From ffb34b52d75e4e5c08f9f57b892f13c736f16fa2 Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Tue, 21 Jul 2026 16:08:54 +1000 Subject: [PATCH] examples: rebase job requires a same-repo head branch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Copilot hardening suggestion from the estate PAT rollout (lecture-python-programming.fr#17). Fork PRs never receive secrets, so the PAT was not exposed — but a merged fork PR whose branch happened to match a translation prefix would start the job with an empty token and fail red. The head-repo check skips it instead. Belt-and-braces plus noise elimination, now that the template's token line is expected to carry a PAT in this org (action-translation#125). Co-Authored-By: Claude Opus 4.8 (1M context) --- examples/rebase-translations.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/examples/rebase-translations.yml b/examples/rebase-translations.yml index 224d30c8..41d3783e 100644 --- a/examples/rebase-translations.yml +++ b/examples/rebase-translations.yml @@ -25,8 +25,13 @@ jobs: # Keep this in step with `isTranslationBranch` in the action's src/branch-naming.ts # — this `if` decides whether the job runs, that predicate decides which open PRs # it then rebases, so a prefix matching only one of them is a no-op run. + # The head-repo check is belt-and-braces: fork PRs never receive secrets, so + # the PAT is not exposed either way — but a merged fork PR whose branch happens + # to match a prefix would otherwise start this job with an empty token and fail + # red. Same-repo branches matching these prefixes only come from the tooling. if: > github.event.pull_request.merged == true && + github.event.pull_request.head.repo.full_name == github.repository && (startsWith(github.event.pull_request.head.ref, 'translation-sync-') || startsWith(github.event.pull_request.head.ref, 'resync/')) runs-on: ubuntu-latest