From ad09637a7ed6ff7b5885f43c1516077be9e636ca Mon Sep 17 00:00:00 2001 From: Akif Gumussu Date: Fri, 7 Aug 2026 12:25:42 +0200 Subject: [PATCH] Skip PR artifact comment on fork PRs The comment-artifacts job requests pull-requests: write, but GitHub caps GITHUB_TOKEN to read-only for pull_request runs originating from a fork. Posting the comment therefore fails with 403 'Resource not accessible by integration', marking the whole run as failed even when every build, test and lint job passed. This has broken every fork PR since 1fe4817 added the job (#128, #133, and external contributions such as #123). PRs from branches in this repository are unaffected and keep their artifact comment. Gate the job on the PR originating from this repository instead of merely being a pull_request. On push events github.event.pull_request is null, so the job is still skipped there, matching the previous guard. --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 52c0278..5a694ff 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -103,7 +103,8 @@ jobs: comment-artifacts: name: Comment PR with artifact links needs: build - if: github.event_name == 'pull_request' + # Skip on fork PRs: GITHUB_TOKEN is read-only there, so commenting always 403s. + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest permissions: pull-requests: write