From 8dd2ad3b0b0c96c92f11c2aee5070aa75c02fa9c Mon Sep 17 00:00:00 2001 From: sotashimozono Date: Sat, 29 Aug 2026 13:39:40 +0000 Subject: [PATCH] ci(labeler): skip PRs from forks instead of failing on them A `pull_request` run whose head is a fork gets a read-only GITHUB_TOKEN regardless of the `permissions:` block, so `createLabel` returns 403 and the check goes red on a contribution that is otherwise green. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/labeler.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index f4e1d39..655e6b8 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -32,6 +32,13 @@ permissions: issues: write # addLabels / createLabel are issue-scoped, even on a PR jobs: label: + # A `pull_request` run whose head is a FORK gets a read-only GITHUB_TOKEN, whatever the + # `permissions:` block says — so `createLabel`/`addLabels` come back 403 and the check goes + # red on a PR that is otherwise fine. Labelling a fork PR needs `pull_request_target`, which + # is a caller-side change; until then, skip rather than fail. Measured on + # sotashimozono/Reversi.jl#54 (an outside contribution): tests all green, this job red on + # `Resource not accessible by integration`. + if: github.event.pull_request.head.repo.fork != true runs-on: ${{ fromJSON(inputs.runner) }} steps: - uses: actions/github-script@v9