Fix preview-publish PR lookup for fork PRs - #3695
Merged
Merged
Conversation
|
The fork-PR fallback used listPullRequestsAssociatedWithCommit, which returns an empty list for fork-PR head commits (they don't live in a base-repo branch). The publish job therefore failed with "No open PR found" before it could push the preview branch or post the comment, so fork PRs (e.g. #3694) never received a preview comment. Look the PR up by its head ref (headOwner:headBranch) from the trusted workflow_run payload via pulls.list instead. The PR number and head SHA are still sourced only from the trusted event payload and validated downstream, so trust guarantees are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jodeleeuw
force-pushed
the
fix/preview-publish-fork-pr-lookup
branch
from
June 26, 2026 15:06
3d5d39d to
5729107
Compare
Contributor
📦 Preview build readyBuilt from PR head Changed packages: none detected Quick-start HTML: <script src="https://cdn.jsdelivr.net/gh/jspsych/jsPsych@e28294c10b69f91f3b5173b5e8ac4f081476b754/packages/jspsych/dist/index.browser.min.js"></script>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/jspsych/jsPsych@e28294c10b69f91f3b5173b5e8ac4f081476b754/packages/jspsych/css/jspsych.css">
<script src="https://cdn.jsdelivr.net/gh/jspsych/jsPsych@e28294c10b69f91f3b5173b5e8ac4f081476b754/packages/plugin-html-keyboard-response/dist/index.browser.min.js"></script>All package URLs
Last updated 2026-06-26 15:09 UTC for PR head |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Fork PRs (e.g. #3694) never receive a preview-build comment. The
preview-buildworkflow succeeds and uploads the artifact, but the companionpreview-publishworkflow — which runs in the trusted base-repo context and is responsible for pushing the preview branch and posting the comment — fails early:Root cause
For fork PRs,
workflow_run.pull_requestsis empty (as the workflow already anticipates), so it falls back tolistPullRequestsAssociatedWithCommit. But that endpoint returns[]for a fork-PR head commit, because the commit doesn't live in a base-repo branch — only underrefs/pull/N/head. With no match, the step callscore.setFailed(...)and the job dies before commenting.Verified directly against the API for #3694's head SHA:
Fix
Look the PR up by its head ref (
headOwner:headBranch) — both taken from the trustedworkflow_runpayload — viapulls.list. This resolves the PR where the previous approach returned nothing:Trust guarantees are unchanged: the PR number and head SHA are still sourced only from the trusted event payload and validated downstream (the artifact's self-reported SHA/number are still cross-checked against these values). Same-repo PRs are unaffected — they populate
workflow_run.pull_requestsand never hit the fallback. A stale build (head moved after the build started) still correctly fails, since the match requiresp.head.sha === headSha.Verification note
workflow_runalways runs the workflow version on the base branch, so this can only be fully validated after merge: once onmain, retriggeringpreview-buildon a fork PR (e.g. push a commit to #3694) should make the publish job resolve the PR and post the preview comment.🤖 Generated with Claude Code