From b15c5270e19ba13739665ed8fc2719dd64810ec1 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 01:21:07 +0000 Subject: [PATCH] ci: label pull requests from forks too For a pull request from a fork, the pull_request event gets a read-only token regardless of the permissions block, so the labeler failed with "Resource not accessible by integration" (seen on #158). Run on pull_request_target instead, which uses the base branch's workflow and a writable token. Neither step checks out or runs the pull request's code, which is what keeps that safe. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012VjGcBURcFQJMzcFaFvciV --- .github/workflows/label-prs.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/label-prs.yml b/.github/workflows/label-prs.yml index e040db3..565c9f9 100644 --- a/.github/workflows/label-prs.yml +++ b/.github/workflows/label-prs.yml @@ -1,7 +1,14 @@ name: Label PRs on: - pull_request: + # pull_request_target, not pull_request: for a pull request from a fork, + # pull_request gets a read-only token whatever the permissions block says, + # and adding the labels fails with "Resource not accessible by integration". + # This runs the workflow from the base branch with a writable token. That is + # safe only because no step checks out or runs the pull request's code: the + # labeler reads the changed file names through the API and the script below + # reads only the title. Keep it that way. + pull_request_target: types: [opened, synchronize, reopened] permissions: