fix(ci): PR Build Artifact publish step fails with ENEEDAUTH on fork PRs

[ranxianglei]

来源: #668 (#668) 分析 preflight 修复 PR 时发现

Problem

The PR Build Artifact workflow (.github/workflows/pr-artifact.yml) triggers on every pull_request to master, including PRs from forks. Its "Publish to npm with PR tag" step authenticates with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}. GitHub does not pass repository secrets to workflows triggered by fork PRs, so on fork PRs the token is empty and npm publish fails with ENEEDAUTH.

Repro

1. Open a PR to master from a fork (observed on fix(preflight): preserve complete content when recovering blocked ranges #668).
2. The build-artifact job builds successfully, then fails at "Publish to npm with PR tag" with ENEEDAUTH (npm requires login for npm publish).

Impact

• The PR shows a failed CI job even though the source is fine, muddying the checks signal on fork PRs.
• All steps after the publish step are skipped: tarball creation, artifact upload, and the PR comment with install instructions — fork PR authors lose the entire artifact feature.

Suggested fix

Gate the publish step to non-fork PRs:

- name: Publish to npm with PR tag
  if: github.event.pull_request.head.repo.full_name == github.repository

and make the "Comment on PR" step drop the "Option A — Install from npm PR tag" section for fork PRs so the comment does not advertise a tag that was never published. The tarball, artifact upload, and comment steps should still run for fork PRs.

Notes

• No credential or workflow permission change is needed; this is a workflow-gating issue.
• Verified on fix(preflight): preserve complete content when recovering blocked ranges #668: build succeeded, publish failed with ENEEDAUTH, job stopped before the artifact steps.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 Picked up. Verifying the claim against #668's actual workflow run (checking the failed step + error), then I'll implement the gating fix. Will follow up with a PR link.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

Verified and fixed. PR: #671

Verification (triage)

• Bug is real. Checked fix(preflight): preserve complete content when recovering blocked ranges #668's actual run 34380059571: build succeeded, then "Publish to npm with PR tag" failed; the job log shows NODE_AUTH_TOKEN: empty in that step followed by npm error code ENEEDAUTH / need auth This command requires you to be logged in. All subsequent steps (tarball, upload, comment) were skipped — exactly as reported.
• Layering: the ENEEDAUTH is the direct symptom of the root cause: the workflow unconditionally runs npm publish with secrets.NPM_TOKEN, and GitHub does not inject repository secrets into workflows triggered by fork PRs. Your analysis identifies the root cause correctly (not just the symptom), and the proposed fix targets it directly — implemented as suggested.
• Blast radius: not specific to fix(preflight): preserve complete content when recovering blocked ranges #668 — every fork PR to master hits it (e.g. fix(mcp): recover tool calls when the shim's conversation id goes stale after host resume #657's artifact run 34376788600 failed the same way). Scope check: pr-artifact.yml is the only pull_request-triggered workflow using secrets (release.yml is push-triggered, ci-e2e.yml is manual dispatch, ci.yml uses none), so no other workflow needs the same gate.

Fix (PR #671)

• Gate the publish step: if: github.event.pull_request.head.repo.full_name == github.repository (with a short comment explaining why, so the gate isn't later "simplified away").
• The "Comment on PR" step detects fork PRs and drops the "Option A — Install from npm PR tag" section, replacing it with a note that the npm publish was skipped — the comment no longer advertises a tag that was never published.
• Tarball creation, artifact upload, and the PR comment still run for fork PRs, per your spec. No credential or permission changes.

Verification of the fix

• Workflow YAML parses cleanly; the embedded github-script JS passes node --check.
• Simulated the comment step with stubbed context/github for both cases: non-fork output is byte-identical to the existing comment format; fork output contains only the skip notice + artifact install instructions (no phantom npm tag).

中文摘要：修复了 fork PR 上 PR Build Artifact 因拿不到 NPM_TOKEN 而在 publish 步骤 ENEEDAUTH 的问题（publish 加非-fork 门控；fork PR 的自动评论去掉 npm 安装方式、只保留 artifact 下载），已验证 YAML/JS 语法并模拟两种模式的评论内容，PR #671 可以合并。