From 50ad5de4234b5c2d80b4f858ceebf5ab758a636b Mon Sep 17 00:00:00 2001
From: Samuel Newman <mozzius@protonmail.com>
Date: Thu, 23 Jul 2026 16:41:51 +0300
Subject: [PATCH] eas: trust baselines from main only

---
 .github/workflows/bundle-deploy-eas-update.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bundle-deploy-eas-update.yml b/.github/workflows/bundle-deploy-eas-update.yml
index ec18974d64..adecff5d95 100644
--- a/.github/workflows/bundle-deploy-eas-update.yml
+++ b/.github/workflows/bundle-deploy-eas-update.yml
@@ -108,10 +108,15 @@ jobs:
         if: ${{ (inputs.channel || 'testflight') == 'testflight' }}
         env:
           GH_TOKEN: ${{ github.token }}
+          REPOSITORY_ID: ${{ github.repository_id }}
         run: |
           url=$(gh api \
             "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=testflight-native-fingerprint&per_page=100" \
-            --jq 'first(.artifacts[] | select(.expired == false)) | .archive_download_url' \
+            --jq "[.artifacts[] | select(
+              .expired == false and
+              .workflow_run.head_branch == \"main\" and
+              .workflow_run.head_repository_id == (\$ENV.REPOSITORY_ID | tonumber)
+            )] | max_by(.created_at) | .archive_download_url" \
             2>/dev/null || true)
 
           if [ -n "$url" ] && [ "$url" != "null" ]; then
@@ -131,7 +136,7 @@ jobs:
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@594f8b014440e76aa4e12cc0110d602fe3b5c348 # v0.3.0
+        uses: bluesky-social/github-actions/fingerprint-native@dbb7ac9d2fed7cafc8488ba707d315b3fb3ea431 # v0.3.0
         with:
           profile: ${{ inputs.channel || 'testflight' }}
           previous-commit-tag: ${{ inputs.runtimeVersion }}