Ayaan Gazali bf30ab5431 ci(conformance): post fork scores from the workflow_run path (#2310) ...

Review feedback on #2310: rather than skipping the score comment for
forks, make the workflow_run companion the only writer and teach it to
resolve fork pull requests.

conformance.yml's report-conformance job is removed. It ran in the
unprivileged pull_request context, so on a fork PR it could only fail
with "Resource not accessible by integration". conformance-comment.yml
already runs in the privileged workflow_run context and posted the Python
score on those same fork PRs.

Its TypeScript path could not, because it resolved the pull request from
workflow_run.pull_requests[0], which GitHub leaves empty for
fork-originated runs. It now resolves from the run's own head:

  head = `${run.head_repository.owner.login}:${run.head_branch}`

and only comments when an open pull request at that head still points at
run.head_sha, so a slow run cannot overwrite a newer result. The pull
request number is never read from the downloaded artifact, which a fork
controls.

Verified the resolution against a live fork PR:

  #2350 head=ayaangazali:docs/cli-readme sha=f1fa0469
  resolved #2350 head_sha=f1fa0469

2026-08-30 10:43:22 -07:00

12 KiB

Raw Permalink Blame History

View Raw