From 01b8279223d4d19a241b2c9f4779a5e677c18bc6 Mon Sep 17 00:00:00 2001
From: Doron Eli Rachman <doron050@gmail.com>
Date: Sat, 24 Oct 2026 18:19:32 +0300
Subject: [PATCH] Fix artifact poisoning in gen-release-pr workflow

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/gen-release-pr.yml | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/gen-release-pr.yml b/.github/workflows/gen-release-pr.yml
index d3168802..caa923ba 100644
--- a/.github/workflows/gen-release-pr.yml
+++ b/.github/workflows/gen-release-pr.yml
@@ -147,11 +147,27 @@ jobs:
 
       - name: Download wasm artifact for sha computation
         if: steps.version-update.outputs.new-version != ''
-        uses: dawidd6/action-download-artifact@v27
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          run_id: ${{ github.event.workflow_run.id }}
-          name: wasm-file
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO_FULL: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          # Only consume artifacts of a successful Build run triggered by a push to main of this repo.
+          # Never take an artifact from PR / fork runs, nor from an arbitrary "latest" run.
+          RUN_FILTER='select(.event == "push" and .head_branch == "main" and .conclusion == "success" and .head_repository.full_name == $repo) | .id'
+          if [ "$EVENT_NAME" = "workflow_run" ]; then
+            RUN_ID=$(gh api "repos/$REPO_FULL/actions/runs/$WORKFLOW_RUN_ID" | jq -r --arg repo "$REPO_FULL" "$RUN_FILTER")
+          else
+            RUN_ID=$(gh api "repos/$REPO_FULL/actions/workflows/build.yml/runs?branch=main&event=push&status=success&per_page=1" \
+              | jq -r --arg repo "$REPO_FULL" ".workflow_runs[0] | $RUN_FILTER")
+          fi
+          if [ -z "$RUN_ID" ]; then
+            echo "::error::No trusted successful Build run on main found to take the wasm artifact from"
+            exit 1
+          fi
+          echo "Downloading wasm-file from Build run $RUN_ID"
+          gh run download "$RUN_ID" --repo "$REPO_FULL" --name wasm-file --dir .
 
       - name: Set up .NET
         if: steps.version-update.outputs.new-version != ''