fix: identify Frost startup launcher - #91
Merged
Merged
Conversation
popen2
enabled auto-merge
September 10, 2026 19:02
popen2
disabled auto-merge
September 10, 2026 19:02
popen2
pushed a commit
that referenced
this pull request
Sep 17, 2026
The autolabeler went red on every pull request from a fork: "Resource not accessible by integration" adding the label it had already worked out. Nothing in the pull request caused it and nothing in the pull request could clear it, so #91 could not be merged on a clean run. A `pull_request` run on a fork's head gets a read-only GITHUB_TOKEN, because the code it is about to execute is a stranger's, and `permissions:` cannot undo that - it only drops privileges. So `pull-requests: write` was a request GitHub was always going to refuse. The label comes from the API alone: no checkout, no install, no contributor code in the job. So it moves to `pull_request_target`, which runs from `main` with a token that can write and reads release-drafter.yml from `main` rather than from the contributor's branch. The action is pinned to the commit behind v7 instead of the tag, now that it resolves inside a job holding that token - the reasoning that already pins aws-iam-authenticator by checksum. The rule that keeps it safe is stated in the file: never check out, install or execute pull request code here. Nothing else changed. ci.yaml already builds without secrets - `sign: false` on pull requests keeps the Developer ID out of a job that has run `npm ci` from the branch - so a fork gets lint, the end-to-end tests and an unsigned six-row build. AGENTS.md now records that, and the two repository settings that would clear a red fork check by handing fork code the signing keys. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FCijaTvChWKvAGFRUoqBzF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.