From ee3cfa387c50a389a674bbead509d5329065a06f Mon Sep 17 00:00:00 2001
From: Patrick O'Doherty <patrick@tailscale.com>
Date: Fri, 12 Jun 2026 18:43:43 +0000
Subject: [PATCH] .github: exclude forks from privileged job runs

Exclude forks from executing "privileged" GHA jobs on our self-hosted
runners.

Updates tailscale/corp#43401

Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
---
 .github/workflows/test.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 325461060..ae871eb4b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -344,6 +344,9 @@ jobs:
   privileged:
     needs: gomod-cache
     runs-on: ubuntu-24.04
+    # This job runs fork-PR code inside a --privileged container, so restrict it
+    # to runs on the tailscale/tailscale repo and never on 3p PRs.
+    if: github.repository == 'tailscale/tailscale'
     container:
       image: golang:latest
       options: --privileged