feat: enforce organization caller restriction for reusable workflows

.github/workflows/e2e-action-commit-push.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   basic-commit:
     name: Basic commit and push to new branch
     needs: [preflight]

.github/workflows/e2e-action-container-structure-test.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   text-output:
     name: Basic test with text output format
     needs: [preflight]

.github/workflows/e2e-action-format-hcl.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   format-check-clean-files:
     name: Check mode on already-formatted files passes
     needs: [preflight]

.github/workflows/e2e-action-pull-request.yml

@@ -49,6 +49,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   basic-pull-request:
     name: Basic pull request creation
     needs: [preflight]

.github/workflows/e2e-action-template-action.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   template-action-input-output:
     name: Validate template-action input/output contract
     needs: [preflight]

.github/workflows/e2e-action-terraform-copy-vars.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   basic-copy-vars:
     name: Copy variables from central file to modules
     needs: [preflight]

.github/workflows/e2e-action-terraform-validate.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   validate-basic:
     name: Validate valid Terraform configuration
     needs: [preflight]

.github/workflows/e2e-action-tflint.yml

@@ -47,6 +47,14 @@ jobs:
               ;;
           esac
 
+      - name: Enforce organization caller for reusable workflow
+        if: ${{ github.event_name == 'workflow_call' }}
+        run: |
+          if [ "${{ github.repository_owner }}" != "devops-infra" ]; then
+            echo "This reusable workflow can only be called by devops-infra repositories."
+            exit 1
+          fi
+
   basic-tflint:
     name: Basic TFLint on valid Terraform files
     needs: [preflight]