From 0d1db4b8b07d056b06a0edbf1037270d812048d6 Mon Sep 17 00:00:00 2001
From: Benoit Marty <benoit@matrix.org>
Date: Mon, 29 Jun 2026 15:29:59 +0200
Subject: [PATCH 1/3] Get enterprise modules if secret is available instead of
 always skipping on forks.

---
 .github/workflows/build_enterprise.yml |  4 ++--
 .github/workflows/danger.yml           |  3 ++-
 .github/workflows/quality.yml          | 28 +++++++++++++-------------
 .github/workflows/release.yml          |  3 +--
 .github/workflows/tests.yml            |  4 ++--
 5 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/build_enterprise.yml b/.github/workflows/build_enterprise.yml
index c176864b46c..e3a5b3ecdc6 100644
--- a/.github/workflows/build_enterprise.yml
+++ b/.github/workflows/build_enterprise.yml
@@ -18,8 +18,8 @@ jobs:
   build:
     name: Build Enterprise APKs
     runs-on: ubuntu-latest
-    # Skip in forks
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+    # Skip if the enterprise deploy key is not set
+    if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
     strategy:
       matrix:
         variant: [debug, release, nightly]
diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index a8bf7b623a3..1539f2e3b5f 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -15,11 +15,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - run: |
           npm install --save-dev @babel/plugin-transform-flow-strip-types
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index c2bf89a07f8..58796249f0b 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -38,11 +38,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Run code quality check suite
         run: ./tools/check/check_code_quality.sh
@@ -101,11 +101,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -142,11 +142,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -176,11 +176,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -221,11 +221,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -262,11 +262,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -303,11 +303,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: Run docs check
         # This is equivalent to `./gradlew checkDocs`, but we avoid having to install java and gradle
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fee9efb518a..854540fdb9a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,7 +66,7 @@ jobs:
   enterprise:
     name: Create App Bundle Enterprise
     runs-on: ubuntu-latest
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+    if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
     concurrency:
       group: ${{ format('build-release-main-enterprise-{0}', github.sha) }}
       cancel-in-progress: true
@@ -76,7 +76,6 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5466bc80af2..efb4a77ec0e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -56,11 +56,11 @@ jobs:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
+        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
         run: git submodule update --init --recursive
       - name: ☕️ Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0

From da85c5f9a851f51359fd8d996ba9c013aca5686f Mon Sep 17 00:00:00 2001
From: Benoit Marty <benoit@matrix.org>
Date: Wed, 1 Jul 2026 11:58:50 +0200
Subject: [PATCH 2/3] Fix the if statement.

As per the doc https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#using-secrets-in-a-workflow says: `Secrets cannot be directly referenced in if: conditionals`
---
 .github/workflows/build_enterprise.yml | 11 ++++++-
 .github/workflows/danger.yml           | 13 +++++++--
 .github/workflows/quality.yml          | 40 +++++++++++++++++---------
 .github/workflows/release.yml          | 11 ++++++-
 .github/workflows/tests.yml            | 14 +++++++--
 5 files changed, 68 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/build_enterprise.yml b/.github/workflows/build_enterprise.yml
index e3a5b3ecdc6..5169ea30bbb 100644
--- a/.github/workflows/build_enterprise.yml
+++ b/.github/workflows/build_enterprise.yml
@@ -15,11 +15,20 @@ env:
   CI_GRADLE_ARG_PROPERTIES: --stacktrace -Dsonar.gradle.skipCompile=true --no-configuration-cache
 
 jobs:
+  check-secret:
+    name: Check Enterprise Deploy Key
+    runs-on: ubuntu-latest
+    outputs:
+      has_key: ${{ steps.check.outputs.has_key }}
+    steps:
+      - id: check
+        run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT
   build:
     name: Build Enterprise APKs
     runs-on: ubuntu-latest
+    needs: check-secret
     # Skip if the enterprise deploy key is not set
-    if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+    if: needs.check-secret.outputs.has_key == 'true'
     strategy:
       matrix:
         variant: [debug, release, nightly]
diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index 1539f2e3b5f..394febca5f5 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -5,9 +5,18 @@ on: [pull_request, merge_group]
 permissions: {}
 
 jobs:
+  check-secret:
+    name: Check Enterprise Deploy Key
+    runs-on: ubuntu-latest
+    outputs:
+      has_key: ${{ steps.check.outputs.has_key }}
+    steps:
+      - id: check
+        run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT
   build:
     runs-on: ubuntu-latest
     name: Danger main check
+    needs: check-secret
     # Skip in forks, it doesn't work even with the fallback token
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
     steps:
@@ -15,12 +24,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: ${{ needs.check-secret.outputs.has_key == 'true' }}
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: ${{ needs.check-secret.outputs.has_key == 'true' }}
         run: git submodule update --init --recursive
       - run: |
           npm install --save-dev @babel/plugin-transform-flow-strip-types
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 58796249f0b..ca22f567c26 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -15,9 +15,18 @@ env:
   CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
 
 jobs:
+  check-secret:
+    name: Check Enterprise Deploy Key
+    runs-on: ubuntu-latest
+    outputs:
+      has_key: ${{ steps.check.outputs.has_key }}
+    steps:
+      - id: check
+        run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT
   checkScript:
     name: Search for forbidden patterns
     runs-on: ubuntu-latest
+    needs: check-secret
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
@@ -38,11 +47,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Run code quality check suite
         run: ./tools/check/check_code_quality.sh
@@ -88,6 +97,7 @@ jobs:
   konsist:
     name: Konsist tests
     runs-on: ubuntu-latest
+    needs: check-secret
     # Allow all jobs on main and develop. Just one per PR.
     concurrency:
       group: ${{ github.ref == 'refs/heads/main' && format('check-konsist-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-konsist-develop-{0}', github.sha) || format('check-konsist-{0}', github.ref) }}
@@ -101,11 +111,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -129,6 +139,7 @@ jobs:
   compose:
     name: Compose tests
     runs-on: ubuntu-latest
+    needs: check-secret
     # Allow all jobs on main and develop. Just one per PR.
     concurrency:
       group: ${{ github.ref == 'refs/heads/main' && format('check-compose-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-compose-develop-{0}', github.sha) || format('check-compose-{0}', github.ref) }}
@@ -142,11 +153,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -163,6 +174,7 @@ jobs:
   lint:
     name: Android lint check
     runs-on: ubuntu-latest
+    needs: check-secret
     # Allow all jobs on main and develop. Just one per PR.
     concurrency:
       group: ${{ github.ref == 'refs/heads/main' && format('check-lint-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-lint-develop-{0}', github.sha) || format('check-lint-{0}', github.ref) }}
@@ -176,11 +188,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -221,11 +233,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -262,11 +274,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
@@ -303,11 +315,11 @@ jobs:
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: needs.check-secret.outputs.has_key == 'true'
         run: git submodule update --init --recursive
       - name: Run docs check
         # This is equivalent to `./gradlew checkDocs`, but we avoid having to install java and gradle
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 854540fdb9a..8d58b2fbb83 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,14 @@ env:
   CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
 
 jobs:
+  check-secret:
+    name: Check Enterprise Deploy Key
+    runs-on: ubuntu-latest
+    outputs:
+      has_key: ${{ steps.check.outputs.has_key }}
+    steps:
+      - id: check
+        run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT
   gplay:
     name: Create App Bundle (Gplay)
     runs-on: ubuntu-latest
@@ -66,7 +74,8 @@ jobs:
   enterprise:
     name: Create App Bundle Enterprise
     runs-on: ubuntu-latest
-    if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+    needs: check-secret
+    if: needs.check-secret.outputs.has_key == 'true'
     concurrency:
       group: ${{ format('build-release-main-enterprise-{0}', github.sha) }}
       cancel-in-progress: true
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index efb4a77ec0e..adb2746c58c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,10 +15,18 @@ env:
   CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
 
 jobs:
+  check-secret:
+    name: Check Enterprise Deploy Key
+    runs-on: ubuntu-latest
+    outputs:
+      has_key: ${{ steps.check.outputs.has_key }}
+    steps:
+      - id: check
+        run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT
   tests:
     name: Runs unit tests
     runs-on: ubuntu-latest
-
+    needs: check-secret
     # Allow all jobs on main and develop. Just one per PR.
     concurrency:
       group: ${{ github.ref == 'refs/heads/main' && format('unit-tests-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('unit-tests-develop-{0}', github.sha) || format('unit-tests-{0}', github.ref) }}
@@ -56,11 +64,11 @@ jobs:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: ${{ needs.check-secret.outputs.has_key == 'true' }}
         with:
           ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }}
       - name: Clone submodules
-        if: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}
+        if: ${{ needs.check-secret.outputs.has_key == 'true' }}
         run: git submodule update --init --recursive
       - name: ☕️ Use JDK 21
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0

From 34a233d4de4632b803f28c594e1f3f7b807d7d40 Mon Sep 17 00:00:00 2001
From: Benoit Marty <benoit@matrix.org>
Date: Mon, 6 Jul 2026 16:36:58 +0200
Subject: [PATCH 3/3] Use workflow_run trigger to allow fork PRs to build the
 enterprise APK.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build_enterprise.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build_enterprise.yml b/.github/workflows/build_enterprise.yml
index 5169ea30bbb..c760647f0a3 100644
--- a/.github/workflows/build_enterprise.yml
+++ b/.github/workflows/build_enterprise.yml
@@ -2,7 +2,9 @@ name: Enterprise APK Build
 
 on:
   workflow_dispatch:
-  pull_request:
+  workflow_run:
+    workflows: ["APK Build"]
+    types: [completed]
   merge_group:
   push:
     branches: [ develop ]
@@ -27,15 +29,19 @@ jobs:
     name: Build Enterprise APKs
     runs-on: ubuntu-latest
     needs: check-secret
-    # Skip if the enterprise deploy key is not set
-    if: needs.check-secret.outputs.has_key == 'true'
+    # Skip if the enterprise deploy key is not set, or if triggered via workflow_run but not from a PR or a failed run
+    if: >
+      needs.check-secret.outputs.has_key == 'true' &&
+      (github.event_name != 'workflow_run' ||
+       (github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'pull_request'))
     strategy:
       matrix:
         variant: [debug, release, nightly]
       fail-fast: false
     # Allow all jobs on develop. Just one per PR.
     concurrency:
-      group: ${{ github.ref == 'refs/heads/develop' && format('build-develop-enterprise-{0}-{1}', matrix.variant, github.sha) || format('build-enterprise-{0}-{1}', matrix.variant, github.ref)  }}
+      group: ${{ github.ref == 'refs/heads/develop' && format('build-develop-enterprise-{0}-{1}', matrix.variant, github.sha) || github.event_name == 'workflow_run' && format('build-enterprise-{0}-{1}', matrix.variant, github.event.workflow_run.head_sha) || format('build-enterprise-{0}-{1}', matrix.variant, github.ref) }}
       cancel-in-progress: true
     steps:
       - name: Free Disk Space (Ubuntu)
@@ -56,7 +62,7 @@ jobs:
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
           persist-credentials: false
       - name: Add SSH private keys for submodule repositories
         uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0