[onedr0p]

Two changes, part of an org-wide CI conformity / minutes pass.

1. Skip only genuine release-please PRs, using a signal a contributor can't forge:

if: >-
  ${{ !(startsWith(github.head_ref, 'release-please--')
  && github.event.pull_request.head.repo.full_name == github.repository) }}

head_ref alone (the PR's source branch name) is settable by anyone, including from a fork, so a release-please--* branch could skip every check. Requiring the PR head repo to be this repo means fork PRs - the realistic path for outside contributors - always run the full suite.

2. Run e2e on pull requests only. Dropped the push: main trigger: a merged PR already ran e2e, so the post-merge run was redundant. e2e now runs on pull_request and workflow_dispatch.

[greptile-apps]

Greptile Summary

This PR narrows the release-please validation exemption to same-repository PRs and removes the post-merge E2E run.

• Adds matching release-please job guards to Go and Helm lint, test, and E2E jobs.
• Removes the E2E workflow's push trigger for main.

Confidence Score: 4/5

This PR is not safe to merge until the release-please exemption authenticates the PR creator rather than relying on a same-repository branch name.

A contributor with repository write access can create a matching branch and cause all six validation jobs to be skipped for arbitrary changes.

Files Needing Attention: .github/workflows/e2e.yaml, .github/workflows/lint.yaml, and .github/workflows/tests.yaml

Security Review

The fork-based bypass is closed, but contributors with repository write access can still forge the release branch prefix and skip every guarded validation job because the exemption does not authenticate the PR creator.

T-Rex Logs

What T-Rex did

• Executed the general contract validation harness to verify that same-repository branches bypass validation by evaluating the extracted GitHub Actions condition.
• Validated the harness output by inspecting the evaluation log, confirming the condition evaluated to false and the GitHub job was skipped across six related jobs, with the harness exit code 0.
• Compared before- and after-run captures to confirm the E2E push trigger and unconditional jobs before, and the exact predicate satisfaction and triggers after, across all targeted jobs.
• Collected and linked artifacts that support the above checks, including the runnable harness artifact and the related logs from both proofs.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/e2e.yaml	Removes post-merge E2E execution and adds a release-please exemption that remains forgeable by same-repository branch creators.
.github/workflows/lint.yaml	Adds the same unauthenticated release-branch exemption to both lint jobs.
.github/workflows/tests.yaml	Adds the same unauthenticated release-branch exemption to both test jobs.

_{Reviews (3): Last reviewed commit: "ci: skip automated release PRs; run e2e ..." | Re-trigger Greptile}

[greptile-apps]

Same-repository branches bypass validation

When a contributor with repository write access opens a PR from a same-repository branch prefixed with release-please--, both predicates match without authenticating the PR creator, causing all six lint, test, and E2E jobs to be skipped for arbitrary changes.