From 69863a0b7f2b019f5271eec23e9160dfc476992e Mon Sep 17 00:00:00 2001
From: Ajay Krishnan <ajay@krishnan.ca>
Date: Mon, 27 Jul 2026 15:04:59 -0700
Subject: [PATCH] Route Gitea image contract to trusted runner

---
 .github/workflows/candidate.yml |  7 +++++--
 test/repository_test.rb         | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/candidate.yml b/.github/workflows/candidate.yml
index 8191319..f05fab4 100644
--- a/.github/workflows/candidate.yml
+++ b/.github/workflows/candidate.yml
@@ -267,9 +267,12 @@ jobs:
           retention-days: 30
 
   exact-image-contract-gitea:
-    if: github.server_url != 'https://github.com'
+    if: >-
+      github.server_url != 'https://github.com' &&
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/main'))
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: heyoka-image-build
     name: Gitea full exact image matrix
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/test/repository_test.rb b/test/repository_test.rb
index 7abb438..a437acc 100644
--- a/test/repository_test.rb
+++ b/test/repository_test.rb
@@ -383,6 +383,20 @@ class RepositoryTest < Minitest::Test
     refute_includes gitea_job, "actions/upload-artifact@"
   end
 
+  def test_gitea_exact_image_contract_uses_the_trusted_builder_only_for_main_pushes_or_manual_dispatches
+    workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
+    ordinary_jobs = workflow.split(/^  exact-image-contract:\n/, 2).fetch(0)
+    github_job, gitea_job = workflow.split(/^  exact-image-contract:\n/, 2).fetch(1)
+      .split(/^  exact-image-contract-gitea:\n/, 2)
+
+    assert_equal 4, ordinary_jobs.scan("runs-on: ubuntu-latest").length
+    assert_includes github_job, "runs-on: ubuntu-latest"
+    assert_includes gitea_job, "runs-on: heyoka-image-build"
+    assert_includes gitea_job, "github.server_url != 'https://github.com'"
+    assert_includes gitea_job, "github.event_name == 'workflow_dispatch'"
+    assert_includes gitea_job, "github.event_name == 'push' && github.ref == 'refs/heads/main'"
+  end
+
   def test_gitea_matrix_runner_uses_every_generated_entry_without_hardcoded_coordinates
     runner = File.read(File.join(ROOT, "scripts/run_image_matrix_contract.sh"))