From 311dc0ea58aca4c783229a6f44a76c5ea74ca597 Mon Sep 17 00:00:00 2001
From: kgala2 <galakp@google.com>
Date: Tue, 18 Aug 2026 16:24:48 +0000
Subject: [PATCH 1/2] ci: skip schedule reporter on forks

---
 .github/workflows/cloud_build_failure_reporter.yml | 1 +
 .github/workflows/schedule_reporter.yml            | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/cloud_build_failure_reporter.yml b/.github/workflows/cloud_build_failure_reporter.yml
index 493ddecd2..85715795c 100644
--- a/.github/workflows/cloud_build_failure_reporter.yml
+++ b/.github/workflows/cloud_build_failure_reporter.yml
@@ -29,6 +29,7 @@ on:
 
 jobs:
   report:
+    if: github.repository == 'GoogleCloudPlatform/cloud-sql-python-connector'
 
     permissions:
       issues: 'write'
diff --git a/.github/workflows/schedule_reporter.yml b/.github/workflows/schedule_reporter.yml
index bad7e46c2..401eb19ba 100644
--- a/.github/workflows/schedule_reporter.yml
+++ b/.github/workflows/schedule_reporter.yml
@@ -20,6 +20,7 @@ on:
 
 jobs:
   run_reporter:
+    if: github.repository == 'GoogleCloudPlatform/cloud-sql-python-connector'
     permissions:
       issues: 'write'
       checks: 'read'
@@ -27,3 +28,4 @@ jobs:
     uses: ./.github/workflows/cloud_build_failure_reporter.yml
     with:
       trigger_names: "py-continuous-test-on-merge,py-integration-test-nightly"
+

From 011e1dbbf7a66fb56be07556660cc6e4596c61dd Mon Sep 17 00:00:00 2001
From: kgala2 <galakp@google.com>
Date: Tue, 18 Aug 2026 16:46:37 +0000
Subject: [PATCH 2/2] ci: pass trigger_names via environment variable to
 prevent template injection

---
 .github/workflows/cloud_build_failure_reporter.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cloud_build_failure_reporter.yml b/.github/workflows/cloud_build_failure_reporter.yml
index 85715795c..a105b4778 100644
--- a/.github/workflows/cloud_build_failure_reporter.yml
+++ b/.github/workflows/cloud_build_failure_reporter.yml
@@ -40,13 +40,15 @@ jobs:
 
     steps:
       - uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # v8
+        env:
+          TRIGGER_NAMES: ${{ inputs.trigger_names }}
         with:
           script: |-
                   // parse test names
-                  const testNameSubstring = '${{ inputs.trigger_names }}';
+                  const testNameSubstring = process.env.TRIGGER_NAMES || '';
                   const testNameFound = new Map(); //keeps track of whether each test is found
                   testNameSubstring.split(',').forEach(testName => {
-                    testNameFound.set(testName, false); 
+                    testNameFound.set(testName.trim(), false); 
                   });
                   
                   // label for all issues opened by reporter
@@ -173,8 +175,8 @@ jobs:
                   const noTestFound = Array.from(testNameFound.values()).every(value => value === false);
                   if (noTestFound){
                     createOrCommentIssue(
-                      'Missing periodic tests: ${{ inputs.trigger_names }}',
-                      `No periodic test is found for triggers: ${{ inputs.trigger_names }}. Last checked from ${
+                      `Missing periodic tests: ${testNameSubstring}`,
+                      `No periodic test is found for triggers: ${testNameSubstring}. Last checked from ${
                         commits[0].html_url
                       } to ${commits[commits.length - 1].html_url}.`
                     );