Repository navigation
ci: label pull requests from forks too - #161
Merged
Merged
Conversation
For a pull request from a fork, the pull_request event gets a read-only token regardless of the permissions block, so the labeler failed with "Resource not accessible by integration" (seen on #158). Run on pull_request_target instead, which uses the base branch's workflow and a writable token. Neither step checks out or runs the pull request's code, which is what keeps that safe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012VjGcBURcFQJMzcFaFvciV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On bvweerd/simple_pid_controller#158, which came from a fork, the check "Automatically label PRs by changed files" failed:
For a pull request from a fork, the
pull_requestevent always gets a read-onlyGITHUB_TOKEN. Thepull-requests: writein the workflow makes no difference there.Change
label-prs.ymlnow triggers onpull_request_targetinstead ofpull_request. The workflow then runs from the base branch with a writable token.That is safe here because no step checks out or runs code from the pull request.
actions/labelerreads the changed file names through the API, and thegithub-scriptstep reads only the title. A comment in the workflow records that this has to stay that way.Side effect: changes to
label-prs.ymlor.github/pr-labeler.ymlin a pull request only take effect once they are merged, because the workflow and its config come from the base branch.🤖 Generated with Claude Code
https://claude.ai/code/session_012VjGcBURcFQJMzcFaFvciV
Generated by Claude Code