fix: address bot feedback on prerelease workflow

- Add explicit permissions block (contents: read, pull-requests: write, issues: write)
- Fix --ref to use PR head branch instead of github.ref (main)
- Add PR info fetching step to get head branch and repo
- Add guard to prevent usage on forks (only works for branches in this repo)
- Add guard to prevent usage on issues (PR-only)
- Improve race condition handling by filtering workflow runs by branch
- Add fallback URL if workflow run not found
- Document that hardcoded defaults mirror publish.yml defaults

Co-Authored-By: AJ Steers <[email protected]>

Author: devin-ai-integration[bot]

.github/workflows/prerelease-command.yml

@@ -1,5 +1,11 @@
 name: On-Demand Prerelease
 
+# Minimal permissions for security (addresses GitHub Advanced Security feedback)
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
 on:
   workflow_dispatch:
     inputs:
@@ -30,6 +36,32 @@ jobs:
         id: vars
         run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT
 
+      - name: Check that PR number is provided
+        if: github.event.inputs.pr == ''
+        run: |
+          echo "Error: /prerelease command must be invoked on a pull request, not an issue."
+          exit 1
+
+      - name: Get PR info
+        id: pr-info
+        run: |
+          PR_JSON=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.inputs.pr }})
+          HEAD_REF=$(echo "$PR_JSON" | jq -r .head.ref)
+          HEAD_REPO=$(echo "$PR_JSON" | jq -r .head.repo.full_name)
+          echo "head-ref=${HEAD_REF}" >> $GITHUB_OUTPUT
+          echo "head-repo=${HEAD_REPO}" >> $GITHUB_OUTPUT
+          echo "PR branch: ${HEAD_REF} from ${HEAD_REPO}"
+        env:
+          GH_TOKEN: ${{ steps.get-app-token.outputs.token }}
+
+      - name: Check that PR is from this repository (not a fork)
+        if: steps.pr-info.outputs.head-repo != github.repository
+        run: |
+          echo "Error: /prerelease only works for branches in this repository, not forks."
+          echo "PR is from: ${{ steps.pr-info.outputs.head-repo }}"
+          echo "Expected: ${{ github.repository }}"
+          exit 1
+
       - name: Append comment with job run link
         if: github.event.inputs.comment-id
         id: first-comment-action
@@ -47,9 +79,13 @@ jobs:
             [1]: ${{ steps.vars.outputs.run-url }}
 
       - name: Trigger publish workflow
+        id: trigger-publish
         run: |
+          # Trigger the publish workflow on the PR's head branch
+          # Note: These defaults mirror the defaults in publish.yml and can be extended
+          # to accept optional overrides via slash command arguments if needed in the future.
           gh workflow run publish.yml \
-            --ref ${{ github.ref }} \
+            --ref "${{ steps.pr-info.outputs.head-ref }}" \
             -f version="" \
             -f publish_to_pypi=true \
             -f publish_to_dockerhub=true \
@@ -63,8 +99,20 @@ jobs:
         run: |
           # Wait a moment for the workflow to be created
           sleep 5
-          # Get the most recent workflow run for publish.yml
-          WORKFLOW_RUN_URL=$(gh run list --workflow=publish.yml --limit=1 --json url --jq '.[0].url')
+          # Query for the most recent publish workflow run on the PR branch
+          # Filter by branch to avoid race conditions with concurrent runs
+          WORKFLOW_RUN_URL=$(gh run list \
+            --workflow=publish.yml \
+            --branch "${{ steps.pr-info.outputs.head-ref }}" \
+            --limit=1 \
+            --json url \
+            --jq '.[0].url')
+          
+          if [ -z "$WORKFLOW_RUN_URL" ] || [ "$WORKFLOW_RUN_URL" = "null" ]; then
+            echo "Warning: Could not find workflow run URL. Using fallback."
+            WORKFLOW_RUN_URL="https://github.com/${{ github.repository }}/actions/workflows/publish.yml"
+          fi
+          
           echo "workflow-run-url=${WORKFLOW_RUN_URL}" >> $GITHUB_OUTPUT
         env:
           GH_TOKEN: ${{ steps.get-app-token.outputs.token }}