From b3805534d613f309a3d0d06b88bdd86d31fbc8f5 Mon Sep 17 00:00:00 2001
From: Ammar Ahmed <ammarahmed6506@gmail.com>
Date: Tue, 21 Jul 2026 12:35:08 +0500
Subject: [PATCH] ci: remove authorize step in android/ios preview builds

---
 .github/workflows/android.preview.build.yml | 17 ++--------------
 .github/workflows/ios.preview.build.yml     | 22 +++------------------
 2 files changed, 5 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/android.preview.build.yml b/.github/workflows/android.preview.build.yml
index 8723f6f4d..31af497d9 100644
--- a/.github/workflows/android.preview.build.yml
+++ b/.github/workflows/android.preview.build.yml
@@ -5,10 +5,8 @@ name: Notesnook Android Preview Build
 # APK is built without any signing secret (the same as before). Firebase
 # distribution and the PR comment happen in android.preview.publish.yml, which
 # runs in the trusted `workflow_run` context and never executes fork code.
-#
-# The `authorize` gate is resource/abuse control only (secrets are not exposed
-# here): whitelisted authors run automatically; everyone else waits on the
-# `external` environment's manual approval.
+# Because no secrets are exposed here, the build runs automatically for every
+# PR (including forks) with no authorization gate.
 
 on:
   pull_request:
@@ -25,18 +23,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  authorize:
-    environment: ${{ (
-      github.event.pull_request.head.repo.full_name == github.repository ||
-      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association) ||
-      contains(fromJSON('["streetwriters","ammarahm-ed"]'), github.event.pull_request.head.repo.owner.login)
-      ) && 'internal' || 'external' }}
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "authorized"
-
   build:
-    needs: authorize
     runs-on: ubuntu-22.04
     env:
       STAGING_BUILD: true
diff --git a/.github/workflows/ios.preview.build.yml b/.github/workflows/ios.preview.build.yml
index a0d456e98..4228b5a63 100644
--- a/.github/workflows/ios.preview.build.yml
+++ b/.github/workflows/ios.preview.build.yml
@@ -4,11 +4,9 @@ name: Notesnook iOS Preview Build
 # compiled with a read-only GITHUB_TOKEN and NO repository secrets. It only
 # produces an *unsigned* archive. Signing, Firebase distribution and PR
 # comments happen in ios.preview.publish.yml, which runs in the trusted
-# `workflow_run` context and never executes fork code.
-#
-# The `authorize` gate is resource/abuse control only (secrets are not exposed
-# here): whitelisted authors run automatically; everyone else waits on the
-# `external` environment's manual approval.
+# `workflow_run` context and never executes fork code. Because no secrets are
+# exposed here, the build runs automatically for every PR (including forks)
+# with no authorization gate.
 
 on:
   pull_request:
@@ -26,21 +24,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  authorize:
-    # `internal` has no protection rules (auto-passes); `external` requires
-    # manual reviewer approval. Whitelist = same-repo branch OR trusted role
-    # OR explicitly allowlisted org/account.
-    environment: ${{ (
-      github.event.pull_request.head.repo.full_name == github.repository ||
-      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association) ||
-      contains(fromJSON('["streetwriters","ammarahm-ed"]'), github.event.pull_request.head.repo.owner.login)
-      ) && 'internal' || 'external' }}
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "authorized"
-
   build:
-    needs: authorize
     runs-on: macos-26
     timeout-minutes: 60