From 0b7537d7b001709989b82461ce637e6b67a7fca6 Mon Sep 17 00:00:00 2001
From: w1am <33353798+w1am@users.noreply.github.com>
Date: Wed, 12 Aug 2026 10:52:03 +0400
Subject: [PATCH 1/4] Fix CI workflows for pull requests from forks

---
 .github/workflows/load-configuration.yml | 42 +++++++++++++++++-------
 .github/workflows/main.yml               | 26 ++++++++++++---
 .github/workflows/qa.yml                 |  1 +
 .github/workflows/tests.yml              |  3 ++
 4 files changed, 56 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/load-configuration.yml b/.github/workflows/load-configuration.yml
index 67ef6464..f2b8604a 100644
--- a/.github/workflows/load-configuration.yml
+++ b/.github/workflows/load-configuration.yml
@@ -50,17 +50,35 @@ jobs:
     steps:
       - name: Set KurrentDB Runtime Configuration Properties
         id: set
+        env:
+          RUNTIME: ${{ inputs.runtime }}
+          REGISTRY: ${{ inputs.registry }}
+          IMAGE: ${{ inputs.image }}
+          TAG: ${{ inputs.tag }}
+          IMAGES: ${{ vars.KURRENTDB_DOCKER_IMAGES }}
         run: |
-          case ${{ inputs.runtime }} in
-            "qa")
-              echo "registry=${{ inputs.registry }}" >> $GITHUB_OUTPUT
-              echo "image=${{ inputs.image }}" >> $GITHUB_OUTPUT
-              echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
-            ;;
+          if [ "$RUNTIME" = "qa" ]; then
+            {
+              echo "registry=$REGISTRY"
+              echo "image=$IMAGE"
+              echo "tag=$TAG"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
 
-            *)
-              echo "registry=${{ fromJSON(vars.KURRENTDB_DOCKER_IMAGES)[inputs.runtime].registry }}" >> $GITHUB_OUTPUT
-              echo "image=${{ fromJSON(vars.KURRENTDB_DOCKER_IMAGES)[inputs.runtime].image }}" >> $GITHUB_OUTPUT
-              echo "tag=${{ fromJSON(vars.KURRENTDB_DOCKER_IMAGES)[inputs.runtime].tag }}" >> $GITHUB_OUTPUT
-            ;;
-          esac
+          # vars are not passed to runs triggered from forks, fall back to the
+          # anonymously pullable lts image so outside PRs can still run tests.
+          if [ -z "$IMAGES" ]; then
+            IMAGES='{"lts":{"registry":"docker.kurrent.io/eventstore","image":"eventstoredb-ee","tag":"lts"}}'
+          fi
+
+          CONFIG=$(jq -ce --arg runtime "$RUNTIME" '.[$runtime]' <<< "$IMAGES") || {
+            echo "No image configuration for runtime '$RUNTIME'" >&2
+            exit 1
+          }
+
+          {
+            echo "registry=$(jq -r '.registry' <<< "$CONFIG")"
+            echo "image=$(jq -r '.image' <<< "$CONFIG")"
+            echo "tag=$(jq -r '.tag' <<< "$CONFIG")"
+          } >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d7b9116a..a54e5a85 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,7 +5,7 @@ on:
       - "**.md"
   push:
     branches:
-      - main
+      - master
   schedule:
     - cron: "0 3 * * 0" # Every sunday at 3am UTC.
 
@@ -45,7 +45,7 @@ jobs:
     name: Code quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Corepack
         run: corepack enable
@@ -64,13 +64,31 @@ jobs:
           git update-index --refresh
           git diff-index --exit-code --name-status HEAD --
 
+  select_runtimes:
+    name: Select runtimes
+    runs-on: ubuntu-latest
+    outputs:
+      runtimes: ${{ steps.set.outputs.runtimes }}
+    env:
+      # Secrets are not passed to runs from forks or dependabot. Without them,
+      # only the anonymously pullable lts image can be tested.
+      SECRETS_AVAILABLE: ${{ secrets.CLOUDSMITH_CICD_USER != '' }}
+    steps:
+      - id: set
+        run: |
+          if [ "$SECRETS_AVAILABLE" = "true" ]; then
+            echo 'runtimes=["previous-lts", "lts", "ci"]' >> "$GITHUB_OUTPUT"
+          else
+            echo 'runtimes=["lts"]' >> "$GITHUB_OUTPUT"
+          fi
+
   tests:
-    needs: validation
+    needs: [validation, select_runtimes]
 
     strategy:
       fail-fast: false
       matrix:
-        runtime: [previous-lts, lts, ci]
+        runtime: ${{ fromJSON(needs.select_runtimes.outputs.runtimes) }}
 
     name: Tests
     uses: ./.github/workflows/tests.yml
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index 948573b1..83271c52 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -26,3 +26,4 @@ jobs:
       registry: ${{ inputs.registry }}
       image: ${{ inputs.image }}
       tag: ${{ inputs.tag }}
+    secrets: inherit
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 962d0305..37bfb6b8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -61,10 +61,13 @@ jobs:
             path: ./src/opentelemetry
 
     runs-on: ubuntu-latest
+    env:
+      SECRETS_AVAILABLE: ${{ secrets.CLOUDSMITH_CICD_USER != '' }}
     steps:
       - uses: actions/checkout@v4
 
       - name: Login to Cloudsmith
+        if: env.SECRETS_AVAILABLE == 'true'
         uses: docker/login-action@v3
         with:
           registry: ${{ needs.load_configuration.outputs.registry }}

From e7e52460878adead16a3a97ca2d03811aa83a1c5 Mon Sep 17 00:00:00 2001
From: w1am <33353798+w1am@users.noreply.github.com>
Date: Wed, 12 Aug 2026 11:05:15 +0400
Subject: [PATCH 2/4] Remove dead plugins job from main workflow

---
 .github/workflows/main.yml | 49 --------------------------------------
 1 file changed, 49 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a54e5a85..1f8277c7 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -95,52 +95,3 @@ jobs:
     with:
       runtime: ${{ matrix.runtime }}
     secrets: inherit
-
-  plugins:
-    needs: tests
-    if: false
-    name: "${{ matrix.group.name }}"
-    strategy:
-      fail-fast: false
-      matrix:
-        group:
-          - name: plugins
-            path: ./src/plugins
-    env:
-      # GitHub only passes secrets to the main repo, so we need to skip some things if they are unavailable
-      SECRETS_AVAILABLE: ${{ secrets.EVENTSTORE_CLOUD_ID != null }}
-      KURRENT_VERSION: "24.2.0-jammy"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: .github/files/.nvmrc
-
-      - name: NodeJS version
-        run: node -v
-
-      - name: Corepack
-        run: corepack enable
-
-      - name: Login to Cloudsmith
-        uses: docker/login-action@v3
-        with:
-          registry: docker.eventstore.com
-          username: ${{ secrets.CLOUDSMITH_CICD_USER }}
-          password: ${{ secrets.CLOUDSMITH_CICD_TOKEN }}
-
-      - name: Install
-        run: yarn
-
-      - name: Corepack
-        run: corepack enable
-
-      - name: Build
-        run: yarn build
-
-      - name: Run Tests
-        run: yarn test ${{ matrix.group.path }} --ci --run-in-band --forceExit
-        env:
-          KURRENT_IMAGE: "docker.eventstore.com/eventstore-ee/eventstoredb-commercial:${{ env.KURRENT_VERSION }}"

From 0a8df3a17b1a41e8616257cfa33cc5c1433ef6ff Mon Sep 17 00:00:00 2001
From: w1am <33353798+w1am@users.noreply.github.com>
Date: Wed, 12 Aug 2026 11:13:10 +0400
Subject: [PATCH 3/4] Fix image fallback to key on secrets availability, not
 vars

---
 .github/workflows/load-configuration.yml | 8 +++++---
 .github/workflows/tests.yml              | 1 +
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/load-configuration.yml b/.github/workflows/load-configuration.yml
index f2b8604a..c5734015 100644
--- a/.github/workflows/load-configuration.yml
+++ b/.github/workflows/load-configuration.yml
@@ -56,6 +56,7 @@ jobs:
           IMAGE: ${{ inputs.image }}
           TAG: ${{ inputs.tag }}
           IMAGES: ${{ vars.KURRENTDB_DOCKER_IMAGES }}
+          SECRETS_AVAILABLE: ${{ secrets.CLOUDSMITH_CICD_USER != '' }}
         run: |
           if [ "$RUNTIME" = "qa" ]; then
             {
@@ -66,9 +67,10 @@ jobs:
             exit 0
           fi
 
-          # vars are not passed to runs triggered from forks, fall back to the
-          # anonymously pullable lts image so outside PRs can still run tests.
-          if [ -z "$IMAGES" ]; then
+          # Runs without registry credentials must use the anonymously pullable
+          # lts image: forks get neither vars nor secrets, dependabot gets vars
+          # but not secrets, so key the fallback on secrets, not on vars.
+          if [ "$SECRETS_AVAILABLE" != "true" ] || [ -z "$IMAGES" ]; then
             IMAGES='{"lts":{"registry":"docker.kurrent.io/eventstore","image":"eventstoredb-ee","tag":"lts"}}'
           fi
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 37bfb6b8..eb557c00 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,6 +30,7 @@ jobs:
       registry: ${{ inputs.registry }}
       image: ${{ inputs.image }}
       tag: ${{ inputs.tag }}
+    secrets: inherit
 
   test:
     needs: load_configuration

From c77c0b94211188c99c1a9e24f448eecd7c74e35e Mon Sep 17 00:00:00 2001
From: w1am <33353798+w1am@users.noreply.github.com>
Date: Wed, 12 Aug 2026 11:14:27 +0400
Subject: [PATCH 4/4] Use public kurrentplatform/kurrentdb image for
 no-credential runs

---
 .github/workflows/load-configuration.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/load-configuration.yml b/.github/workflows/load-configuration.yml
index c5734015..0b2b4083 100644
--- a/.github/workflows/load-configuration.yml
+++ b/.github/workflows/load-configuration.yml
@@ -71,7 +71,7 @@ jobs:
           # lts image: forks get neither vars nor secrets, dependabot gets vars
           # but not secrets, so key the fallback on secrets, not on vars.
           if [ "$SECRETS_AVAILABLE" != "true" ] || [ -z "$IMAGES" ]; then
-            IMAGES='{"lts":{"registry":"docker.kurrent.io/eventstore","image":"eventstoredb-ee","tag":"lts"}}'
+            IMAGES='{"lts":{"registry":"docker.io/kurrentplatform","image":"kurrentdb","tag":"lts"}}'
           fi
 
           CONFIG=$(jq -ce --arg runtime "$RUNTIME" '.[$runtime]' <<< "$IMAGES") || {