Skip PR artifact comment job on fork PRs - #134
Merged
peterjaap merged 1 commit intoAug 7, 2026
Merged
Conversation
The comment-artifacts job requests pull-requests: write, but GitHub caps GITHUB_TOKEN to read-only for pull_request runs originating from a fork. Posting the comment therefore fails with 403 'Resource not accessible by integration', marking the whole run as failed even when every build, test and lint job passed. This has broken every fork PR since 1fe4817 added the job (qoliber#128, qoliber#133, and external contributions such as qoliber#123). PRs from branches in this repository are unaffected and keep their artifact comment. Gate the job on the PR originating from this repository instead of merely being a pull_request. On push events github.event.pull_request is null, so the job is still skipped there, matching the previous guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Comment PR with artifact linksjob fails on every PR from a fork with403 Resource not accessible by integration. It asks forpull-requests: write, but GitHub capsGITHUB_TOKENto read-only forpull_requestruns from a fork — requesting the permission cannot override that. The run goes red even though all builds, tests and lint pass.It's not flaky: always fails for fork PRs, never for PRs from branches in this repo. Since most PRs here come from
qoliberbranches, it just looks intermittent. Introduced in 1fe4817 — #111 was green from a fork the day before; #123 (external contributor), #128 and #133 all failed on this job since.The fix gates the job on the PR coming from this repo:
On
pusheventsgithub.event.pull_requestis null, so the job is still skipped — this covers the oldgithub.event_name == 'pull_request'guard.This PR is itself from a fork, so green CI here is the proof it works.
Trade-off: fork PRs lose the artifact-links comment (today they never get it anyway). The real fix is a
workflow_runtrigger, which runs with a writable token — left out because it only takes effect after merge and can't demonstrate itself in a PR. Happy to open that separately.