[onedr0p]

Two changes, part of an org-wide CI conformity / minutes pass.

1. Skip only genuine release-please PRs, using a signal a contributor can't forge:

if: >-
  ${{ !(startsWith(github.head_ref, 'release-please--')
  && github.event.pull_request.head.repo.full_name == github.repository) }}

head_ref alone (the PR's source branch name) is settable by anyone, including from a fork, so a release-please--* branch could skip every check. Requiring the PR head repo to be this repo means fork PRs - the realistic path for outside contributors - always run the full suite.

2. Run e2e on pull requests only. Dropped the push: main trigger: a merged PR already ran e2e, so the post-merge run was redundant. e2e now runs on pull_request and workflow_dispatch.

[greptile-apps]

Greptile Summary

This PR narrows validation skipping to same-repository release-prefixed pull requests and removes the post-merge E2E trigger.

• Adds matching job guards to the E2E, Go/Helm lint, and Go/Helm test jobs.
• Runs E2E for pull requests and manual dispatches, but no longer for pushes to main.

Confidence Score: 4/5

This PR is not safe to merge until validation skipping authenticates genuine release-please pull requests instead of trusting an internally forgeable branch prefix.

A contributor able to create a branch in the repository can satisfy the new condition and skip every E2E, lint, and test job from an ordinary pull request.

Files Needing Attention: .github/workflows/e2e.yaml, .github/workflows/lint.yaml, .github/workflows/tests.yaml

Security Review

The guard still permits any contributor who can create a same-repository branch named release-please--* to bypass all five validation jobs; repository identity does not authenticate release-please as the branch creator.

T-Rex Logs

What T-Rex did

• I reproduced the internal branch prefix bypass by running a Ruby guard-evaluation harness that parsed the guards from the repository workflow files and evaluated them against a same-repository PR fixture, which resulted in all five jobs being skipped.
• The validator runs exited with code 0 and produced verbose trigger data.
• The YAML parse and the trigger contract assertions PASS.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/e2e.yaml	Removes push-triggered E2E and adds a same-repository branch-prefix guard that still allows internal branches to bypass E2E.
.github/workflows/lint.yaml	Adds the same forgeable same-repository branch-prefix guard to both lint jobs.
.github/workflows/tests.yaml	Adds the same forgeable same-repository branch-prefix guard to both test jobs.

_{Reviews (3): Last reviewed commit: "ci: skip automated release PRs; run e2e ..." | Re-trigger Greptile}

[greptile-apps]

Internal branch prefix bypasses checks

When a contributor creates a same-repository branch named release-please--*, this condition skips the job despite the pull request not being generated by release-please, causing Helm E2E, both lint jobs, and both test jobs to be bypassed across the three workflows.