From e458347f271a7fa304a24eb882846391ce1bd497 Mon Sep 17 00:00:00 2001
From: ishaan1124 <ishaan1124@users.noreply.github.com>
Date: Fri, 14 Aug 2026 14:03:53 +0530
Subject: [PATCH] fix: normalize release workflow identity

---
 .github/workflows/npm-test.yml                      |  2 +-
 .github/workflows/publish.yml                       |  2 +-
 backend/cli/test/installation/release-order.test.ts | 13 +++++++++++++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/npm-test.yml b/.github/workflows/npm-test.yml
index b446f017..2a27a4bd 100644
--- a/.github/workflows/npm-test.yml
+++ b/.github/workflows/npm-test.yml
@@ -36,7 +36,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          if [[ "$GITHUB_REPOSITORY" != "synthetic-sciences/OpenScience" || "$GITHUB_REF" != "refs/heads/main" ]]; then
+          if [[ "${GITHUB_REPOSITORY,,}" != "synthetic-sciences/openscience" || "$GITHUB_REF" != "refs/heads/main" ]]; then
             echo "::error::npm test publishing uses registry credentials and must be dispatched from synthetic-sciences/OpenScience main; received $GITHUB_REPOSITORY at $GITHUB_REF."
             exit 1
           fi
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5ad911ae..d24a09b5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -39,7 +39,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          if [[ "$GITHUB_REPOSITORY" != "synthetic-sciences/OpenScience" || "$GITHUB_REF" != "refs/heads/main" ]]; then
+          if [[ "${GITHUB_REPOSITORY,,}" != "synthetic-sciences/openscience" || "$GITHUB_REF" != "refs/heads/main" ]]; then
             echo "::error::Production releases must be dispatched from synthetic-sciences/OpenScience main; received $GITHUB_REPOSITORY at $GITHUB_REF."
             exit 1
           fi
diff --git a/backend/cli/test/installation/release-order.test.ts b/backend/cli/test/installation/release-order.test.ts
index 2fb2aee8..abd35d56 100644
--- a/backend/cli/test/installation/release-order.test.ts
+++ b/backend/cli/test/installation/release-order.test.ts
@@ -10,3 +10,16 @@ test("production publish pushes the release commit before targeting it on GitHub
   expect(release).toBeGreaterThan(tag)
   expect(script.slice(tag, release)).not.toContain(".nothrow()")
 })
+
+test("publish source gates normalize GitHub's case-insensitive repository slug", async () => {
+  const workflows = ["npm-test.yml", "publish.yml"]
+
+  for (const workflow of workflows) {
+    const source = await Bun.file(path.join(import.meta.dir, `../../../../.github/workflows/${workflow}`)).text()
+
+    expect(source).toContain(
+      '[[ "${GITHUB_REPOSITORY,,}" != "synthetic-sciences/openscience" || "$GITHUB_REF" != "refs/heads/main" ]]',
+    )
+    expect(source).not.toContain('[[ "$GITHUB_REPOSITORY" != "synthetic-sciences/OpenScience"')
+  }
+})