Skip to content

Commit 5e5f807

Browse files
antonwolfyclaude
andcommitted
Skip PR comments for fork PRs due to token restrictions
Fork PRs run with read-only GITHUB_TOKEN and cannot post comments due to GitHub's security restrictions. This causes the comment step to fail with "Resource not accessible by integration" error. Changes: - Removed the comment preparation step (no longer needed) - Comment step now only runs for upstream PRs - Fork PR contributors can still find artifacts in workflow run Fork PR artifacts remain accessible via the workflow run's Artifacts section without needing a comment. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1 parent 5c3b452 commit 5e5f807

1 file changed

Lines changed: 6 additions & 46 deletions

File tree

.github/workflows/build-sphinx.yml

Lines changed: 6 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -237,57 +237,17 @@ jobs:
237237
user_name: ${{ env.GH_BOT_NAME }}
238238
user_email: ${{ env.GH_BOT_EMAIL }}
239239

240-
# Prepare documentation preview comment based on PR type
241-
- name: Prepare docs preview comment
242-
if: github.event_name == 'pull_request' && github.event.action != 'closed'
243-
id: docs_comment
240+
# Comment on upstream PR with docs preview URL
241+
# Note: Fork PRs cannot post comments due to GitHub's read-only token restrictions
242+
- name: Comment with docs preview
243+
if: github.event_name == 'pull_request' && github.event.action != 'closed' && steps.check_fork.outputs.is_fork == 'false'
244244
env:
245245
PR_NUM: ${{ github.event.number }}
246-
IS_FORK: ${{ steps.check_fork.outputs.is_fork }}
247-
run: |
248-
if [ "$IS_FORK" == "true" ]; then
249-
# Fork PR - provide artifact download instructions
250-
cat << 'EOF' >> "$GITHUB_OUTPUT"
251-
message<<COMMENT_EOF
252-
📚 **Documentation Preview (Fork PR)**
253-
254-
Your docs have been built successfully! For security reasons, fork PRs cannot automatically publish to GitHub Pages.
255-
256-
**To view your docs:**
257-
```bash
258-
gh run download ${{ github.run_id }} -R ${{ github.repository }} -n pr-${{ env.PR_NUM }}-docs
259-
cd pr-${{ env.PR_NUM }}-docs
260-
python -m http.server 8000
261-
# Open http://localhost:8000 in your browser
262-
```
263-
264-
**Alternative: Manual download**
265-
1. Download artifact `pr-${{ env.PR_NUM }}-docs` from [this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) (scroll to "Artifacts" section)
266-
2. Extract the ZIP file and open `index.html` in your browser
267-
268-
<details>
269-
<summary>Why can't fork PRs publish automatically?</summary>
270-
271-
Fork PRs run with restricted permissions to prevent malicious code from modifying the repository or accessing secrets. This is a GitHub security feature to protect open source projects.
272-
</details>
273-
COMMENT_EOF
274-
EOF
275-
else
276-
# Upstream PR - provide direct URL
277-
cat << 'EOF' >> "$GITHUB_OUTPUT"
278-
message<<COMMENT_EOF
279-
View rendered docs @ https://intelpython.github.io/dpnp/pull/${{ env.PR_NUM }}/index.html
280-
COMMENT_EOF
281-
EOF
282-
fi
283-
284-
# Comment on PR with docs preview
285-
- name: Comment with docs preview
286-
if: github.event_name == 'pull_request' && github.event.action != 'closed'
287246
uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0.8.3.11.0
288247
with:
289248
message-id: docs_preview
290-
message: ${{ steps.docs_comment.outputs.message }}
249+
message: |
250+
View rendered docs @ https://intelpython.github.io/dpnp/pull/${{ env.PR_NUM }}/index.html
291251
allow-repeats: false
292252

293253
# The job is only used to build docs when PR is closed (action from PR branch)

0 commit comments

Comments
 (0)