Repository navigation
fix(review): skip pull requests from forks - #41
Conversation
Fork PRs run without secrets, so the App token step fails on an empty private key and the check goes red before any review. Skip the job for them, keeping the smoke run on push to main, which has no pull request.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
The fork guard's no-PR bypass can also match the documented empty payload for a fork pull request, leaving the original failure in place.
Reviewed changes in e0c44fe, covering the fork gate and its workflow-lint regression check.
- Fork job gate — Adds a head-repository comparison intended to skip secretless fork pull requests while retaining same-repository reviews and push-triggered smoke runs.
- Regression check — Extracts the review job condition and asserts that the repository comparison and no-PR bypass are present.
GPT Sol ｜ 𝕏
GitHub documents the pull_request payload as empty for fork PRs, so !github.event.pull_request also admitted forks. Bypass only for non-pull_request events, the smoke run on push to main.
| # private key before any review. Skip them rather than fail every outside contribution. | ||
| # Compared by name, not head.repo.fork, which is also true for same-repo branches in a repo | ||
| # that is itself a fork. A non-pull_request event is the smoke run on push to main, which | ||
| # must still run; keyed on the event name because a fork's payload is documented as empty, |
There was a problem hiding this comment.
super nit: (not blocking) Cite the source for "a fork's payload is documented as empty", or reword the rationale. The GitHub docs state an empty pull_requests array for fork PRs on workflow_run events. The docs do not state an empty pull_request object on pull_request events. If the citation is the workflow_run note, the comment gives the wrong reason for a correct guard. The same wording appears in tests/workflow-lint-test.sh near line 229 and in the FAIL message near line 244.
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes since the prior Pullfrog review, covering the corrected fork guard and its tightened regression assertion.
- Event-scoped bypass — Replaced payload-presence detection with
github.event_name != 'pull_request', so an empty fork PR payload cannot reach the secret-backed token step while push-triggered smoke runs still execute. - Regression coverage — Rejected
!github.event.pull_requestin the extracted job condition and required the event-name bypass explicitly.
GPT Sol ｜ 𝕏
1 participant
Fork PRs get no secrets, so the review job failed at the App token step (e.g. hotdata-dev/duckdb_extension_parser_tools#17). The job now skips them by comparing the head repo to this repo, and still runs when there is no pull request, so the smoke run on main keeps working.