fix(ci): restrict Docker publishing to the OSS repository

[NathanFlurry]

• Restrict Docker image publishing, manifest creation, and release retagging to the OSS repository's immutable GitHub ID.
• Prevent copied workflows in other repositories from logging in to or pushing images to Docker Hub.

[railway-app]

🚅 Deployed to the actors-pr-5690 environment in rivet-frontend

Service	Status	Web	Updated
kitchen-sink	😴 Sleeping (View Logs)	Web	Sep 10, 2026 at 1:06 am UTC
frontend-inspector	😴 Sleeping (View Logs)	Web	Sep 10, 2026 at 1:06 am UTC
frontend-cloud	😴 Sleeping (View Logs)	Web	Sep 10, 2026 at 1:04 am UTC
ladle	✅ Success (View Logs)	Web	Sep 10, 2026 at 12:57 am UTC
mcp-hub	✅ Success (View Logs)	Web	Sep 10, 2026 at 12:57 am UTC
website	❌ Build Failed (View Logs)	Web	Sep 10, 2026 at 12:57 am UTC

[the-company-company]

✅ No issues found

_{Reviewed commit 16abe7a.}

[claude]

Review

Verified 654560183 against gh api repos/rivet-dev/actors — it matches this repo's actual immutable ID, so the gate is correctly targeted.

Correctness

• Coverage looks complete: all four Docker-touching points are gated — the docker-images job itself, its docker-setup (login) step, the publish job's own docker-setup step, the manifest-creation step, and the retag step.
• The publish job treats needs.docker-images.result == 'skipped' as acceptable, so non-OSS runs correctly fall through to a docker-less publish rather than failing the whole workflow.
• Using github.repository_id (immutable, survives renames) rather than github.repository (a renamable string) is the right choice for this kind of gate.

Minor / non-blocking

• The literal 654560183 is duplicated across 4 conditions with no named reference. A repo-level Actions variable (vars.OSS_REPOSITORY_ID) would let the four if:s read vars.OSS_REPOSITORY_ID instead of a bare magic number (job-level if: supports vars but not workflow env, so a plain top-level env: entry like DEPOT_PROJECT_ID above can't be reused here as-is). Not required — the explanatory comment on the first occurrence is enough to keep this readable.
• Scope check: this only restricts Docker Hub publishing, per the stated goal. Other steps with real credentials later in the same publish job (R2 upload, crates.io publish) aren't restricted by repository ID. That's likely fine since npm's trusted publishing and crates.io tokens have their own scoping/OIDC bindings Docker Hub username/password auth lacks, but worth confirming that's the actual reasoning rather than an oversight.

Testing

• This is CI config with no automated test surface; the change is inherently only verifiable by observing a real workflow run in a non-OSS-ID context (fork or copy) and confirming the Docker jobs/steps skip. Nothing further to add given the nature of the change.

Overall a small, well-targeted fix — approve.