From efd2b8666e5ce74a0deffa75e264646d50024951 Mon Sep 17 00:00:00 2001 From: Andy Postnikov Date: Fri, 17 Jul 2026 10:57:50 +0200 Subject: [PATCH] ci(docs): skip pr-comment on fork PRs; bump actions to Node 24 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pr-comment job posts a preview comment via github-script's createComment, which is a write. On PRs opened from forks the GITHUB_TOKEN is read-only, so the call fails with HTTP 403 "Resource not accessible by integration" and the job goes red on every fork PR (cosmetic — build and deploy are unaffected). Guard the job to run only for same-repo PRs, where the token can write. Also bump the Node 20 actions to their Node 24 majors to clear the runner deprecation warnings ("Node 20 is being deprecated ... forced to run on Node.js 24"): actions/checkout v4->v5, actions/setup-python v5->v6, actions/github-script v7->v8. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01DYcuURscruaF1yNVHJHW3C --- .github/workflows/docs-build-push.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docs-build-push.yml b/.github/workflows/docs-build-push.yml index 9a0da81f..4411cfb6 100644 --- a/.github/workflows/docs-build-push.yml +++ b/.github/workflows/docs-build-push.yml @@ -47,7 +47,7 @@ jobs: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 with: fetch-depth: 0 @@ -70,7 +70,7 @@ jobs: ### Sphinx build - name: Setup Python if: inputs.doc_type == 'sphinx' - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: "3.12" @@ -125,13 +125,17 @@ jobs: pr-comment: needs: build - if: github.event.action == 'opened' || github.event.action == 'synchronize' + # Skip on PRs from forks: their GITHUB_TOKEN is read-only, so the + # createComment call below 403s ("Resource not accessible by integration"). + if: >- + (github.event.action == 'opened' || github.event.action == 'synchronize') + && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-24.04 permissions: pull-requests: write steps: - name: Post preview comment - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: PREVIEW_URL_PATH: ${{ inputs.preview_url_path }} PR_NUMBER: ${{ github.event.pull_request.number }}