From 533f7af822249760d77ddcd6cd6116e923e8d941 Mon Sep 17 00:00:00 2001 From: Dmitrii Fedorov Date: Wed, 16 Sep 2026 14:50:35 +0700 Subject: [PATCH] ci: skip secret-bound bot workflows on fork pull requests Three workflows depend on repository secrets (PROJECT_TOKEN, CLAUDE_CODE_OAUTH_TOKEN) that GitHub withholds on pull_request events from forks, so every fork PR has been collecting red checks that can never pass: add-to-project ("Input required and not supplied: github-token"), pr-opened ("set the GH_TOKEN environment variable") and claude-review (empty claude_code_oauth_token). Each job now skips when the PR head repository is not this repository; same-repo PRs and issue events are unchanged. The branch also archived .github/workflows/dev-enforcement.yml, which had not parsed since #357. That part is dropped: #1054 rewrote the file on main, it parses, and its pr-status job already carries continue-on-error for fork pull requests. Only the three guards remain. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/claude-code-review.yml | 4 ++++ .github/workflows/project-auto-add.yml | 4 ++++ .github/workflows/project-auto-status.yml | 5 +++-- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index fc9448bceb..cadffd65a3 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -12,6 +12,10 @@ on: jobs: claude-review: + # CLAUDE_CODE_OAUTH_TOKEN is a repository secret, and secrets are withheld on + # pull_request events from forks, so the action started with an empty token + # and failed on every fork PR. Skip fork PRs; same-repo PRs still get reviewed. + if: github.event.pull_request.head.repo.full_name == github.repository # Optional: Filter by PR author # if: | # github.event.pull_request.user.login == 'external-contributor' || diff --git a/.github/workflows/project-auto-add.yml b/.github/workflows/project-auto-add.yml index 4c82f26d9b..debcce4074 100644 --- a/.github/workflows/project-auto-add.yml +++ b/.github/workflows/project-auto-add.yml @@ -13,6 +13,10 @@ on: jobs: add-to-project: + # Pull requests from forks run without repository secrets, so PROJECT_TOKEN is + # empty there and the action fails with "Input required and not supplied: + # github-token". Skip those runs instead of failing them. + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: actions/add-to-project@v1.0.2 diff --git a/.github/workflows/project-auto-status.yml b/.github/workflows/project-auto-status.yml index ea0ab1922e..e9ad8ea75f 100644 --- a/.github/workflows/project-auto-status.yml +++ b/.github/workflows/project-auto-status.yml @@ -70,7 +70,8 @@ jobs: # When a PR is opened → set "In review" pr-opened: - if: github.event_name == 'pull_request' && github.event.action == 'opened' + # Fork PRs have no PROJECT_TOKEN (secrets are withheld on pull_request from forks). + if: github.event_name == 'pull_request' && github.event.action == 'opened' && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - name: Get project item ID @@ -115,7 +116,7 @@ jobs: # When a PR is merged → set PR + linked issues to "Done" pr-merged: - if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged == true + if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - name: Move PR to Done