From 9b2a0f9cba13cb8c192660c74b5a94e8da0a9249 Mon Sep 17 00:00:00 2001
From: Peter Tripp <petertripp@gmail.com>
Date: Thu, 8 Oct 2026 14:13:18 -0400
Subject: [PATCH 1/5] ci: Improve CI experience on forks

---
 .github/workflows/check_generated_vrl_docs.yml |  2 +-
 .github/workflows/ci-integration-review.yml    |  1 +
 .github/workflows/cleanup-ghcr-images.yml      |  1 +
 .github/workflows/component_features.yml       |  1 +
 .github/workflows/coverage.yml                 |  4 +++-
 .github/workflows/deny.yml                     |  4 ++--
 .github/workflows/integration.yml              |  6 ++++--
 .github/workflows/integration_windows.yml      |  2 +-
 .github/workflows/k8s_e2e.yml                  |  8 ++++----
 .github/workflows/nightly.yml                  |  1 +
 .github/workflows/publish.yml                  |  3 +++
 .github/workflows/regression.yml               |  1 +
 .github/workflows/scorecard.yml                |  1 +
 .github/workflows/test.yml                     | 10 +++++-----
 .github/workflows/unit-tests.yml               |  1 +
 .github/workflows/unit_windows.yml             |  1 +
 .github/workflows/warm-cache.yml               |  1 +
 17 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/check_generated_vrl_docs.yml b/.github/workflows/check_generated_vrl_docs.yml
index e3d67ea0153d5..9a1d514f6ebe1 100644
--- a/.github/workflows/check_generated_vrl_docs.yml
+++ b/.github/workflows/check_generated_vrl_docs.yml
@@ -40,7 +40,7 @@ jobs:
 
   run-check-generated-vrl-docs:
     needs: changes
-    if: needs.changes.outputs.docs == 'true'
+    if: needs.changes.outputs.docs == 'true' && github.repository_owner == 'vectordotdev'
     runs-on: ubuntu-24.04-8core
     permissions:
       contents: write
diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index ae4e960e1162f..485f60db389ab 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -190,6 +190,7 @@ jobs:
     needs:
       - prep-pr
       - build-test-runner
+    if: github.repository_owner == 'vectordotdev'
     runs-on: ubuntu-24.04-8core
     timeout-minutes: 30
     permissions:
diff --git a/.github/workflows/cleanup-ghcr-images.yml b/.github/workflows/cleanup-ghcr-images.yml
index 885df52f5caa3..8b880f9d2c406 100644
--- a/.github/workflows/cleanup-ghcr-images.yml
+++ b/.github/workflows/cleanup-ghcr-images.yml
@@ -21,6 +21,7 @@ permissions:
 
 jobs:
   cleanup-test-runner:
+    if: ${{ github.repository_owner == 'vectordotdev' }}
     runs-on: ubuntu-24.04
     permissions:
       packages: write # Required to delete package versions from GHCR
diff --git a/.github/workflows/component_features.yml b/.github/workflows/component_features.yml
index 1fa7bb700a242..48bc0c2ee17d6 100644
--- a/.github/workflows/component_features.yml
+++ b/.github/workflows/component_features.yml
@@ -30,6 +30,7 @@ permissions:
 
 jobs:
   check-component-features:
+    if: github.repository_owner == 'vectordotdev'
     # use free tier on schedule and 8 core to expedite results on demand invocation
     runs-on: ${{ github.event_name == 'schedule' && 'ubuntu-24.04' || 'ubuntu-24.04-8core' }}
     timeout-minutes: 180 # Usually takes 2h but this prevents it from hanging for an indefinite time
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 075113b5ec111..248e46b4e5600 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -32,6 +32,7 @@ env:
 
 jobs:
   tests:
+    if: ${{ github.repository_owner == 'vectordotdev' }}
     permissions:
       contents: read
       id-token: write
@@ -44,6 +45,7 @@ jobs:
       vector-api: true
 
   integration-tests:
+    if: ${{ github.repository_owner == 'vectordotdev' }}
     permissions:
       contents: read
       packages: write
@@ -61,7 +63,7 @@ jobs:
     needs:
       - tests
       - integration-tests
-    if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
+    if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && github.repository_owner == 'vectordotdev' }}
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 33169f3efbcde..4c6e5d9b4fde2 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -48,7 +48,7 @@ jobs:
   test-deny:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') }}
+    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
     needs: [changes]
     steps:
       - name: Checkout branch
@@ -67,7 +67,7 @@ jobs:
   test-deny-licenses:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') }}
+    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
     needs: [changes]
     steps:
       - name: Checkout branch
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 9794672002cd0..bba715f0ecbb7 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -92,7 +92,8 @@ jobs:
       - build-test-runner
 
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) }}
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) &&
+      github.repository_owner == 'vectordotdev' }}
     strategy:
       fail-fast: false
       matrix:
@@ -209,7 +210,8 @@ jobs:
       - changes
       - build-test-runner
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) }}
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) &&
+      github.repository_owner == 'vectordotdev' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/integration_windows.yml b/.github/workflows/integration_windows.yml
index dcbb0a84dc81c..c011edb317fab 100644
--- a/.github/workflows/integration_windows.yml
+++ b/.github/workflows/integration_windows.yml
@@ -31,7 +31,7 @@ jobs:
 
   run-test-integration-windows:
     needs: changes
-    if: needs.changes.outputs.windows == 'true'
+    if: needs.changes.outputs.windows == 'true' && github.repository_owner == 'vectordotdev'
     runs-on: windows-2025-8core
     timeout-minutes: 60
     steps:
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 1ca5421f75478..f8b5be7d162e3 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -68,8 +68,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     needs: changes
-    # Run this job even if `changes` job is skipped
-    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' }}
+    # Run this job even if `changes` job is skipped.
+    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
     env:
       DISABLE_MOLD: true
     steps:
@@ -105,8 +105,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     needs: changes
-    # Run this job even if `changes` job is skipped
-    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' }}
+    # Run this job even if `changes` job is skipped.
+    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 56933a04efc13..f1c8233549924 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -10,6 +10,7 @@ on:
 
 jobs:
   Nightly:
+    if: ${{ github.repository_owner == 'vectordotdev' }}
     permissions:
       contents: write # Required to create/update releases and tags
       packages: write # Required to push container images to GHCR
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 958bd1b8fe477..627a64f352315 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -65,6 +65,7 @@ jobs:
 
   build-linux-gnu-native:
     name: Build Vector for ${{ matrix.target }} (native)
+    if: github.repository_owner == 'vectordotdev'
     runs-on: ${{ matrix.runner }}
     container:
       image: almalinux:8@sha256:ca871b110064fe81bff0250ed5cc56fbb0a9840715f09811c33bbf9d72cef56c
@@ -136,6 +137,7 @@ jobs:
 
   build-linux-cross:
     name: Build Vector for ${{ matrix.target }}
+    if: github.repository_owner == 'vectordotdev'
     runs-on: release-builder-linux
     timeout-minutes: 60
     needs: generate-publish-metadata
@@ -225,6 +227,7 @@ jobs:
 
   build-x86_64-pc-windows-msvc-packages:
     name: Build Vector for x86_64-pc-windows-msvc (.zip)
+    if: github.repository_owner == 'vectordotdev'
     runs-on: windows-2025-8core
     timeout-minutes: 90
     needs: generate-publish-metadata
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 32ceaa3ca18a5..c1a3905dd02e6 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -60,6 +60,7 @@ env:
 
 jobs:
   resolve-inputs:
+    if: ${{ github.repository_owner == 'vectordotdev' }}
     runs-on: ubuntu-24.04
     outputs:
       baseline-sha: ${{ steps.set_and_validate_shas.outputs.BASELINE_SHA }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ca14a19069f6c..336659e3b1378 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,6 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
+    if: ${{ github.repository_owner == 'vectordotdev' }}
     runs-on: ubuntu-24.04
     permissions:
       # Needed to upload the results to code-scanning dashboard.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b8cd6038559d5..a4d580e65db3a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -57,7 +57,7 @@ jobs:
   check-clippy:
     name: Check clippy
     runs-on: ubuntu-24.04-8core
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -97,7 +97,7 @@ jobs:
   check-events:
     name: Check events
     runs-on: ubuntu-24.04-8core
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -152,7 +152,7 @@ jobs:
   check-generated-docs:
     name: Check Generated Docs
     runs-on: ubuntu-24.04-8core
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.component_docs == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.component_docs == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -169,7 +169,7 @@ jobs:
   test-vrl:
     name: VRL - Linux
     runs-on: ubuntu-24.04-8core
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.cue == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.cue == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -184,7 +184,7 @@ jobs:
   build-vrl-playground:
     name: Build VRL Playground
     runs-on: ubuntu-24.04-8core
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.dependencies == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.dependencies == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 025285e8f1ee3..358a6f55f1ee7 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -61,6 +61,7 @@ env:
 jobs:
   tests:
     name: Tests
+    if: github.repository_owner == 'vectordotdev'
     runs-on: ubuntu-24.04-8core
     permissions:
       contents: read
diff --git a/.github/workflows/unit_windows.yml b/.github/workflows/unit_windows.yml
index c1ac04bd6d24a..38a81ab5f95fc 100644
--- a/.github/workflows/unit_windows.yml
+++ b/.github/workflows/unit_windows.yml
@@ -13,6 +13,7 @@ permissions:
 
 jobs:
   test-windows:
+    if: github.repository_owner == 'vectordotdev'
     runs-on: windows-2025-8core
     timeout-minutes: 60
     steps:
diff --git a/.github/workflows/warm-cache.yml b/.github/workflows/warm-cache.yml
index 701b170fa1a12..ba403460ed0b4 100644
--- a/.github/workflows/warm-cache.yml
+++ b/.github/workflows/warm-cache.yml
@@ -25,6 +25,7 @@ concurrency:
 jobs:
   warm:
     name: Warm shared workspace cache
+    if: github.repository_owner == 'vectordotdev'
     runs-on: ubuntu-24.04-8core
     timeout-minutes: 90
     steps:

From c8be9b7f86c92df10721008f539c4f1814f131e6 Mon Sep 17 00:00:00 2001
From: Peter Tripp <petertripp@gmail.com>
Date: Thu, 8 Oct 2026 15:57:04 -0400
Subject: [PATCH 2/5] Switch to repository gating; gate macos; fallback to
 small runners

---
 .../workflows/check_generated_vrl_docs.yml    |  2 +-
 .github/workflows/ci-integration-review.yml   |  2 +-
 .github/workflows/cleanup-ghcr-images.yml     |  2 +-
 .github/workflows/component_features.yml      |  2 +-
 .github/workflows/coverage.yml                |  6 +++---
 .github/workflows/deny.yml                    |  4 ++--
 .github/workflows/integration.yml             |  7 ++++---
 .github/workflows/integration_windows.yml     |  2 +-
 .github/workflows/k8s_e2e.yml                 |  6 +++---
 .github/workflows/nightly.yml                 |  2 +-
 .github/workflows/publish.yml                 |  7 ++++---
 .github/workflows/regression.yml              |  4 ++--
 .github/workflows/scorecard.yml               |  2 +-
 .github/workflows/static-analysis.yml         |  2 ++
 .github/workflows/test.yml                    | 20 +++++++++----------
 .github/workflows/unit-tests.yml              |  2 +-
 .github/workflows/unit_windows.yml            |  2 +-
 .github/workflows/warm-cache.yml              |  2 +-
 18 files changed, 40 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/check_generated_vrl_docs.yml b/.github/workflows/check_generated_vrl_docs.yml
index 9a1d514f6ebe1..80a517d954192 100644
--- a/.github/workflows/check_generated_vrl_docs.yml
+++ b/.github/workflows/check_generated_vrl_docs.yml
@@ -40,7 +40,7 @@ jobs:
 
   run-check-generated-vrl-docs:
     needs: changes
-    if: needs.changes.outputs.docs == 'true' && github.repository_owner == 'vectordotdev'
+    if: needs.changes.outputs.docs == 'true' && github.repository == 'vectordotdev/vector'
     runs-on: ubuntu-24.04-8core
     permissions:
       contents: write
diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 7b14da8a875b1..75ffbb5aaf697 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -190,7 +190,7 @@ jobs:
     needs:
       - prep-pr
       - build-test-runner
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: ubuntu-24.04-8core
     timeout-minutes: 30
     permissions:
diff --git a/.github/workflows/cleanup-ghcr-images.yml b/.github/workflows/cleanup-ghcr-images.yml
index 8b880f9d2c406..246de5cb1c727 100644
--- a/.github/workflows/cleanup-ghcr-images.yml
+++ b/.github/workflows/cleanup-ghcr-images.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   cleanup-test-runner:
-    if: ${{ github.repository_owner == 'vectordotdev' }}
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     runs-on: ubuntu-24.04
     permissions:
       packages: write # Required to delete package versions from GHCR
diff --git a/.github/workflows/component_features.yml b/.github/workflows/component_features.yml
index 48bc0c2ee17d6..416dbfa67dc8d 100644
--- a/.github/workflows/component_features.yml
+++ b/.github/workflows/component_features.yml
@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   check-component-features:
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     # use free tier on schedule and 8 core to expedite results on demand invocation
     runs-on: ${{ github.event_name == 'schedule' && 'ubuntu-24.04' || 'ubuntu-24.04-8core' }}
     timeout-minutes: 180 # Usually takes 2h but this prevents it from hanging for an indefinite time
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 248e46b4e5600..c4d432fc709e3 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -32,7 +32,7 @@ env:
 
 jobs:
   tests:
-    if: ${{ github.repository_owner == 'vectordotdev' }}
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     permissions:
       contents: read
       id-token: write
@@ -45,7 +45,7 @@ jobs:
       vector-api: true
 
   integration-tests:
-    if: ${{ github.repository_owner == 'vectordotdev' }}
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     permissions:
       contents: read
       packages: write
@@ -63,7 +63,7 @@ jobs:
     needs:
       - tests
       - integration-tests
-    if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && github.repository_owner == 'vectordotdev' }}
+    if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && github.repository == 'vectordotdev/vector' }}
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 4c6e5d9b4fde2..ed90c62663081 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -48,7 +48,7 @@ jobs:
   test-deny:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
+    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
     needs: [changes]
     steps:
       - name: Checkout branch
@@ -67,7 +67,7 @@ jobs:
   test-deny-licenses:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
+    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
     needs: [changes]
     steps:
       - name: Checkout branch
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index bba715f0ecbb7..db2fcc55de478 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -75,7 +75,8 @@ jobs:
       (needs.changes.outputs.dependencies == 'true' ||
       needs.changes.outputs.integration-yml == 'true' ||
       needs.changes.outputs.int-tests-any == 'true' ||
-      needs.changes.outputs.e2e-tests-any == 'true')))
+      needs.changes.outputs.e2e-tests-any == 'true'))) &&
+      github.repository == 'vectordotdev/vector'
       }}
     uses: ./.github/workflows/build-test-runner.yml
     with:
@@ -93,7 +94,7 @@ jobs:
 
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
       (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) &&
-      github.repository_owner == 'vectordotdev' }}
+      github.repository == 'vectordotdev/vector' }}
     strategy:
       fail-fast: false
       matrix:
@@ -211,7 +212,7 @@ jobs:
       - build-test-runner
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
       (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) &&
-      github.repository_owner == 'vectordotdev' }}
+      github.repository == 'vectordotdev/vector' }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/integration_windows.yml b/.github/workflows/integration_windows.yml
index c011edb317fab..5f22bb1cf4ee2 100644
--- a/.github/workflows/integration_windows.yml
+++ b/.github/workflows/integration_windows.yml
@@ -31,7 +31,7 @@ jobs:
 
   run-test-integration-windows:
     needs: changes
-    if: needs.changes.outputs.windows == 'true' && github.repository_owner == 'vectordotdev'
+    if: needs.changes.outputs.windows == 'true' && github.repository == 'vectordotdev/vector'
     runs-on: windows-2025-8core
     timeout-minutes: 60
     steps:
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index f8b5be7d162e3..b1c2889f78409 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -69,7 +69,7 @@ jobs:
     timeout-minutes: 45
     needs: changes
     # Run this job even if `changes` job is skipped.
-    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
+    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
     env:
       DISABLE_MOLD: true
     steps:
@@ -106,7 +106,7 @@ jobs:
     timeout-minutes: 5
     needs: changes
     # Run this job even if `changes` job is skipped.
-    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository_owner == 'vectordotdev') }}
+    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -250,7 +250,7 @@ jobs:
       - build-x86_64-unknown-linux-gnu
       - compute-k8s-test-plan
       - test-e2e-kubernetes
-    if: always()
+    if: always() && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector')
     env:
       FAILED: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
     steps:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index f1c8233549924..b894dcabb5722 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   Nightly:
-    if: ${{ github.repository_owner == 'vectordotdev' }}
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     permissions:
       contents: write # Required to create/update releases and tags
       packages: write # Required to push container images to GHCR
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1849792eb5675..7ec9794ca8275 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -65,7 +65,7 @@ jobs:
 
   build-linux-gnu-native:
     name: Build Vector for ${{ matrix.target }} (native)
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: ${{ matrix.runner }}
     container:
       image: almalinux:8@sha256:ca871b110064fe81bff0250ed5cc56fbb0a9840715f09811c33bbf9d72cef56c
@@ -137,7 +137,7 @@ jobs:
 
   build-linux-cross:
     name: Build Vector for ${{ matrix.target }}
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: release-builder-linux
     timeout-minutes: 60
     needs: generate-publish-metadata
@@ -179,6 +179,7 @@ jobs:
 
   build-apple-darwin-packages:
     name: Build Vector for ${{ matrix.architecture }}-apple-darwin (.tar.gz)
+    if: github.repository == 'vectordotdev/vector'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 90
     needs: generate-publish-metadata
@@ -227,7 +228,7 @@ jobs:
 
   build-x86_64-pc-windows-msvc-packages:
     name: Build Vector for x86_64-pc-windows-msvc (.zip)
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: windows-2025-8core
     timeout-minutes: 90
     needs: generate-publish-metadata
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index c1a3905dd02e6..da69e5cf6ddc7 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -60,7 +60,7 @@ env:
 
 jobs:
   resolve-inputs:
-    if: ${{ github.repository_owner == 'vectordotdev' }}
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     runs-on: ubuntu-24.04
     outputs:
       baseline-sha: ${{ steps.set_and_validate_shas.outputs.BASELINE_SHA }}
@@ -564,7 +564,7 @@ jobs:
     name: Set final result
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    if: always()
+    if: always() && github.repository == 'vectordotdev/vector'
     needs:
       - should-run-gate
       - resolve-inputs
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f768fa10ca2ad..3673da421ac4c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    if: ${{ github.repository_owner == 'vectordotdev' }}
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     runs-on: ubuntu-24.04
     permissions:
       # Needed to upload the results to code-scanning dashboard.
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index bc6b455acac7f..a80ac8cc5f6b3 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -12,6 +12,8 @@ permissions:
 
 jobs:
   static-analysis:
+    # Requires Datadog OIDC credentials that aren't available on forks.
+    if: github.repository == 'vectordotdev/vector'
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a4d580e65db3a..12722f1f526d5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -56,8 +56,8 @@ jobs:
 
   check-clippy:
     name: Check clippy
-    runs-on: ubuntu-24.04-8core
-    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
+    runs-on: ${{ github.repository == 'vectordotdev/vector' && 'ubuntu-24.04-8core' || 'ubuntu-24.04' }}
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -96,8 +96,8 @@ jobs:
 
   check-events:
     name: Check events
-    runs-on: ubuntu-24.04-8core
-    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
+    runs-on: ${{ github.repository == 'vectordotdev/vector' && 'ubuntu-24.04-8core' || 'ubuntu-24.04' }}
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -151,8 +151,8 @@ jobs:
 
   check-generated-docs:
     name: Check Generated Docs
-    runs-on: ubuntu-24.04-8core
-    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.component_docs == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
+    runs-on: ${{ github.repository == 'vectordotdev/vector' && 'ubuntu-24.04-8core' || 'ubuntu-24.04' }}
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.component_docs == 'true' || needs.changes.outputs.test-yml == 'true' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -168,8 +168,8 @@ jobs:
 
   test-vrl:
     name: VRL - Linux
-    runs-on: ubuntu-24.04-8core
-    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.cue == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
+    runs-on: ${{ github.repository == 'vectordotdev/vector' && 'ubuntu-24.04-8core' || 'ubuntu-24.04' }}
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.cue == 'true' || needs.changes.outputs.test-yml == 'true' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -183,8 +183,8 @@ jobs:
 
   build-vrl-playground:
     name: Build VRL Playground
-    runs-on: ubuntu-24.04-8core
-    if: ${{ (needs.changes.outputs.source == 'true' || needs.changes.outputs.dependencies == 'true' || needs.changes.outputs.test-yml == 'true') && github.repository_owner == 'vectordotdev' }}
+    runs-on: ${{ github.repository == 'vectordotdev/vector' && 'ubuntu-24.04-8core' || 'ubuntu-24.04' }}
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.dependencies == 'true' || needs.changes.outputs.test-yml == 'true' }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 358a6f55f1ee7..c91a0dbb2d4ac 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -61,7 +61,7 @@ env:
 jobs:
   tests:
     name: Tests
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: ubuntu-24.04-8core
     permissions:
       contents: read
diff --git a/.github/workflows/unit_windows.yml b/.github/workflows/unit_windows.yml
index 38a81ab5f95fc..abf80f51b0692 100644
--- a/.github/workflows/unit_windows.yml
+++ b/.github/workflows/unit_windows.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   test-windows:
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: windows-2025-8core
     timeout-minutes: 60
     steps:
diff --git a/.github/workflows/warm-cache.yml b/.github/workflows/warm-cache.yml
index ba403460ed0b4..f62dbbf9107a9 100644
--- a/.github/workflows/warm-cache.yml
+++ b/.github/workflows/warm-cache.yml
@@ -25,7 +25,7 @@ concurrency:
 jobs:
   warm:
     name: Warm shared workspace cache
-    if: github.repository_owner == 'vectordotdev'
+    if: github.repository == 'vectordotdev/vector'
     runs-on: ubuntu-24.04-8core
     timeout-minutes: 90
     steps:

From 82a4d899ebaa3a8455080759c3c207fa781ea44e Mon Sep 17 00:00:00 2001
From: Peter Tripp <petertripp@gmail.com>
Date: Thu, 8 Oct 2026 16:21:39 -0400
Subject: [PATCH 3/5] YAML anchors

---
 .github/workflows/deny.yml        |  7 +++++--
 .github/workflows/integration.yml | 13 +++++++------
 .github/workflows/k8s_e2e.yml     | 10 ++++++++--
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index ed90c62663081..538b046ab87e1 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -48,7 +48,10 @@ jobs:
   test-deny:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
+    if: &deny_gate >-
+      always() &&
+      (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') &&
+      (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector')
     needs: [changes]
     steps:
       - name: Checkout branch
@@ -67,7 +70,7 @@ jobs:
   test-deny-licenses:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
+    if: *deny_gate
     needs: [changes]
     steps:
       - name: Checkout branch
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index db2fcc55de478..258d57ec27fb2 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -92,9 +92,12 @@ jobs:
       - changes
       - build-test-runner
 
-    if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) &&
-      github.repository == 'vectordotdev/vector' }}
+    if: &integration_gate >-
+      always() && !failure() && !cancelled() &&
+      needs.build-test-runner.result == 'success' &&
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' ||
+       github.event_name == 'workflow_call' || inputs.run_all == true) &&
+      github.repository == 'vectordotdev/vector'
     strategy:
       fail-fast: false
       matrix:
@@ -210,9 +213,7 @@ jobs:
     needs:
       - changes
       - build-test-runner
-    if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) &&
-      github.repository == 'vectordotdev/vector' }}
+    if: *integration_gate
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index b1c2889f78409..5532364b288fa 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -69,7 +69,13 @@ jobs:
     timeout-minutes: 45
     needs: changes
     # Run this job even if `changes` job is skipped.
-    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
+    if: &run_k8s >-
+      !failure() && !cancelled() &&
+      github.event_name != 'pull_request' &&
+      needs.changes.outputs.website_only != 'true' &&
+      needs.changes.outputs.k8s != 'false' &&
+      (github.event_name != 'schedule' ||
+       github.repository == 'vectordotdev/vector')
     env:
       DISABLE_MOLD: true
     steps:
@@ -106,7 +112,7 @@ jobs:
     timeout-minutes: 5
     needs: changes
     # Run this job even if `changes` job is skipped.
-    if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' && (github.event_name != 'schedule' || github.repository == 'vectordotdev/vector') }}
+    if: *run_k8s
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:

From 6dd3b132c6277791db46b41d2368762d2bddfeb1 Mon Sep 17 00:00:00 2001
From: Peter Tripp <petertripp@gmail.com>
Date: Thu, 8 Oct 2026 17:00:51 -0400
Subject: [PATCH 4/5] Disable changelog / CLA Assistant on forks.

---
 .github/workflows/changelog.yaml | 1 +
 .github/workflows/cla.yml        | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index bfb3cd3f06164..60a2e8df6b5f7 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -21,6 +21,7 @@ permissions:
 
 jobs:
   validate-changelog:
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     permissions:
       contents: read
       pull-requests: none
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 6c02647ef60d6..e505ceb524dfd 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -12,6 +12,8 @@ permissions:
 
 jobs:
   CLAAssistant:
+    # Signatures are stored in DataDog/cla-signatures via an STS token only upstream can obtain.
+    if: ${{ github.repository == 'vectordotdev/vector' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write # Required to comment on PRs

From b4616da07a4a982231be6c37b0ee101a4fda75db Mon Sep 17 00:00:00 2001
From: Peter Tripp <petertripp@gmail.com>
Date: Thu, 8 Oct 2026 17:12:39 -0400
Subject: [PATCH 5/5] Disable failing docs checks; touch src/

---
 .github/workflows/test.yml              | 6 ++++--
 src/sinks/azure_logs_ingestion/tests.rs | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 12722f1f526d5..222200658f004 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -124,7 +124,8 @@ jobs:
   check-docs:
     name: Check Cue docs
     runs-on: ubuntu-24.04
-    if: ${{ needs.changes.outputs.cue == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    # `make generate-vrl-docs` fetches GITHUB_SHA from vectordotdev/vector, which fails on forks.
+    if: ${{ github.repository == 'vectordotdev/vector' && (needs.changes.outputs.cue == 'true' || needs.changes.outputs.test-yml == 'true') }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -152,7 +153,8 @@ jobs:
   check-generated-docs:
     name: Check Generated Docs
     runs-on: ${{ github.repository == 'vectordotdev/vector' && 'ubuntu-24.04-8core' || 'ubuntu-24.04' }}
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.component_docs == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    # `make generate-vrl-docs` fetches GITHUB_SHA from vectordotdev/vector, which fails on forks.
+    if: ${{ github.repository == 'vectordotdev/vector' && (needs.changes.outputs.source == 'true' || needs.changes.outputs.component_docs == 'true' || needs.changes.outputs.test-yml == 'true') }}
     needs: changes
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/src/sinks/azure_logs_ingestion/tests.rs b/src/sinks/azure_logs_ingestion/tests.rs
index 7d81df6d177ce..09be84676824c 100644
--- a/src/sinks/azure_logs_ingestion/tests.rs
+++ b/src/sinks/azure_logs_ingestion/tests.rs
@@ -46,7 +46,7 @@ fn validate_accepts_valid_config() {
 
 #[test]
 fn validate_rejects_invalid_path_segments() {
-    // A space in either path segment makes the request path unparseable, so
+    // A space in either path segment makes the request path unparsable, so
     // validation must fail rather than panicking at build time.
     let config: AzureLogsIngestionConfig = serde_yaml::from_str(indoc::indoc! {r#"
             endpoint: "https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com"