fork-live-gate.yml

name: Fork Live Gate

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  issues: read
  pull-requests: read

jobs:
  fork-live-gate:
    runs-on: ubuntu-latest
    steps:
      - name: Validate fork live approval marker
        uses: actions/github-script@v7
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) {
              core.setFailed("Missing pull request context.");
              return;
            }

            if (!pr.head.repo?.fork) {
              core.info("Internal PR detected; fork live gate is not required.");
              return;
            }

            const marker = `fork-external-live-pass:${pr.head.sha}`;
            const comments = await github.paginate(
              github.rest.issues.listComments,
              {
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: pr.number,
                per_page: 100,
              }
            );

            const approval = comments.find((comment) => {
              return (
                comment.user?.login === "github-actions[bot]" &&
                typeof comment.body === "string" &&
                comment.body.includes(marker)
              );
            });

            if (!approval) {
              core.setFailed(
                `Missing fork live approval marker for ${pr.head.sha}. ` +
                  `Run "Fork External Live Tests (manual)" with pr_number=${pr.number}.`
              );
              return;
            }

            core.info(`Found approval marker on ${approval.html_url}`);