ci(preview-readme): skip fork PRs to fix checkout failure - #30
Merged
Conversation
The preview-readme job checks out the head branch by name (ref: github.event.pull_request.head.ref) without setting repository, so actions/checkout fetches refs/heads/<branch> from this repo. For a fork PR the branch lives only in the fork, so the fetch finds no ref and the step fails with 'git failed with exit code 1' (seen on PR #28, from gaul/s3proxy-chart). Every other workflow uses the default merge-ref checkout and is unaffected. Even with checkout fixed, the comment-posting steps need a write-scoped GITHUB_TOKEN, which the pull_request event does not grant fork PRs, so the preview feature is inherently limited to same-repo branches. Guard the job on head.repo.full_name == github.repository: internal branches still get the README preview; fork PRs skip it cleanly instead of reporting a spurious failure.
📊 Helm Render Diff SummaryChart
🎉 No changes detected in any of the tested configurations! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
preview-readmecheck failed on #28 (a fork PR fromgaul/s3proxy-chart). Theactions/checkoutstep failed with:Root cause: the job checks out the head branch by name but does not set
repository:repositorytherefore defaults to this repo (comet-ml/s3proxy-chart), so checkout tries to fetchrefs/heads/<branch>from here. On a fork PR the branch lives only in the fork, so the fetch finds no ref and fails. Every other workflow uses the default merge-ref checkout (refs/pull/N/merge, which GitHub materializes in the base repo for forks too), so they were unaffected.There is also a second, latent limitation: even with checkout fixed, the comment-posting steps call
issues.createCommentwithGITHUB_TOKEN, which thepull_requestevent grants fork PRs as read-only, so the preview comment cannot be posted from a fork PR anyway.Fix
Guard the job on head/base repo identity:
Same-repo (internal) branches still get the README preview comment; fork PRs skip the job cleanly instead of reporting a spurious red check. This is the minimal, no-security-tradeoff option. Full fork support would need a
workflow_runtwo-stage pattern (render onpull_requestwith a read-only token + artifact upload; comment onworkflow_runwith a write token), which can follow separately if we want previews on external contributions.Validation
python3 -c "import yaml; yaml.safe_load(...)"on the workflow: OK.if:plus an explanatory comment); no step logic changed.