Review feedback on #2310: rather than skipping the score comment for
forks, make the workflow_run companion the only writer and teach it to
resolve fork pull requests.
conformance.yml's report-conformance job is removed. It ran in the
unprivileged pull_request context, so on a fork PR it could only fail
with "Resource not accessible by integration". conformance-comment.yml
already runs in the privileged workflow_run context and posted the Python
score on those same fork PRs.
Its TypeScript path could not, because it resolved the pull request from
workflow_run.pull_requests[0], which GitHub leaves empty for
fork-originated runs. It now resolves from the run's own head:
head = `${run.head_repository.owner.login}:${run.head_branch}`
and only comments when an open pull request at that head still points at
run.head_sha, so a slow run cannot overwrite a newer result. The pull
request number is never read from the downloaded artifact, which a fork
controls.
Verified the resolution against a live fork PR:
#2350 head=ayaangazali:docs/cli-readme sha=f1fa0469
resolved#2350 head_sha=f1fa0469
* fix(python): respect configured inspector path
* fix(python): treat inspector path as a base prefix
* fix(python): format inspector fixes for ruff
* fix(ci): run conformance with node 22
* fix(ci): fail conformance runs with empty results
* chore(ci): drop inline conformance result validation
* docs(python): clarify inspector path behavior
- Comment workflow only runs for pull_request events (not push)
- For push events, there's no PR to comment on
- Conformance workflow already runs on all branch pushes for iteration
- Badges remain branch-specific (only updated for main/canary pushes)
- Remove pull_request-only restriction from workflow trigger
- Make PR metadata download and comment posting conditional
- Workflow now runs for both push and pull_request events
- For push events, workflow completes without posting comment
- Badges remain branch-specific per existing logic in conformance.yml
Use environment variables instead of direct string interpolation to pass
PR metadata to the github-script action, preventing potential code injection
from untrusted input.
Addresses CodeQL security findings.
- Split conformance workflow into test execution and comment posting
- Created conformance-comment.yml with workflow_run trigger for full permissions
- Upload PR metadata and parsed results as artifacts
- Updated badge labels to 'MCP Conformance (TS)' and 'MCP Conformance (PY)'
- Fixed badge colors: green at 100%, yellow ≥60%, red <60%
- Resolves permission errors when posting comments on forked PRs
Ayaan Gazali