From 935a36b52376e788edd97df64757e7f2e44856c3 Mon Sep 17 00:00:00 2001
From: Sourabh Mehta <sourabh.mehta@arm.com>
Date: Mon, 22 Jun 2026 15:34:44 +0200
Subject: [PATCH 1/2] Block fork PRs from custom runner

---
 .github/workflows/Run_RPS_AppKit-E8.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/Run_RPS_AppKit-E8.yml b/.github/workflows/Run_RPS_AppKit-E8.yml
index dea636c..4808695 100644
--- a/.github/workflows/Run_RPS_AppKit-E8.yml
+++ b/.github/workflows/Run_RPS_AppKit-E8.yml
@@ -27,8 +27,21 @@ permissions:
   actions: read
 
 jobs:
+  runner-blocked-for-forks:
+    name: Block fork PRs from custom runner
+    if: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_repository.full_name != github.repository }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify about runner restriction for fork PRs
+        run: |
+          echo " External contributors cannot run workflows on the Raspberry Pi custom runner and are intentionally restricted"
+          echo "Fork PRs use GitHub-hosted runners only."
+
   CI:
-    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success') }}
+    if: >-
+      ${{ github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository) }}
     runs-on: [self-hosted, rsp-p5-01]
 
     steps:

From 87641c677ec868209f2baba0ce7bfdc3d2650076 Mon Sep 17 00:00:00 2001
From: Sourabh Mehta <73165318+soumeh01@users.noreply.github.com>
Date: Mon, 22 Jun 2026 16:10:59 +0200
Subject: [PATCH 2/2] Update workflow to remove branch restriction

---
 .github/workflows/Run_RPS_AppKit-E8.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/Run_RPS_AppKit-E8.yml b/.github/workflows/Run_RPS_AppKit-E8.yml
index 4808695..a124231 100644
--- a/.github/workflows/Run_RPS_AppKit-E8.yml
+++ b/.github/workflows/Run_RPS_AppKit-E8.yml
@@ -20,7 +20,6 @@ on:
   workflow_run:
     workflows: ["Build RPS for AppKit-E8 Hardware"]
     types: [completed]
-    branches: [main]
 
 permissions:
   contents: read