Merge branch 'block:main' into main

Author: bavadim

.github/workflows/cargo-deny.yml

@@ -18,6 +18,7 @@ on:
 jobs:
   deny:
     runs-on: ubuntu-latest
+    if: github.repository == 'block/goose'
     permissions:
       contents: read
     steps:

.github/workflows/minor-release.yaml

@@ -11,6 +11,7 @@ on:
 
 jobs:
   release:
+    if: github.repository == 'block/goose'
     uses: ./.github/workflows/create-release-pr.yaml
     with:
       bump_type: "minor"

.github/workflows/pr-comment-bundle-intel.yml

@@ -91,9 +91,25 @@ jobs:
           body: |
             ### macOS Intel Desktop App (x64)
 
-            [💻 Download macOS Desktop App (Intel x64, signed)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/Goose-darwin-x64.zip)
+            [💻 Download macOS Desktop App (Intel x64, unsigned)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/Goose-darwin-x64.zip)
 
             **Instructions:**
-            After downloading, unzip the file and drag the goose.app to your Applications folder. The app is signed and notarized for macOS.
-
-            This link is provided by nightly.link and will work even if you're not logged into GitHub.
+            
+            The easiest way is to just run the following script:
+            
+            `./scripts/pre-release.sh`
+            
+            script which will download the latest release (or you can specify the release you need), does the
+            unzip, xattr to get it out of quarantine and signs it.
+            
+            If you need to do this manually:
+            
+               * Download the file
+               * Unzip
+               * run `xattr -r -d com.apple.quarantine '/path/to/Goose.app'`
+               * optionally run `codesign --force --deep --sign - --entitlements ui/desktop/entitlements.plist '/path/to/Goose.app'`
+               * start the app
+            
+            The signing step is only needed if you do something that uses mac entitlements like speech to text
+            
+            This link is provided by nightly.link and will work even if you're not logged into GitHub.

.github/workflows/rebuild-skills-marketplace.yml

@@ -23,6 +23,7 @@ concurrency:
 jobs:
   rebuild-docs:
     runs-on: ubuntu-latest
+    if: github.repository == 'block/goose'
     permissions:
       contents: write
 

.github/workflows/release-branches.yml

@@ -27,9 +27,20 @@ jobs:
             [📱 Download macOS Desktop App (arm64, unsigned)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/Goose-darwin-arm64.zip)
 
             **Instructions:**
-            After downloading, unzip the file and drag the goose.app to a location you prefer. The app is unsigned, so to run it run `xattr -r -d com.apple.quarantine '/path/to/goose.app'` and then open the app
-
-            **To test speech-to-text**, you also need to codesign the app with the microphone entitlement:
-            ```
-            codesign --force --deep --sign - --entitlements ui/desktop/entitlements.plist '/path/to/Goose.app'
-            ```
+            
+            The easiest way is to just run the following script:
+            
+            `./scripts/pre-release.sh`
+            
+            script which will download the latest release (or you can specify the release you need), does the
+            unzip, xattr to get it out of quarantine and signs it.
+            
+            If you need to do this manually:
+            
+               * Download the file
+               * Unzip
+               * run `xattr -r -d com.apple.quarantine '/path/to/Goose.app'`
+               * optionally run `codesign --force --deep --sign - --entitlements ui/desktop/entitlements.plist '/path/to/Goose.app'`
+               * start the app
+            
+            The signing step is only needed if you do something that uses mac entitlements like speech to text

.github/workflows/scorecard.yml

@@ -22,7 +22,7 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
-    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    if: github.repository == 'block/goose' && (github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request')
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write

.github/workflows/stale.yml

@@ -24,6 +24,7 @@ jobs:
   stale:
     name: 'Mark and Close Stale PRs'
     runs-on: ubuntu-latest
+    if: github.repository == 'block/goose'
 
     steps:
       # Use the official stale action from GitHub

.github/workflows/update-hacktoberfest-leaderboard.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   update-leaderboard:
     runs-on: ubuntu-latest
+    if: github.repository == 'block/goose'
     permissions:
       contents: read
       pull-requests: read

.github/workflows/update-health-dashboard.yml

@@ -23,6 +23,7 @@ jobs:
   update-dashboard:
     name: 'Update Health Dashboard'
     runs-on: ubuntu-latest
+    if: github.repository == 'block/goose'
 
     steps:
       - name: 'Download previous metrics'