From 8f9ebc3136c549f8c09121cb15a8d35fc78e4ef2 Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 17 Oct 2026 04:07:06 +0000
Subject: [PATCH] CI: release only with git dependencies from storytold

---
 .github/workflows/release.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bfdca9e3e9..4666f5a851 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,21 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  git-sources:
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check Cargo.lock
+        run: |
+          if grep -E '^source = "git\+' Cargo.lock | grep -v '"git+https://github.com/storytold/'; then
+            echo "Cargo.lock has a git dependency outside github.com/storytold"; exit 1
+          fi
+
   release:
+    needs: git-sources
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with: