From c560928dd82dce5e84ba347b00d17813c5bfb88f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 03:30:14 +0000
Subject: [PATCH 02/11] Constrain workflow repository guards

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .github/workflows/analyze-ci-failure.md            |  2 +-
 .../workflows/auto-rerun-outerloop-failures.yml    |  2 +-
 .../workflows/auto-rerun-transient-ci-failures.yml |  2 +-
 .github/workflows/backmerge-release.yml            |  2 +-
 .github/workflows/ci.yml                           | 10 +++++-----
 .github/workflows/deployment-cleanup.yml           |  2 +-
 .github/workflows/deployment-test-command.yml      |  2 +-
 .github/workflows/deployment-tests.yml             |  8 ++++----
 .github/workflows/dogfood-comment.yml              |  2 +-
 .../workflows/extension-changelog-finalized.yml    |  1 +
 .github/workflows/generate-api-diffs.yml           |  2 +-
 .github/workflows/generate-ats-diffs.yml           |  2 +-
 .github/workflows/labeler-cache-retention.yml      |  2 +-
 .github/workflows/labeler-predict-issues.yml       |  2 +-
 .github/workflows/labeler-predict-pulls.yml        |  2 +-
 .github/workflows/locker.yml                       |  2 +-
 .github/workflows/markdownlint.yml                 |  2 +-
 .github/workflows/milestone-changelog.lock.yml     |  2 +-
 .github/workflows/milestone-changelog.md           |  2 +-
 .github/workflows/monitor-scheduled-workflows.yml  |  2 +-
 .github/workflows/pr-docs-check.md                 |  2 +-
 .github/workflows/refresh-manifests.yml            |  2 +-
 .github/workflows/release-github-tasks.yml         |  6 +++---
 .github/workflows/reproduce-flaky-tests.yml        |  6 ++++--
 .github/workflows/scratch-cli-platform-smoke.yml   |  2 ++
 .github/workflows/specialized-test-runner.yml      | 12 ++++++------
 .github/workflows/tests-daily-smoke.yml            |  2 ++
 .github/workflows/tests-outerloop.yml              |  4 ++--
 .github/workflows/tests-quarantine.yml             |  4 ++--
 .github/workflows/tests.yml                        | 14 +++++++-------
 .github/workflows/update-ai-foundry-models.yml     |  2 +-
 .github/workflows/update-aspire-skills-bundle.yml  |  2 +-
 .github/workflows/update-azure-vm-sizes.yml        |  2 +-
 .github/workflows/update-dependencies.yml          |  2 +-
 .github/workflows/update-nix-cli-flake.yml         |  1 +
 .github/workflows/validate-agentic-workflows.yml   |  1 +
 .github/workflows/validate-copilot-extensions.yml  |  2 +-
 .github/workflows/verify-aspire-skills-bundle.yml  |  2 +-
 .../workflows/verify-telemetry-hook-changes.yml    |  1 +
 .github/workflows/warm-cli-e2e-image-cache.yml     |  2 +-
 .github/workflows/zizmor.yml                       |  1 +
 41 files changed, 68 insertions(+), 57 deletions(-)

diff --git a/.github/workflows/analyze-ci-failure.md b/.github/workflows/analyze-ci-failure.md
index 6b5fcb4f046..71d5eb65d1a 100644
--- a/.github/workflows/analyze-ci-failure.md
+++ b/.github/workflows/analyze-ci-failure.md
@@ -24,7 +24,7 @@ jobs:
   collect-data:
     runs-on: ubuntu-latest
     if: >-
-      github.repository_owner == 'microsoft'
+      github.repository == 'microsoft/aspire'
       && (
         github.event_name == 'workflow_dispatch'
         || (
diff --git a/.github/workflows/auto-rerun-outerloop-failures.yml b/.github/workflows/auto-rerun-outerloop-failures.yml
index b4b6dcfc67b..5ede5ed2058 100644
--- a/.github/workflows/auto-rerun-outerloop-failures.yml
+++ b/.github/workflows/auto-rerun-outerloop-failures.yml
@@ -31,7 +31,7 @@ jobs:
     # them would mask genuine breakage in exactly the PRs that change outerloop CI.
     if: >-
       ${{
-          github.repository_owner == 'microsoft' &&
+          github.repository == 'microsoft/aspire' &&
           github.event.workflow_run.event != 'pull_request' &&
           github.event.workflow_run.conclusion == 'failure' &&
           github.event.workflow_run.run_attempt <= 3
diff --git a/.github/workflows/auto-rerun-transient-ci-failures.yml b/.github/workflows/auto-rerun-transient-ci-failures.yml
index 561e7450820..c5febcd3d95 100644
--- a/.github/workflows/auto-rerun-transient-ci-failures.yml
+++ b/.github/workflows/auto-rerun-transient-ci-failures.yml
@@ -31,7 +31,7 @@ jobs:
     name: Analyze transient CI failures
     if: >-
       ${{
-          github.repository_owner == 'microsoft' &&
+          github.repository == 'microsoft/aspire' &&
           (github.event_name == 'workflow_dispatch' ||
            (github.event.workflow_run.event == 'pull_request' &&
             github.event.workflow_run.conclusion == 'failure' &&
diff --git a/.github/workflows/backmerge-release.yml b/.github/workflows/backmerge-release.yml
index 5c21c72eb7a..330a9c43790 100644
--- a/.github/workflows/backmerge-release.yml
+++ b/.github/workflows/backmerge-release.yml
@@ -14,7 +14,7 @@ jobs:
   backmerge:
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
 
     steps:
       - name: Generate GitHub App Token
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ddf9abf5300..f892bce51f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
   prepare_for_ci:
     runs-on: ubuntu-latest
     name: Prepare for CI
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     outputs:
       skip_workflow: ${{ (steps.check_for_changes.outputs.no_changes == 'true' || steps.check_for_changes.outputs.only_changed == 'true') && 'true' || 'false' }}
       VERSION_SUFFIX_OVERRIDE: ${{ steps.compute_version_suffix.outputs.VERSION_SUFFIX_OVERRIDE }}
@@ -80,7 +80,7 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
-    if: ${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}
     with:
       versionOverrideArg: ${{ needs.prepare_for_ci.outputs.VERSION_SUFFIX_OVERRIDE }}
       extensionVersionOverride: ${{ needs.prepare_for_ci.outputs.EXTENSION_VERSION_OVERRIDE }}
@@ -109,7 +109,7 @@ jobs:
     name: Stabilization Check
     runs-on: 8-core-ubuntu-latest
     needs: [prepare_for_ci]
-    if: ${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}
     steps:
       # The actual stabilization work only makes sense for pull_request events. On push
       # (including push to release branches with StabilizePackageVersion=true) the build is
@@ -185,7 +185,7 @@ jobs:
 
   # This job is used for branch protection. It fails if any of the dependent jobs failed
   results:
-    if: ${{ always() && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Final Results
     needs: [prepare_for_ci, tests, stabilization_check]
@@ -220,7 +220,7 @@ jobs:
   ci_failure_tracker:
     name: Track CI Failure
     needs: [prepare_for_ci, tests, stabilization_check]
-    if: ${{ always() && github.event_name == 'push' && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.event_name == 'push' && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read   # checkout to require the local .js modules
diff --git a/.github/workflows/deployment-cleanup.yml b/.github/workflows/deployment-cleanup.yml
index 7d9d86e3807..6b3490aa12c 100644
--- a/.github/workflows/deployment-cleanup.yml
+++ b/.github/workflows/deployment-cleanup.yml
@@ -39,7 +39,7 @@ jobs:
   cleanup:
     name: Cleanup Azure Resources
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     environment: deployment-testing
 
     steps:
diff --git a/.github/workflows/deployment-test-command.yml b/.github/workflows/deployment-test-command.yml
index dd42328593c..02ff2321cdc 100644
--- a/.github/workflows/deployment-test-command.yml
+++ b/.github/workflows/deployment-test-command.yml
@@ -23,7 +23,7 @@ jobs:
       ${{
         startsWith(github.event.comment.body, '/deployment-test') &&
         github.event.issue.pull_request &&
-        github.repository_owner == 'microsoft'
+        github.repository == 'microsoft/aspire'
       }}
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/deployment-tests.yml b/.github/workflows/deployment-tests.yml
index f13ffcec879..b812a745c6e 100644
--- a/.github/workflows/deployment-tests.yml
+++ b/.github/workflows/deployment-tests.yml
@@ -40,7 +40,7 @@ jobs:
   notify-start:
     name: Notify PR
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' && inputs.pr_number != '' }}
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.pr_number != '' }}
     permissions:
       pull-requests: write
     steps:
@@ -67,7 +67,7 @@ jobs:
   enumerate:
     name: Enumerate Tests
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read
     outputs:
@@ -114,7 +114,7 @@ jobs:
   build:
     name: Build
     runs-on: 8-core-ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read
     steps:
@@ -641,7 +641,7 @@ jobs:
     name: Create Issue on Failure
     needs: [deploy-test]
     runs-on: ubuntu-latest
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read   # checkout to require the local .js modules
       issues: write
diff --git a/.github/workflows/dogfood-comment.yml b/.github/workflows/dogfood-comment.yml
index 97faf6c42ab..7f66d943074 100644
--- a/.github/workflows/dogfood-comment.yml
+++ b/.github/workflows/dogfood-comment.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   add-dogfood-comment:
     # Only run on the dotnet org to avoid running on forks
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
diff --git a/.github/workflows/extension-changelog-finalized.yml b/.github/workflows/extension-changelog-finalized.yml
index 8c975a791c7..55dafdbc890 100644
--- a/.github/workflows/extension-changelog-finalized.yml
+++ b/.github/workflows/extension-changelog-finalized.yml
@@ -13,6 +13,7 @@ permissions:
 jobs:
   extension_changelog_finalized:
     name: Extension changelog finalized
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/generate-api-diffs.yml b/.github/workflows/generate-api-diffs.yml
index 7b5019ca092..c3b1aa34612 100644
--- a/.github/workflows/generate-api-diffs.yml
+++ b/.github/workflows/generate-api-diffs.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/generate-ats-diffs.yml b/.github/workflows/generate-ats-diffs.yml
index fb5707c0a2c..3a83742181c 100644
--- a/.github/workflows/generate-ats-diffs.yml
+++ b/.github/workflows/generate-ats-diffs.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/labeler-cache-retention.yml b/.github/workflows/labeler-cache-retention.yml
index f1dcbc2c55f..94b22873376 100644
--- a/.github/workflows/labeler-cache-retention.yml
+++ b/.github/workflows/labeler-cache-retention.yml
@@ -21,7 +21,7 @@ env:
 jobs:
   restore-cache:
     # Do not automatically run the workflow on forks outside the 'dotnet' org
-    if: ${{ github.event_name == 'workflow_dispatch' || github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/labeler-predict-issues.yml b/.github/workflows/labeler-predict-issues.yml
index 25b0ff5d139..9d1eb6fe692 100644
--- a/.github/workflows/labeler-predict-issues.yml
+++ b/.github/workflows/labeler-predict-issues.yml
@@ -29,7 +29,7 @@ env:
 jobs:
   predict-issue-label:
     # Do not automatically run the workflow on forks outside the 'dotnet' org
-    if: ${{ github.event_name == 'workflow_dispatch' || github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write
diff --git a/.github/workflows/labeler-predict-pulls.yml b/.github/workflows/labeler-predict-pulls.yml
index 7a5eb0d43c2..c7e6c8609d1 100644
--- a/.github/workflows/labeler-predict-pulls.yml
+++ b/.github/workflows/labeler-predict-pulls.yml
@@ -89,7 +89,7 @@ jobs:
   predict-pull-label:
     # The 'if' uses always() so this job runs even when poll-pull-requests is skipped
     # Do not automatically run the workflow on forks outside the 'dotnet' org
-    if: ${{ always() && (github.event_name == 'workflow_dispatch' || github.repository_owner == 'microsoft') }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     needs: [poll-pull-requests]
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml
index a125abebd27..e0e9b436bce 100644
--- a/.github/workflows/locker.yml
+++ b/.github/workflows/locker.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   main:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - name: Checkout Actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
index 05356ef1801..756685d3d13 100644
--- a/.github/workflows/markdownlint.yml
+++ b/.github/workflows/markdownlint.yml
@@ -12,7 +12,7 @@ jobs:
   lint:
 
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/milestone-changelog.lock.yml b/.github/workflows/milestone-changelog.lock.yml
index 570387868e1..57a53c48603 100644
--- a/.github/workflows/milestone-changelog.lock.yml
+++ b/.github/workflows/milestone-changelog.lock.yml
@@ -340,7 +340,7 @@ jobs:
     needs:
       - activation
       - fetch-data
-    if: github.repository_owner == 'microsoft' && needs.fetch-data.outputs.has-work == 'true'
+    if: github.repository == 'microsoft/aspire' && needs.fetch-data.outputs.has-work == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/milestone-changelog.md b/.github/workflows/milestone-changelog.md
index 9915ccd0691..8a446a54ab0 100644
--- a/.github/workflows/milestone-changelog.md
+++ b/.github/workflows/milestone-changelog.md
@@ -318,7 +318,7 @@ jobs:
           name: changelog-data
           path: /tmp/gh-aw/
 
-if: github.repository_owner == 'microsoft' && needs.fetch-data.outputs.has-work == 'true'
+if: github.repository == 'microsoft/aspire' && needs.fetch-data.outputs.has-work == 'true'
 
 permissions:
   contents: read
diff --git a/.github/workflows/monitor-scheduled-workflows.yml b/.github/workflows/monitor-scheduled-workflows.yml
index 575c72fc284..557edd29910 100644
--- a/.github/workflows/monitor-scheduled-workflows.yml
+++ b/.github/workflows/monitor-scheduled-workflows.yml
@@ -33,7 +33,7 @@ concurrency:
 jobs:
   monitor:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/pr-docs-check.md b/.github/workflows/pr-docs-check.md
index f46767b66cf..f03f126c697 100644
--- a/.github/workflows/pr-docs-check.md
+++ b/.github/workflows/pr-docs-check.md
@@ -29,7 +29,7 @@ on:
 
 if: >-
   (github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch')
-  && github.repository_owner == 'microsoft'
+  && github.repository == 'microsoft/aspire'
 
 # Cap the number of agent turns. `max-turns` is the supported field; the older
 # `max-runs` alias is deprecated and rejected under strict compilation. It
diff --git a/.github/workflows/refresh-manifests.yml b/.github/workflows/refresh-manifests.yml
index 0544645ddd9..400fab81db9 100644
--- a/.github/workflows/refresh-manifests.yml
+++ b/.github/workflows/refresh-manifests.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: windows-latest # Using Windows because the script uses PowerShell and build.cmd
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/release-github-tasks.yml b/.github/workflows/release-github-tasks.yml
index 9b1a06e2ac4..e8b307a3da9 100644
--- a/.github/workflows/release-github-tasks.yml
+++ b/.github/workflows/release-github-tasks.yml
@@ -419,7 +419,7 @@ jobs:
   merge-pr:
     name: Create Merge-Back PR
     needs: release
-    if: inputs.skip_merge_pr != true
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.skip_merge_pr != true }}
     runs-on: ubuntu-latest
     # Every GitHub operation in this job uses the App token minted below.
     permissions: {}
@@ -508,7 +508,7 @@ jobs:
   baseline-pr:
     name: Create Baseline Version Branch/PR
     needs: release
-    if: inputs.skip_baseline_pr != true && inputs.is_prerelease != true
+    if: ${{ github.repository == 'microsoft/aspire' && inputs.skip_baseline_pr != true && inputs.is_prerelease != true }}
     runs-on: ubuntu-latest
     # Every GitHub operation in this job uses the App token minted below.
     permissions: {}
@@ -664,7 +664,7 @@ jobs:
   summary:
     name: Summary
     needs: [release, merge-pr, baseline-pr]
-    if: always()
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Print Summary
diff --git a/.github/workflows/reproduce-flaky-tests.yml b/.github/workflows/reproduce-flaky-tests.yml
index fd002aaab45..a2dd9e0256a 100644
--- a/.github/workflows/reproduce-flaky-tests.yml
+++ b/.github/workflows/reproduce-flaky-tests.yml
@@ -45,6 +45,7 @@ jobs:
 
   setup:
     name: Generate matrix
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.generate.outputs.matrix }}
@@ -127,7 +128,7 @@ jobs:
   build_cli_e2e_image:
     name: Build CLI E2E Docker image
     needs: setup
-    if: ${{ needs.setup.outputs.is_cli_e2e == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.setup.outputs.is_cli_e2e == 'true' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
 
   reproduce:
@@ -135,6 +136,7 @@ jobs:
     needs: [setup, build_cli_e2e_image]
     if: >-
       ${{
+        github.repository == 'microsoft/aspire' &&
         !cancelled() &&
         needs.setup.result == 'success' &&
         (needs.build_cli_e2e_image.result == 'success' || needs.build_cli_e2e_image.result == 'skipped')
@@ -388,7 +390,7 @@ jobs:
           if-no-files-found: ignore
 
   results:
-    if: always()
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Reproduce Results
     needs: [reproduce]
diff --git a/.github/workflows/scratch-cli-platform-smoke.yml b/.github/workflows/scratch-cli-platform-smoke.yml
index 415aa8a73e0..75847be9b0c 100644
--- a/.github/workflows/scratch-cli-platform-smoke.yml
+++ b/.github/workflows/scratch-cli-platform-smoke.yml
@@ -21,6 +21,7 @@ run-name: "CLI platform smoke tests for PR #${{ inputs.pr_number }} (run ${{ inp
 jobs:
   source:
     name: Resolve artifact source
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     outputs:
       sha: ${{ steps.source.outputs.sha }}
@@ -56,6 +57,7 @@ jobs:
   smoke:
     name: ${{ matrix.name }}
     needs: source
+    if: ${{ github.repository == 'microsoft/aspire' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/specialized-test-runner.yml b/.github/workflows/specialized-test-runner.yml
index 6571562fcc8..8ba886b4465 100644
--- a/.github/workflows/specialized-test-runner.yml
+++ b/.github/workflows/specialized-test-runner.yml
@@ -34,7 +34,7 @@ jobs:
   generate_tests_matrix:
     name: Generate test runsheet
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     outputs:
       runsheet: ${{ steps.inject_properties.outputs.runsheet }}
       requiresNugets: ${{ steps.check_nugets.outputs.requiresNugets }}
@@ -131,19 +131,19 @@ jobs:
   build_packages:
     name: Build packages
     needs: [generate_tests_matrix]
-    if: ${{ github.repository_owner == 'microsoft' && needs.generate_tests_matrix.outputs.requiresNugets == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.generate_tests_matrix.outputs.requiresNugets == 'true' }}
     uses: ./.github/workflows/build-packages.yml
 
   build_cli_archives:
     name: Build native CLI archives
     needs: [generate_tests_matrix]
-    if: ${{ github.repository_owner == 'microsoft' && (needs.generate_tests_matrix.outputs.requiresNugets == 'true' || needs.generate_tests_matrix.outputs.requiresCliArchive == 'true') }}
+    if: ${{ github.repository == 'microsoft/aspire' && (needs.generate_tests_matrix.outputs.requiresNugets == 'true' || needs.generate_tests_matrix.outputs.requiresCliArchive == 'true') }}
     uses: ./.github/workflows/build-cli-native-archives.yml
 
   build_cli_e2e_image:
     name: Build CLI E2E Docker image
     needs: [generate_tests_matrix]
-    if: ${{ github.repository_owner == 'microsoft' && needs.generate_tests_matrix.outputs.requiresCliArchive == 'true' }}
+    if: ${{ github.repository == 'microsoft/aspire' && needs.generate_tests_matrix.outputs.requiresCliArchive == 'true' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
 
   run_tests:
@@ -159,7 +159,7 @@ jobs:
     # We still require generate_tests_matrix and build_packages to succeed.
     if: >-
       ${{
-        github.repository_owner == 'microsoft' &&
+        github.repository == 'microsoft/aspire' &&
         !cancelled() &&
         needs.generate_tests_matrix.result == 'success' &&
         (needs.build_packages.result == 'success' || needs.build_packages.result == 'skipped') &&
@@ -176,7 +176,7 @@ jobs:
 
 
   results:
-    if: ${{ always() && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Final Results
     needs: [generate_tests_matrix, build_packages, build_cli_archives, build_cli_e2e_image, run_tests]
diff --git a/.github/workflows/tests-daily-smoke.yml b/.github/workflows/tests-daily-smoke.yml
index b95a693cee9..df728f76e4f 100644
--- a/.github/workflows/tests-daily-smoke.yml
+++ b/.github/workflows/tests-daily-smoke.yml
@@ -28,6 +28,7 @@ permissions:
 jobs:
   build_cli_e2e_image:
     name: Build CLI E2E Docker image
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
     with:
       includePolyglotImages: false
@@ -35,6 +36,7 @@ jobs:
   smoke-test:
     name: CLI Smoke Test (${{ inputs.quality || 'dev' }})
     needs: build_cli_e2e_image
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
 
diff --git a/.github/workflows/tests-outerloop.yml b/.github/workflows/tests-outerloop.yml
index e416dd6e26b..3531f94625c 100644
--- a/.github/workflows/tests-outerloop.yml
+++ b/.github/workflows/tests-outerloop.yml
@@ -36,6 +36,7 @@ concurrency:
 
 jobs:
   outerloop_tests:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
     with:
       testRunnerName: "OuterloopTestRunsheetBuilder"
@@ -52,7 +53,7 @@ jobs:
   report_failures:
     name: Report failures
     needs: [outerloop_tests]
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read   # checkout to require the local .js modules
@@ -114,4 +115,3 @@ jobs:
           script: |
             const reporter = require('./.github/workflows/report-specialized-test-failures.js');
             await require('./.github/workflows/specialized-test-failure-runner.js')({ github, context, core, reporter });
-
diff --git a/.github/workflows/tests-quarantine.yml b/.github/workflows/tests-quarantine.yml
index c4284dee2f4..f541bd32402 100644
--- a/.github/workflows/tests-quarantine.yml
+++ b/.github/workflows/tests-quarantine.yml
@@ -37,6 +37,7 @@ concurrency:
 
 jobs:
   quarantine_tests:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
     with:
       testRunnerName: "QuarantinedTestRunsheetBuilder"
@@ -55,7 +56,7 @@ jobs:
   report_infra_failure:
     name: Report infra failure
     needs: [quarantine_tests]
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read   # checkout to require the local .js modules
@@ -79,4 +80,3 @@ jobs:
           script: |
             const reporter = require('./.github/workflows/report-specialized-test-failures.js');
             await require('./.github/workflows/specialized-test-failure-runner.js')({ github, context, core, reporter });
-
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 1f0a404ff49..941ddcf2f43 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -476,7 +476,7 @@ jobs:
   cli_starter_validation_linux_x64:
     name: Aspire CLI Starter Validation (Ubuntu x64)
     needs: [setup_for_tests, build_packages, build_cli_archive_linux]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: ubuntu-latest
@@ -490,7 +490,7 @@ jobs:
   cli_starter_validation_linux_arm64:
     name: Aspire CLI Starter Validation (Ubuntu ARM64)
     needs: [setup_for_tests, build_packages, build_cli_archive_linux_arm64]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: ubuntu-24.04-arm
@@ -504,7 +504,7 @@ jobs:
   cli_starter_validation_windows_x64:
     name: Aspire CLI Starter Validation (Windows x64)
     needs: [setup_for_tests, build_packages, build_cli_archive_windows]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: windows-latest
@@ -518,7 +518,7 @@ jobs:
   cli_starter_validation_windows_arm64:
     name: Aspire CLI Starter Validation (Windows ARM64)
     needs: [setup_for_tests, build_packages, build_cli_archive_windows_arm64]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: windows-11-arm
@@ -532,7 +532,7 @@ jobs:
   cli_starter_validation_macos_x64:
     name: Aspire CLI Starter Validation (macOS x64)
     needs: [setup_for_tests, build_packages, build_cli_archive_macos_x64]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: macos-15-intel
@@ -546,7 +546,7 @@ jobs:
   cli_starter_validation_macos_arm64:
     name: Aspire CLI Starter Validation (macOS ARM64)
     needs: [setup_for_tests, build_packages, build_cli_archive_macos]
-    if: ${{ github.event_name == 'pull_request' && github.repository_owner == 'microsoft' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.repository == 'microsoft/aspire' && needs.setup_for_tests.outputs.run_cli_starter_validation == 'true' }}
     uses: ./.github/workflows/cli-starter-validation.yml
     with:
       runner: macos-latest
@@ -712,7 +712,7 @@ jobs:
     uses: ./.github/workflows/typescript-api-compat.yml
 
   results:
-    if: ${{ always() && github.repository_owner == 'microsoft' }}
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Final Test Results
     needs: [
diff --git a/.github/workflows/update-ai-foundry-models.yml b/.github/workflows/update-ai-foundry-models.yml
index 17c6f8b3618..ab8ff7f0482 100644
--- a/.github/workflows/update-ai-foundry-models.yml
+++ b/.github/workflows/update-ai-foundry-models.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   generate-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/update-aspire-skills-bundle.yml b/.github/workflows/update-aspire-skills-bundle.yml
index 97b0635a9d4..83988215276 100644
--- a/.github/workflows/update-aspire-skills-bundle.yml
+++ b/.github/workflows/update-aspire-skills-bundle.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   update-and-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/update-azure-vm-sizes.yml b/.github/workflows/update-azure-vm-sizes.yml
index 96c6516bcec..35fa5dfa2fd 100644
--- a/.github/workflows/update-azure-vm-sizes.yml
+++ b/.github/workflows/update-azure-vm-sizes.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     # 'schedule' only ever runs on the default branch, so the owner guard is the
     # only condition needed here.
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     environment: deployment-testing
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 2543229deca..f1b3c3c900f 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   update-dependencies:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/update-nix-cli-flake.yml b/.github/workflows/update-nix-cli-flake.yml
index a0fa857b7b3..b0a39164c72 100644
--- a/.github/workflows/update-nix-cli-flake.yml
+++ b/.github/workflows/update-nix-cli-flake.yml
@@ -66,6 +66,7 @@ permissions:
 jobs:
   update-nix-flake:
     name: Update Nix flake manifest
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Authorize
diff --git a/.github/workflows/validate-agentic-workflows.yml b/.github/workflows/validate-agentic-workflows.yml
index 928d03f4446..c80ca6258e1 100644
--- a/.github/workflows/validate-agentic-workflows.yml
+++ b/.github/workflows/validate-agentic-workflows.yml
@@ -25,6 +25,7 @@ permissions:
 jobs:
   validate:
     name: Compile, lint, and test agentic workflows
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/validate-copilot-extensions.yml b/.github/workflows/validate-copilot-extensions.yml
index 9c4069d8eb6..83451b330d2 100644
--- a/.github/workflows/validate-copilot-extensions.yml
+++ b/.github/workflows/validate-copilot-extensions.yml
@@ -19,7 +19,7 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/verify-aspire-skills-bundle.yml b/.github/workflows/verify-aspire-skills-bundle.yml
index f22c87368b8..78a53d5fbe1 100644
--- a/.github/workflows/verify-aspire-skills-bundle.yml
+++ b/.github/workflows/verify-aspire-skills-bundle.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   verify:
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
diff --git a/.github/workflows/verify-telemetry-hook-changes.yml b/.github/workflows/verify-telemetry-hook-changes.yml
index 7a5ba7a2024..53b572d3927 100644
--- a/.github/workflows/verify-telemetry-hook-changes.yml
+++ b/.github/workflows/verify-telemetry-hook-changes.yml
@@ -10,6 +10,7 @@ permissions:
 jobs:
   verify:
     name: Telemetry hook update branch
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/warm-cli-e2e-image-cache.yml b/.github/workflows/warm-cli-e2e-image-cache.yml
index f332d07293f..4a36f717639 100644
--- a/.github/workflows/warm-cli-e2e-image-cache.yml
+++ b/.github/workflows/warm-cli-e2e-image-cache.yml
@@ -29,7 +29,7 @@ concurrency:
 jobs:
   warm_cli_e2e_image_cache:
     name: Warm CLI E2E image cache
-    if: ${{ github.repository_owner == 'microsoft' }}
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-e2e-image.yml
     with:
       includePolyglotImages: true
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index ea4780ea362..7f8dfd51793 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,6 +19,7 @@ permissions: {}
 jobs:
   zizmor:
     name: Zizmor
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

From a8e7754ab93d030559baf522f1e86dd661dd5ca5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 03:32:57 +0000
Subject: [PATCH 03/11] Guard reusable workflows against fork callers

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .../agentics-maintenance-microsoft-aspire.dev.yml        | 8 ++++----
 .github/workflows/analyze-ci-failure.lock.yml            | 4 ++--
 .github/workflows/backport.yml                           | 4 ++--
 .github/workflows/build-cli-e2e-image.yml                | 1 +
 .github/workflows/build-cli-native-archives.yml          | 1 +
 .github/workflows/build-packages.yml                     | 1 +
 .github/workflows/cli-starter-validation.yml             | 1 +
 .github/workflows/extension-e2e-tests.yml                | 2 ++
 .github/workflows/extension-unit-tests.yml               | 1 +
 .github/workflows/labeler-cache-retention.yml            | 2 +-
 .github/workflows/labeler-predict-issues.yml             | 2 +-
 .github/workflows/milestone-changelog.lock.yml           | 2 +-
 .github/workflows/milestone-changelog.md                 | 1 +
 .github/workflows/native-dashboard-validation.yml        | 1 +
 .github/workflows/polyglot-validation.yml                | 9 +++++++--
 .github/workflows/pr-docs-check.lock.yml                 | 6 +++---
 .github/workflows/prepare-installer-artifacts.yml        | 1 +
 .github/workflows/run-tests.yml                          | 1 +
 .github/workflows/tests-daily-smoke.yml                  | 2 +-
 .github/workflows/tests.yml                              | 1 +
 .github/workflows/typescript-api-compat.yml              | 2 +-
 .github/workflows/typescript-sdk-tests.yml               | 1 +
 22 files changed, 36 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml b/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml
index dc18418b0e4..b8b30c2063f 100644
--- a/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml
+++ b/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml
@@ -77,7 +77,7 @@ permissions: {}
 jobs:
 
   apply_safe_outputs:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
+    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     permissions:
       actions: read
@@ -137,7 +137,7 @@ jobs:
         run: echo "run_url=$GH_AW_RUN_URL" >> "$GITHUB_OUTPUT"
 
   create_labels:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
+    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -195,7 +195,7 @@ jobs:
             await main();
 
   activity_report:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
+    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     timeout-minutes: 120
     permissions:
@@ -316,7 +316,7 @@ jobs:
             core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);
 
   validate_workflows:
-    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
+    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/analyze-ci-failure.lock.yml b/.github/workflows/analyze-ci-failure.lock.yml
index 85dfe01e833..66da9c35947 100644
--- a/.github/workflows/analyze-ci-failure.lock.yml
+++ b/.github/workflows/analyze-ci-failure.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0b2bb2b0399c77551480ef59644dd3a084e2cee3f4d93bcc1a00bdf802b02057","body_hash":"1c62bfd447384ce250986e55630d7cf0b661087462c7d085cf48c63684110174","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"58c705b7392097417ceda22c1568694f84f017fb7b4a34430d0ecbb29713c100","body_hash":"1c62bfd447384ce250986e55630d7cf0b661087462c7d085cf48c63684110174","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["missing_data","missing_tool","noop","publish_data","rerun_failed_jobs"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -1180,7 +1180,7 @@ jobs:
   collect-data:
     needs: activation
     if: >
-      github.repository_owner == 'microsoft' && (
+      github.repository == 'microsoft/aspire' && (
       github.event_name == 'workflow_dispatch'
       || (
       github.event.workflow_run.conclusion == 'failure'
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index b3988ac5b95..cc17e4aba7b 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -20,7 +20,7 @@ jobs:
   cleanup:
     if: >-
       github.event_name == 'schedule' &&
-      contains(fromJSON('["dotnet", "microsoft"]'), github.repository_owner)
+      github.repository == 'microsoft/aspire'
     runs-on: ubuntu-latest
     permissions:
       actions: write
@@ -62,7 +62,7 @@ jobs:
   backport:
     if: >-
       github.event_name == 'issue_comment' &&
-      contains(fromJSON('["dotnet", "microsoft"]'), github.repository_owner) &&
+      github.repository == 'microsoft/aspire' &&
       github.event.issue.pull_request != '' &&
       contains(github.event.comment.body, '/backport to')
     runs-on: ubuntu-latest
diff --git a/.github/workflows/build-cli-e2e-image.yml b/.github/workflows/build-cli-e2e-image.yml
index 3efc0a4570d..60337f5b15b 100644
--- a/.github/workflows/build-cli-e2e-image.yml
+++ b/.github/workflows/build-cli-e2e-image.yml
@@ -30,6 +30,7 @@ env:
 jobs:
   build:
     name: Build CLI E2E Docker image
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ github.repository_owner == 'microsoft' && '8-core-ubuntu-latest' || 'ubuntu-latest' }}
     timeout-minutes: 45
 
diff --git a/.github/workflows/build-cli-native-archives.yml b/.github/workflows/build-cli-native-archives.yml
index 4782c6d0d24..970544381a5 100644
--- a/.github/workflows/build-cli-native-archives.yml
+++ b/.github/workflows/build-cli-native-archives.yml
@@ -31,6 +31,7 @@ jobs:
 
   build_cli_archives:
     name: Build CLI (${{ matrix.targets.rids }})
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ matrix.targets.runner }}
     strategy:
       matrix:
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 2cb9094dfc4..c619f7fb853 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -10,6 +10,7 @@ on:
 jobs:
   build_packages:
     name: Build packages
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: 8-core-ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/cli-starter-validation.yml b/.github/workflows/cli-starter-validation.yml
index 35b4de1c12e..1ee989bd310 100644
--- a/.github/workflows/cli-starter-validation.yml
+++ b/.github/workflows/cli-starter-validation.yml
@@ -32,6 +32,7 @@ permissions:
 jobs:
   validate:
     name: Validate
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ inputs.runner }}
     # Shared budget for every caller of this reusable workflow. The validation script can spend
     # up to four startup waits (run + start for two templates) and three resource waits, which is
diff --git a/.github/workflows/extension-e2e-tests.yml b/.github/workflows/extension-e2e-tests.yml
index be403525b84..d210a65890b 100644
--- a/.github/workflows/extension-e2e-tests.yml
+++ b/.github/workflows/extension-e2e-tests.yml
@@ -5,6 +5,7 @@ on:
 
 jobs:
   verify_extester_feed:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: Verify ExTester internal feed availability
     runs-on: ubuntu-latest
     env:
@@ -72,6 +73,7 @@ jobs:
         run: node scripts/run-e2e.js --verify-extester-feed
 
   extension_e2e:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: VS Code extension E2E (${{ matrix.name }}, ${{ matrix.shardName }})
     needs: verify_extester_feed
     runs-on: ${{ matrix.runner }}
diff --git a/.github/workflows/extension-unit-tests.yml b/.github/workflows/extension-unit-tests.yml
index 554d12b244e..e136f2f076a 100644
--- a/.github/workflows/extension-unit-tests.yml
+++ b/.github/workflows/extension-unit-tests.yml
@@ -18,6 +18,7 @@ permissions:
 jobs:
   extension_tests_win:
     name: Run VS Code extension unit tests (Windows)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: windows-latest
     env:
       NPM_REGISTRY: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
diff --git a/.github/workflows/labeler-cache-retention.yml b/.github/workflows/labeler-cache-retention.yml
index 94b22873376..5cfb2ed83bd 100644
--- a/.github/workflows/labeler-cache-retention.yml
+++ b/.github/workflows/labeler-cache-retention.yml
@@ -20,7 +20,7 @@ env:
 
 jobs:
   restore-cache:
-    # Do not automatically run the workflow on forks outside the 'dotnet' org
+    # Run the cache maintenance workflow only in the source repository.
     if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     strategy:
diff --git a/.github/workflows/labeler-predict-issues.yml b/.github/workflows/labeler-predict-issues.yml
index 9d1eb6fe692..9bbce07bbb6 100644
--- a/.github/workflows/labeler-predict-issues.yml
+++ b/.github/workflows/labeler-predict-issues.yml
@@ -28,7 +28,7 @@ env:
 
 jobs:
   predict-issue-label:
-    # Do not automatically run the workflow on forks outside the 'dotnet' org
+    # Run label prediction only in the source repository.
     if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/milestone-changelog.lock.yml b/.github/workflows/milestone-changelog.lock.yml
index 57a53c48603..2936c10e674 100644
--- a/.github/workflows/milestone-changelog.lock.yml
+++ b/.github/workflows/milestone-changelog.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"12baf6023c14ed076a4cc69aeb45dd9d0715a85841225e33894228a99facc286","body_hash":"e6460f2f62abedaf5fc72aa24dffd798414dcc0c1f4f96c62343709fa3dbd85e","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"97fc500ddbb4cc83b0721baa4d8d3ef94ded5c5bf256062ce95683ecdc78a489","body_hash":"e6460f2f62abedaf5fc72aa24dffd798414dcc0c1f4f96c62343709fa3dbd85e","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["missing_data","missing_tool","noop","publish"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/milestone-changelog.md b/.github/workflows/milestone-changelog.md
index 8a446a54ab0..96dab383fa0 100644
--- a/.github/workflows/milestone-changelog.md
+++ b/.github/workflows/milestone-changelog.md
@@ -54,6 +54,7 @@ on:
 
 jobs:
   fetch-data:
+    if: github.repository == 'microsoft/aspire'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/native-dashboard-validation.yml b/.github/workflows/native-dashboard-validation.yml
index d0ea6f2ac50..7c291b89e6a 100644
--- a/.github/workflows/native-dashboard-validation.yml
+++ b/.github/workflows/native-dashboard-validation.yml
@@ -21,6 +21,7 @@ permissions:
 jobs:
   validate:
     name: Validate
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
diff --git a/.github/workflows/polyglot-validation.yml b/.github/workflows/polyglot-validation.yml
index b7ac2359fc9..0375481b803 100644
--- a/.github/workflows/polyglot-validation.yml
+++ b/.github/workflows/polyglot-validation.yml
@@ -17,6 +17,7 @@ env:
 jobs:
   validate_python:
     name: Python SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -72,6 +73,7 @@ jobs:
 
   validate_go:
     name: Go SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -127,6 +129,7 @@ jobs:
 
   validate_java:
     name: Java SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -182,6 +185,7 @@ jobs:
 
   validate_rust:
     name: Rust SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     # Rust SDK has known issues - don't fail the workflow
     continue-on-error: true
@@ -238,7 +242,8 @@ jobs:
             polyglot-rust
 
   validate_typescript:
-    name: TypeScript SDK Validation (Node ${{ matrix.node-version }}.x)
+    name: TypeScript SDK Validation
+    if: ${{ github.repository == 'microsoft/aspire' }} (Node ${{ matrix.node-version }}.x)
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -298,7 +303,7 @@ jobs:
             polyglot-typescript-node-${{ matrix.node-version }}
 
   results:
-    if: always()
+    if: ${{ always() && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     name: Polyglot Validation Results
     needs: [validate_python, validate_go, validate_java, validate_rust, validate_typescript]
diff --git a/.github/workflows/pr-docs-check.lock.yml b/.github/workflows/pr-docs-check.lock.yml
index 2ac477372cf..c5b8b5ae36a 100644
--- a/.github/workflows/pr-docs-check.lock.yml
+++ b/.github/workflows/pr-docs-check.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f46e10de87d170af1d9534d8948e1d73d943e003cace3d0d46816e392f4aad73","body_hash":"286d2cb44cc68daab8b4a9302115444e05e47610162a50b7810ab0e650fd5282","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f86fe79184975910d9c148e901f9b6e56eb897d7dc3451b2bf8b49ada978ffbb","body_hash":"286d2cb44cc68daab8b4a9302115444e05e47610162a50b7810ab0e650fd5282","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["ASPIRE_BOT_APP_ID","ASPIRE_BOT_PRIVATE_KEY","GH_AW_CI_TRIGGER_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/create-github-app-token","sha":"bcd2ba49218906704ab6c1aa796996da409d3eb1","version":"v3.2.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"has_pull_request":true,"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["create_pull_request","missing_data","missing_tool","noop","notify_source_pr"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -104,7 +104,7 @@ jobs:
     needs: pre_activation
     if: >
       needs.pre_activation.outputs.activated == 'true' && ((((github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch') &&
-      github.repository_owner == 'microsoft') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)) &&
+      github.repository == 'microsoft/aspire') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || github.event.pull_request.stack == null ||
       github.event.pull_request.stack.position == github.event.pull_request.stack.size))
     runs-on: ubuntu-slim
@@ -2081,7 +2081,7 @@ jobs:
 
   pre_activation:
     if: >
-      (((github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch') && github.repository_owner == 'microsoft') &&
+      (((github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch') && github.repository == 'microsoft/aspire') &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)) &&
       ((github.event_name != 'pull_request' && github.event_name != 'pull_request_review') || github.event.pull_request.stack == null ||
       github.event.pull_request.stack.position == github.event.pull_request.stack.size)
diff --git a/.github/workflows/prepare-installer-artifacts.yml b/.github/workflows/prepare-installer-artifacts.yml
index 9d6abea5049..2d995eaed22 100644
--- a/.github/workflows/prepare-installer-artifacts.yml
+++ b/.github/workflows/prepare-installer-artifacts.yml
@@ -9,6 +9,7 @@ on:
 
 jobs:
   prepare_installer_artifacts:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: Prepare ${{ inputs.installer == 'winget' && 'WinGet manifests' || 'Homebrew cask' }}
     runs-on: ${{ inputs.installer == 'winget' && 'windows-latest' || 'macos-latest' }}
     steps:
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index fc88245e5cf..92f371719a6 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -43,6 +43,7 @@ on:
 jobs:
 
   test:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     name: ${{ inputs.testShortName }} (${{ inputs.os }})
diff --git a/.github/workflows/tests-daily-smoke.yml b/.github/workflows/tests-daily-smoke.yml
index df728f76e4f..2a493b19a6c 100644
--- a/.github/workflows/tests-daily-smoke.yml
+++ b/.github/workflows/tests-daily-smoke.yml
@@ -253,7 +253,7 @@ jobs:
     name: Create Issue on Failure
     needs: [smoke-test]
     runs-on: ubuntu-latest
-    if: ${{ failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft' }}
+    if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire' }}
     permissions:
       contents: read   # checkout to require the local .js modules
       actions: read    # download-artifact
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 941ddcf2f43..8f5964b0f9d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -18,6 +18,7 @@ permissions:
 jobs:
   setup_for_tests:
     name: Setup for tests
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     # This job checks out and runs PR-authored code (SelectTests, the test build), so it is kept at
     # contents:read with no pull-requests:write. The selection comment is posted from the
diff --git a/.github/workflows/typescript-api-compat.yml b/.github/workflows/typescript-api-compat.yml
index 6d9d150061a..bb02a39c3b8 100644
--- a/.github/workflows/typescript-api-compat.yml
+++ b/.github/workflows/typescript-api-compat.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   typescript_api_compat:
     name: TypeScript API Compatibility
-    if: ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.repository == 'microsoft/aspire' && github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/typescript-sdk-tests.yml b/.github/workflows/typescript-sdk-tests.yml
index 3b15372a95b..b949e516831 100644
--- a/.github/workflows/typescript-sdk-tests.yml
+++ b/.github/workflows/typescript-sdk-tests.yml
@@ -9,6 +9,7 @@ on:
 
 jobs:
   typescript_unit_tests:
+    if: ${{ github.repository == 'microsoft/aspire' }}
     name: TypeScript SDK Tests Job
     runs-on: ubuntu-latest
     timeout-minutes: 5

From 421659b2701b869e6a5826e3b60de74c68020e3d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 03:35:02 +0000
Subject: [PATCH 04/11] Gate remaining workflow jobs

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .github/workflows/milestone-changelog.lock.yml | 3 ++-
 .github/workflows/tests.yml                    | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/milestone-changelog.lock.yml b/.github/workflows/milestone-changelog.lock.yml
index 2936c10e674..193d8cd60d2 100644
--- a/.github/workflows/milestone-changelog.lock.yml
+++ b/.github/workflows/milestone-changelog.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"97fc500ddbb4cc83b0721baa4d8d3ef94ded5c5bf256062ce95683ecdc78a489","body_hash":"e6460f2f62abedaf5fc72aa24dffd798414dcc0c1f4f96c62343709fa3dbd85e","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"bcd2588d9695047e0af591d99674f75cd2ee7a9045f8040ef0dddc38f591ba2f","body_hash":"e6460f2f62abedaf5fc72aa24dffd798414dcc0c1f4f96c62343709fa3dbd85e","compiler_version":"v0.89.17","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.85"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"f3b81cdb3070066a47faa9bdf440f4f1dc78b1f0","version":"v0.89.17"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20","digest":"sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.20@sha256:1bacef0f405d77999d01d8c00cb731222531b3f43ef9dc8312c513d6d9038bb1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20","digest":"sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.20@sha256:30ab6d3261dd95364281fa0b52ab78450e1c01aa074eccc3a8d4f04b12a6560b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20","digest":"sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.20@sha256:cba5f56857e4869c4a00c1cce29c3056516cf1a746e18ce380753ecfbe40f112"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.25","digest":"sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.25@sha256:9be0a86220e807a0ecc89e53d7453468f7a53fbc6b3d1efd2299025ffe01d086"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0daa8971fa4732b647150cb6524a6b0804b68d5d24f6f58b5dd1af23bd63fb23"},{"image":"ghcr.io/github/github-mcp-server:v1.12.1","digest":"sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560","pinned_image":"ghcr.io/github/github-mcp-server:v1.12.1@sha256:0ba840c46a237879c8300e7fddb0b6347f20e029ccb9cbe2ce4a943daa1ff560"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["missing_data","missing_tool","noop","publish"]}]}
 # This file was automatically generated by gh-aw (v0.89.17). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -1645,6 +1645,7 @@ jobs:
 
   fetch-data:
     needs: activation
+    if: github.repository == 'microsoft/aspire'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8f5964b0f9d..438ca539a33 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -255,12 +255,14 @@ jobs:
 
   build_packages:
     name: Build packages
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-packages.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
 
   build_cli_archive_linux:
     name: Build native CLI archive (Linux)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -268,6 +270,7 @@ jobs:
 
   build_cli_archive_linux_arm64:
     name: Build native CLI archive (Linux ARM64)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -279,6 +282,7 @@ jobs:
   # without waiting for the slower Windows/macOS builds.
   build_cli_archive_windows:
     name: Build native CLI archive (Windows)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -286,6 +290,7 @@ jobs:
 
   build_cli_archive_windows_arm64:
     name: Build native CLI archive (Windows ARM64)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -294,6 +299,7 @@ jobs:
 
   build_cli_archive_macos:
     name: Build native CLI archive (macOS)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}
@@ -301,6 +307,7 @@ jobs:
 
   build_cli_archive_macos_x64:
     name: Build native CLI archive (macOS x64)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/build-cli-native-archives.yml
     with:
       versionOverrideArg: ${{ inputs.versionOverrideArg }}

From 259dd5029b432b84942fd722781523dd05369f61 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 03:37:17 +0000
Subject: [PATCH 05/11] Limit GitHub Actions token permissions

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .github/workflows/labeler-cache-retention.yml | 2 ++
 .github/workflows/reproduce-flaky-tests.yml   | 1 +
 .github/workflows/run-tests.yml               | 3 +++
 .github/workflows/specialized-test-runner.yml | 4 ++++
 .github/workflows/tests-outerloop.yml         | 2 ++
 .github/workflows/tests-quarantine.yml        | 2 ++
 6 files changed, 14 insertions(+)

diff --git a/.github/workflows/labeler-cache-retention.yml b/.github/workflows/labeler-cache-retention.yml
index 5cfb2ed83bd..b9b338ce91e 100644
--- a/.github/workflows/labeler-cache-retention.yml
+++ b/.github/workflows/labeler-cache-retention.yml
@@ -18,6 +18,8 @@ on:
 env:
   CACHE_KEY: ${{ inputs.cache_key || 'ACTIVE' }}
 
+permissions: {}
+
 jobs:
   restore-cache:
     # Run the cache maintenance workflow only in the source repository.
diff --git a/.github/workflows/reproduce-flaky-tests.yml b/.github/workflows/reproduce-flaky-tests.yml
index a2dd9e0256a..694d9e47192 100644
--- a/.github/workflows/reproduce-flaky-tests.yml
+++ b/.github/workflows/reproduce-flaky-tests.yml
@@ -394,6 +394,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Reproduce Results
     needs: [reproduce]
+    permissions: {}
     steps:
       - name: Summary
         shell: bash
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 92f371719a6..9bfc7de26d7 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -40,6 +40,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 jobs:
 
   test:
diff --git a/.github/workflows/specialized-test-runner.yml b/.github/workflows/specialized-test-runner.yml
index 8ba886b4465..96b79bc552f 100644
--- a/.github/workflows/specialized-test-runner.yml
+++ b/.github/workflows/specialized-test-runner.yml
@@ -166,6 +166,8 @@ jobs:
         (needs.build_cli_e2e_image.result == 'success' || needs.build_cli_e2e_image.result == 'skipped')
       }}
     uses: ./.github/workflows/run-tests.yml
+    permissions:
+      contents: read
     with:
       testShortName: ${{ matrix.tests.project }}
       properties: ${{ toJson(matrix.tests.properties) }}
@@ -180,6 +182,8 @@ jobs:
     runs-on: ubuntu-latest
     name: Final Results
     needs: [generate_tests_matrix, build_packages, build_cli_archives, build_cli_e2e_image, run_tests]
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
diff --git a/.github/workflows/tests-outerloop.yml b/.github/workflows/tests-outerloop.yml
index 3531f94625c..ba3bdeec76a 100644
--- a/.github/workflows/tests-outerloop.yml
+++ b/.github/workflows/tests-outerloop.yml
@@ -38,6 +38,8 @@ jobs:
   outerloop_tests:
     if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
+    permissions:
+      contents: read
     with:
       testRunnerName: "OuterloopTestRunsheetBuilder"
       attributeName: "OuterloopTest"
diff --git a/.github/workflows/tests-quarantine.yml b/.github/workflows/tests-quarantine.yml
index f541bd32402..2c5886d58ba 100644
--- a/.github/workflows/tests-quarantine.yml
+++ b/.github/workflows/tests-quarantine.yml
@@ -39,6 +39,8 @@ jobs:
   quarantine_tests:
     if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
+    permissions:
+      contents: read
     with:
       testRunnerName: "QuarantinedTestRunsheetBuilder"
       attributeName: "QuarantinedTest"

From d4acedb8b722a5676249da86b8ab79ee55a6551f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 03:38:59 +0000
Subject: [PATCH 06/11] Run pull-label polling in source repo

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .github/workflows/labeler-predict-pulls.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/labeler-predict-pulls.yml b/.github/workflows/labeler-predict-pulls.yml
index c7e6c8609d1..c105e5ae328 100644
--- a/.github/workflows/labeler-predict-pulls.yml
+++ b/.github/workflows/labeler-predict-pulls.yml
@@ -48,8 +48,8 @@ env:
 
 jobs:
   poll-pull-requests:
-    # Run on schedule trigger or workflow_dispatch without PR numbers, within the 'dotnet' org
-    if: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.pulls == '')) && github.repository_owner == 'dotnet' }}
+    # Poll on schedule or when manually dispatched without a PR number.
+    if: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.pulls == '')) && github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     permissions:
       actions: read

From ae3b3a7d56449c4fe9e1ab81fc361dd687e15603 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 4 Oct 2026 15:03:29 +0000
Subject: [PATCH 07/11] Restore labeler workflow changes

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .github/workflows/labeler-cache-retention.yml |  6 ++----
 .github/workflows/labeler-predict-issues.yml  |  4 ++--
 .github/workflows/labeler-predict-pulls.yml   |  6 +++---
 .github/workflows/labeler-promote.yml         |  4 ++--
 .github/workflows/labeler-train.yml           | 12 ++++++------
 5 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/labeler-cache-retention.yml b/.github/workflows/labeler-cache-retention.yml
index b9b338ce91e..f1dcbc2c55f 100644
--- a/.github/workflows/labeler-cache-retention.yml
+++ b/.github/workflows/labeler-cache-retention.yml
@@ -18,12 +18,10 @@ on:
 env:
   CACHE_KEY: ${{ inputs.cache_key || 'ACTIVE' }}
 
-permissions: {}
-
 jobs:
   restore-cache:
-    # Run the cache maintenance workflow only in the source repository.
-    if: ${{ github.repository == 'microsoft/aspire' }}
+    # Do not automatically run the workflow on forks outside the 'dotnet' org
+    if: ${{ github.event_name == 'workflow_dispatch' || github.repository_owner == 'microsoft' }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/labeler-predict-issues.yml b/.github/workflows/labeler-predict-issues.yml
index 9bbce07bbb6..25b0ff5d139 100644
--- a/.github/workflows/labeler-predict-issues.yml
+++ b/.github/workflows/labeler-predict-issues.yml
@@ -28,8 +28,8 @@ env:
 
 jobs:
   predict-issue-label:
-    # Run label prediction only in the source repository.
-    if: ${{ github.repository == 'microsoft/aspire' }}
+    # Do not automatically run the workflow on forks outside the 'dotnet' org
+    if: ${{ github.event_name == 'workflow_dispatch' || github.repository_owner == 'microsoft' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write
diff --git a/.github/workflows/labeler-predict-pulls.yml b/.github/workflows/labeler-predict-pulls.yml
index c105e5ae328..7a5eb0d43c2 100644
--- a/.github/workflows/labeler-predict-pulls.yml
+++ b/.github/workflows/labeler-predict-pulls.yml
@@ -48,8 +48,8 @@ env:
 
 jobs:
   poll-pull-requests:
-    # Poll on schedule or when manually dispatched without a PR number.
-    if: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.pulls == '')) && github.repository == 'microsoft/aspire' }}
+    # Run on schedule trigger or workflow_dispatch without PR numbers, within the 'dotnet' org
+    if: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.pulls == '')) && github.repository_owner == 'dotnet' }}
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -89,7 +89,7 @@ jobs:
   predict-pull-label:
     # The 'if' uses always() so this job runs even when poll-pull-requests is skipped
     # Do not automatically run the workflow on forks outside the 'dotnet' org
-    if: ${{ always() && github.repository == 'microsoft/aspire' }}
+    if: ${{ always() && (github.event_name == 'workflow_dispatch' || github.repository_owner == 'microsoft') }}
     needs: [poll-pull-requests]
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/labeler-promote.yml b/.github/workflows/labeler-promote.yml
index 5933288f606..de703e8af50 100644
--- a/.github/workflows/labeler-promote.yml
+++ b/.github/workflows/labeler-promote.yml
@@ -28,7 +28,7 @@ permissions: {}
 
 jobs:
   promote-issues:
-    if: ${{ github.repository == 'microsoft/aspire' && inputs.issues }}
+    if: ${{ inputs.issues }}
     runs-on: ubuntu-latest
     permissions:
       actions: write # The promotion action deletes the active GitHub Actions cache.
@@ -41,7 +41,7 @@ jobs:
           backup_key: ${{ inputs.backup_key }}
 
   promote-pulls:
-    if: ${{ github.repository == 'microsoft/aspire' && inputs.pulls }}
+    if: ${{ inputs.pulls }}
     runs-on: ubuntu-latest
     permissions:
       actions: write # The promotion action deletes the active GitHub Actions cache.
diff --git a/.github/workflows/labeler-train.yml b/.github/workflows/labeler-train.yml
index b6e10d855ad..861e5360085 100644
--- a/.github/workflows/labeler-train.yml
+++ b/.github/workflows/labeler-train.yml
@@ -51,7 +51,7 @@ env:
 
 jobs:
   download-issues:
-    if: ${{ github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
+    if: ${{ contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
     runs-on: ubuntu-latest
     permissions:
       issues: read
@@ -71,7 +71,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
   download-pulls:
-    if: ${{ github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
+    if: ${{ contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Download Data"]'), inputs.steps) }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
@@ -91,7 +91,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
   train-issues:
-    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-issues.result) }}
+    if: ${{ always() && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-issues.result) }}
     runs-on: ubuntu-latest
     permissions: {}
     needs: download-issues
@@ -104,7 +104,7 @@ jobs:
           model_cache_key: ${{ env.CACHE_KEY }}
 
   train-pulls:
-    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-pulls.result) }}
+    if: ${{ always() && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Train Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.download-pulls.result) }}
     runs-on: ubuntu-latest
     permissions: {}
     needs: download-pulls
@@ -117,7 +117,7 @@ jobs:
           model_cache_key: ${{ env.CACHE_KEY }}
 
   test-issues:
-    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-issues.result) }}
+    if: ${{ always() && contains(fromJSON('["Both", "Issues"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-issues.result) }}
     runs-on: ubuntu-latest
     permissions:
       issues: read
@@ -139,7 +139,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
   test-pulls:
-    if: ${{ always() && github.repository == 'microsoft/aspire' && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-pulls.result) }}
+    if: ${{ always() && contains(fromJSON('["Both", "Pull Requests"]'), inputs.type) && contains(fromJSON('["All", "Test Model"]'), inputs.steps) && contains(fromJSON('["success", "skipped"]'), needs.train-pulls.result) }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read

From 64795c40e97bfdc2159bee575116d735f8dd563b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Oct 2026 17:20:54 +0000
Subject: [PATCH 08/11] Fix workflow validation guards

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .../agentics-maintenance-microsoft-aspire.dev.yml         | 8 ++++----
 .github/workflows/polyglot-validation.yml                 | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml b/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml
index b8b30c2063f..dc18418b0e4 100644
--- a/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml
+++ b/.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml
@@ -77,7 +77,7 @@ permissions: {}
 jobs:
 
   apply_safe_outputs:
-    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
+    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     permissions:
       actions: read
@@ -137,7 +137,7 @@ jobs:
         run: echo "run_url=$GH_AW_RUN_URL" >> "$GITHUB_OUTPUT"
 
   create_labels:
-    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
+    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -195,7 +195,7 @@ jobs:
             await main();
 
   activity_report:
-    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
+    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-slim
     timeout-minutes: 120
     permissions:
@@ -316,7 +316,7 @@ jobs:
             core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);
 
   validate_workflows:
-    if: ${{ github.repository == 'microsoft/aspire' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
+    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/polyglot-validation.yml b/.github/workflows/polyglot-validation.yml
index 0375481b803..98890ab1991 100644
--- a/.github/workflows/polyglot-validation.yml
+++ b/.github/workflows/polyglot-validation.yml
@@ -242,8 +242,8 @@ jobs:
             polyglot-rust
 
   validate_typescript:
-    name: TypeScript SDK Validation
-    if: ${{ github.repository == 'microsoft/aspire' }} (Node ${{ matrix.node-version }}.x)
+    name: TypeScript SDK Validation (Node ${{ matrix.node-version }}.x)
+    if: ${{ github.repository == 'microsoft/aspire' }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

From a5c51b27d8b322e1495573e53e69ce40a505da06 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 6 Oct 2026 01:38:01 +0000
Subject: [PATCH 09/11] Align workflow tests with repository guards

Co-authored-by: radical <1472+radical@users.noreply.github.com>
---
 .../WorkflowScripts/BackportWorkflowTests.cs                | 6 +++---
 .../WorkflowScripts/DeploymentTestCommandTests.cs           | 2 +-
 .../WorkflowScripts/ExtensionWorkflowTests.cs               | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
index 24d7eec3a7a..90c5ddf1a4a 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
@@ -12,15 +12,15 @@ public sealed class BackportWorkflowTests(ITestOutputHelper output)
     private const string WorkflowRelativePath = ".github/workflows/backport.yml";
 
     [Fact]
-    public void JobsUseExactRepositoryOwnerMembership()
+    public void JobsAreRestrictedToTheExactRepository()
     {
         var jobs = Mapping(LoadWorkflow(), "jobs");
 
         Assert.Equal(
-            "github.event_name == 'schedule' && contains(fromJSON('[\"dotnet\", \"microsoft\"]'), github.repository_owner)",
+            "github.event_name == 'schedule' && github.repository == 'microsoft/aspire'",
             Scalar(Mapping(jobs, "cleanup"), "if"));
         Assert.Equal(
-            "github.event_name == 'issue_comment' && contains(fromJSON('[\"dotnet\", \"microsoft\"]'), github.repository_owner) && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/backport to')",
+            "github.event_name == 'issue_comment' && github.repository == 'microsoft/aspire' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/backport to')",
             Scalar(Mapping(jobs, "backport"), "if"));
     }
 
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
index 44fb208b600..49f14a8524d 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
@@ -14,7 +14,7 @@ public void CommandPrefilterSelectsCandidatesOnMicrosoftPullRequests()
     {
         var condition = Scalar(LoadJob(), "if");
         Assert.Equal(
-            "${{ startsWith(github.event.comment.body, '/deployment-test') && github.event.issue.pull_request && github.repository_owner == 'microsoft' }}",
+            "${{ startsWith(github.event.comment.body, '/deployment-test') && github.event.issue.pull_request && github.repository == 'microsoft/aspire' }}",
             string.Join(" ", condition.Split((char[]?)null, StringSplitOptions.RemoveEmptyEntries)));
     }
 
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
index d34e26fdeb2..725f69b4c50 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
@@ -257,11 +257,11 @@ public void CiRunsSelectorDrivenTestsAndStabilizationForEveryRequiredPr()
         var normalTests = Mapping(s_ciJobs, "tests");
         Assert.Equal("./.github/workflows/tests.yml", Scalar(normalTests, "uses"));
         Assert.Equal(
-            "${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}",
+            "${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}",
             Scalar(normalTests, "if"));
 
         Assert.Equal(
-            "${{ github.repository_owner == 'microsoft' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}",
+            "${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}",
             Scalar(Mapping(s_ciJobs, "stabilization_check"), "if"));
     }
 
@@ -288,7 +288,7 @@ public void CiFailureTrackerPushResultContractIsUnchanged()
 
         Assert.Equal(["prepare_for_ci", "tests", "stabilization_check"], SequenceScalars(tracker, "needs"));
         Assert.Equal(
-            "${{ always() && github.event_name == 'push' && github.repository_owner == 'microsoft' }}",
+            "${{ always() && github.event_name == 'push' && github.repository == 'microsoft/aspire' }}",
             Scalar(tracker, "if"));
 
         var scriptStep = Assert.Single(Steps(tracker), step => Scalar(step, "name") == "File or close the red-main issue");

From e04692d8e1985bd807bc8ed4ade8eaff9ffbeb7e Mon Sep 17 00:00:00 2001
From: Ankit Jain <radical@gmail.com>
Date: Fri, 9 Oct 2026 17:01:55 -0400
Subject: [PATCH 10/11] docs(ci): update repository guard in workflow docs

Two CI docs still described the previous
`github.repository_owner == 'microsoft'` guard. Align them with the
exact `github.repository == 'microsoft/aspire'` check the workflows use.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ba06c37d-f431-49e4-8bd4-035075b722ad
---
 docs/ci/auto-rerun-outerloop-failures.md | 4 ++--
 docs/ci/pipeline-failure-issues.md       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/ci/auto-rerun-outerloop-failures.md b/docs/ci/auto-rerun-outerloop-failures.md
index b109e31e55c..09e243cc51b 100644
--- a/docs/ci/auto-rerun-outerloop-failures.md
+++ b/docs/ci/auto-rerun-outerloop-failures.md
@@ -39,7 +39,7 @@ Outerloop Tests run fails
 │  • conclusion == 'failure'            │
 │  • run_attempt <= 3                   │
 │  • event != 'pull_request'            │
-│  • repository_owner == 'microsoft'    │
+│  • repository == 'microsoft/aspire'   │
 └──────────────┬─────────────────────────┘
                │ yes
                ▼
@@ -59,7 +59,7 @@ condition holds:
 | **Attempt limit** | The run must be on attempt ≤ 3. Reruns fire from attempts 1, 2, and 3, so a run gets up to 3 automatic reruns (4 total attempts). |
 | **Failure-only triggering** | Only fires on `workflow_run.conclusion == 'failure'`. A `cancelled` run never triggers a rerun. |
 | **Scheduled/manual only** | Only fires when the outerloop run's trigger was not `pull_request` (`workflow_run.event != 'pull_request'`). PR-triggered outerloop runs (narrow paths filter) are left for the PR author to rerun manually. |
-| **Repository guard** | Only runs on `microsoft/aspire` (`github.repository_owner == 'microsoft'`). |
+| **Repository guard** | Only runs on `microsoft/aspire` (`github.repository == 'microsoft/aspire'`). |
 
 GitHub's `rerun-failed-jobs` API reruns **all** failed jobs for the attempt
 (there is no API to rerun a subset), which is exactly the desired behavior here.
diff --git a/docs/ci/pipeline-failure-issues.md b/docs/ci/pipeline-failure-issues.md
index c58aefd3126..0824e500e0a 100644
--- a/docs/ci/pipeline-failure-issues.md
+++ b/docs/ci/pipeline-failure-issues.md
@@ -37,7 +37,7 @@ re-runs of the same run.
 ## How a run is reported
 
 Each workflow's reporter job runs only on
-`failure() && github.event_name == 'schedule' && github.repository_owner == 'microsoft'`
+`failure() && github.event_name == 'schedule' && github.repository == 'microsoft/aspire'`
 (so PR/manual runs never file issues and forks stay quiet). Because the job is
 gated on `failure()`, it cannot run for a `startup_failure` (no job runs) or a
 `timed_out` run (cancelled-class); the scheduled-workflow scanner **backstops**

From 881832e5d0fbf0cf84cf76b721f14752322c0581 Mon Sep 17 00:00:00 2001
From: Ankit Jain <radical@gmail.com>
Date: Tue, 13 Oct 2026 12:15:11 -0400
Subject: [PATCH 11/11] test(ci): drop YAML string assertions changed by
 repository guards

Five workflow tests assert literal YAML conditions rather than behavior.
Changing the repository guards requires rewriting those expectations
without demonstrating that the workflows run correctly.

Remove those five tests. Retain behavioral Node harness tests,
untouched assertions, and shared helpers.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 401f795f-42c1-4ff5-929a-2b40840c86a6
---
 .../WorkflowScripts/BackportWorkflowTests.cs  | 13 ----
 .../DeploymentTestCommandTests.cs             |  9 ---
 .../WorkflowScripts/ExtensionWorkflowTests.cs | 65 -------------------
 3 files changed, 87 deletions(-)

diff --git a/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
index 90c5ddf1a4a..758ec3e060b 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/BackportWorkflowTests.cs
@@ -11,19 +11,6 @@ public sealed class BackportWorkflowTests(ITestOutputHelper output)
 {
     private const string WorkflowRelativePath = ".github/workflows/backport.yml";
 
-    [Fact]
-    public void JobsAreRestrictedToTheExactRepository()
-    {
-        var jobs = Mapping(LoadWorkflow(), "jobs");
-
-        Assert.Equal(
-            "github.event_name == 'schedule' && github.repository == 'microsoft/aspire'",
-            Scalar(Mapping(jobs, "cleanup"), "if"));
-        Assert.Equal(
-            "github.event_name == 'issue_comment' && github.repository == 'microsoft/aspire' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/backport to')",
-            Scalar(Mapping(jobs, "backport"), "if"));
-    }
-
     [Fact]
     [RequiresTools(["node"])]
     public async Task CleanupCollectsWorkflowRunIdsBeforeDeleting()
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
index 49f14a8524d..208d76bdf81 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/DeploymentTestCommandTests.cs
@@ -9,15 +9,6 @@ namespace Infrastructure.Tests;
 
 public sealed class DeploymentTestCommandTests(ITestOutputHelper output)
 {
-    [Fact]
-    public void CommandPrefilterSelectsCandidatesOnMicrosoftPullRequests()
-    {
-        var condition = Scalar(LoadJob(), "if");
-        Assert.Equal(
-            "${{ startsWith(github.event.comment.body, '/deployment-test') && github.event.issue.pull_request && github.repository == 'microsoft/aspire' }}",
-            string.Join(" ", condition.Split((char[]?)null, StringSplitOptions.RemoveEmptyEntries)));
-    }
-
     [Fact]
     public void DeploymentStepsRequireRepositoryWriteAccess()
     {
diff --git a/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs b/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
index 05342a317f8..c06249d2592 100644
--- a/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
+++ b/tests/Infrastructure.Tests/WorkflowScripts/ExtensionWorkflowTests.cs
@@ -251,52 +251,6 @@ public void GenericReviewChecksOnlyStableNonExperimentalAtsBreaks()
         Assert.False(skill.Contains("breaking changes to public API without justification", StringComparison.Ordinal));
     }
 
-    [Fact]
-    public void CiRunsSelectorDrivenTestsForEveryRequiredPr()
-    {
-        var normalTests = Mapping(s_ciJobs, "tests");
-        Assert.Equal("./.github/workflows/tests.yml", Scalar(normalTests, "uses"));
-        Assert.Equal(
-            "${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' }}",
-            Scalar(normalTests, "if"));
-    }
-
-    [Fact]
-    public void StabilizationJobUsesOneEnableSwitchAndRunsOnlyOnPrs()
-    {
-        var outputs = Mapping(Mapping(s_ciJobs, "prepare_for_ci"), "outputs");
-        Assert.Contains(Scalar(outputs, "STABILIZATION_ENABLED"), new[] { "true", "false" });
-
-        var job = Mapping(s_ciJobs, "stabilization_check");
-        Assert.Equal(
-            "${{ github.repository == 'microsoft/aspire' && needs.prepare_for_ci.outputs.skip_workflow != 'true' && " +
-            "github.event_name == 'pull_request' && needs.prepare_for_ci.outputs.STABILIZATION_ENABLED == 'true' }}",
-            Scalar(job, "if"));
-        Assert.False(job.Children.ContainsKey(new YamlScalarNode("env")));
-
-        var steps = Steps(job);
-        Assert.Equal(
-            [
-                "Checkout code",
-                "Build + pack with StabilizePackageVersion=true",
-                "Run version-sensitive Aspire.Cli.Tests classes under stabilization",
-                "aspire init + restore smoke against stable local feed",
-                "Upload logs",
-            ],
-            steps.Select(step => Scalar(step, "name")));
-        Assert.All(steps, step =>
-        {
-            if (Scalar(step, "name") == "Upload logs")
-            {
-                Assert.Equal("${{ always() }}", Scalar(step, "if"));
-            }
-            else
-            {
-                Assert.False(step.Children.ContainsKey(new YamlScalarNode("if")));
-            }
-        });
-    }
-
     [Fact]
     public void FinalResultsRequireStabilizationOnlyWhenEnabledForPrs()
     {
@@ -316,25 +270,6 @@ public void FinalResultsRequireStabilizationOnlyWhenEnabledForPrs()
             CollapseWhitespace(Scalar(failureStep, "if")));
     }
 
-    [Fact]
-    public void CiFailureTrackerDoesNotRequirePrOnlyStabilizationOnPush()
-    {
-        var tracker = Mapping(s_ciJobs, "ci_failure_tracker");
-
-        Assert.Equal(["actionlint", "prepare_for_ci", "tests", "stabilization_check"], SequenceScalars(tracker, "needs"));
-        Assert.Equal(
-            "${{ always() && github.event_name == 'push' && github.repository == 'microsoft/aspire' }}",
-            Scalar(tracker, "if"));
-
-        var scriptStep = Assert.Single(Steps(tracker), step => Scalar(step, "name") == "File or close the red-main issue");
-        var environment = Mapping(scriptStep, "env");
-        Assert.Equal("${{ contains(needs.*.result, 'failure') }}", Scalar(environment, "CI_RED"));
-        Assert.Equal(
-            "${{ needs.actionlint.result == 'success' && needs.prepare_for_ci.result == 'success' && " +
-            "needs.tests.result == 'success' }}",
-            CollapseWhitespace(Scalar(environment, "CI_GREEN")));
-    }
-
     private static List<YamlMappingNode> Steps(YamlMappingNode job)
         => ((YamlSequenceNode)job.Children[new YamlScalarNode("steps")]).Cast<YamlMappingNode>().ToList();