Repository navigation
fix(ci): Skip the coverage comment on pull requests from forks - #901
Merged
Merged
Conversation
A workflow run for a pull request from a fork gets a read-only token, whatever `permissions:` declares. The coverage-comment step therefore cannot post, and fails the job with HttpError: Resource not accessible by integration two steps after `pytest unit` reported success. So every external contribution has shown a red `Test (pytest + coverage)` check while its tests passed. On #867 that read as the contributor's tests failing, and cost a round of looking for a fault that was not his — the job's name is what people read, not its step list. The step now also requires the pull request to come from this repository. Nothing is lost for forks: the Codecov upload and the coverage artifact are separate steps and still run. Two guards. One walks every workflow and fails when a step whose `uses:` is a known PR-writing action lacks the fork exemption — keyed on the action rather than the step name, because a name is free text. The other fails when that watch list matches nothing at all, which is how the first would quietly pass the day the action is replaced. Both mutation-tested: removing the exemption fails the first, renaming the action fails the second. Refs #847
Reviewer's GuideThe PR prevents fork-originated pull requests from producing misleading failures by skipping the PR-writing coverage comment when the workflow token is read-only, while preserving coverage reporting and adding tests that guard the workflow condition and its action watch list. File-Level Changes
Assessment against linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Review limit reachedNext included review available in 53 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository: stefanko-ch/Nexus-Stack/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="tests/unit/test_workflow_expressions.py" line_range="572-576" />
<code_context>
+ for step in _steps_with_uses(workflow):
+ if not any(str(step["uses"]).startswith(a) for a in _PR_WRITING_ACTIONS):
+ continue
+ condition = str(step.get("if", ""))
+ assert _SAME_REPO in condition, (
+ f"{path.name}: step {step.get('name')!r} writes to the pull request but "
+ "does not exempt forks, so it fails the job on every external contribution"
</code_context>
<issue_to_address>
**issue (testing):** The guard only checks that the textual `_SAME_REPO` fragment appears somewhere in the condition, so replacing the workflow's `&&` with `||` still passes the test while forked pull requests execute the write action and fail with the read-only-token error.
**Triggers:** When the workflow condition is changed in a way that preserves the comparison text but changes its boolean semantics.
**Suggested fix:** Assert the complete expression semantics, including the `pull_request` event check and conjunction, rather than only checking for a substring; for example, parse or normalize the condition and explicitly reject `||`/unconditional branches.
```suggestion
condition = " ".join(str(step.get("if", "")).split())
assert condition == (
"github.event_name == 'pull_request' && "
f"{_SAME_REPO}"
), (
f"{path.name}: step {step.get('name')!r} writes to the pull request but "
"does not exempt forks, so it fails the job on every external contribution"
)
```
</issue_to_address>Sourcery assessment
Approval pending. 1 finding to address first.
Blocking findings: tests/unit/test_workflow_expressions.py:576
Contributor
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Address PR review comments on #901. [4052815422] sourcery-ai — Fixed. The guard checked that the fork comparison appeared somewhere in the condition, and `A || B` contains the same text as `A && B`. So a workflow whose `&&` had been swapped for `||` would have passed the test and still run the step for every fork, which is the exact failure the guard exists to prevent — the substring was evidence of the right words, not of the right meaning. It now normalises the whitespace, rejects `||` outright, and requires the fork check to be conjoined with `&&`. Mutation-tested: swapping the workflow condition to `||` fails test_a_step_that_comments_on_the_pr_is_skipped_for_forks.
stefanko-ch
pushed a commit
that referenced
this pull request
Sep 25, 2026
🤖 I have created a release *beep* *boop* --- ## [0.83.0](v0.82.3...v0.83.0) (2026-09-25) ### 🚀 Features * **stacks:** Add Cube as the semantic layer over the warehouse ([#905](#905)) ([2dc7a6e](2dc7a6e)) ### 🐛 Bug Fixes * **ci:** Skip the coverage comment on pull requests from forks ([#901](#901)) ([90ef3b2](90ef3b2)) * **deploy:** Hash the Filestash password without htpasswd ([#900](#900)) ([b67f1c5](b67f1c5)) ### 🔧 Maintenance * **ci:** Remove the duplicate orphan-cleanup workflow, keep the tool ([#902](#902)) ([04d7885](04d7885)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). ## Summary by Sourcery Release version 0.83.0 with Cube integration, CI and deployment fixes, and workflow maintenance. New Features: - Add Cube as a semantic layer over the warehouse. Bug Fixes: - Skip coverage comments for pull requests originating from forks. - Hash Filestash passwords without relying on htpasswd. CI: - Remove the duplicate orphan-cleanup workflow while retaining the cleanup tool. Chores: - Release version 0.83.0 and update the changelog and release manifest. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #847.
What this fixes
A workflow run for a pull request from a fork gets a read-only token, whatever
permissions:declares. The coverage-comment step therefore cannot post, and fails with:two steps after
pytest unitreported success. So every external contribution has shown a redTest (pytest + coverage)check while its tests passed.On #867 that is precisely what happened, and it cost the contributor a round of looking for a fault that was not his — the job's name is what people read, not its step list:
pytest unitCoverage comment on PRThe change
The step now also requires the pull request to come from this repository:
Nothing is lost for forks: the Codecov upload and the coverage artifact are separate steps and still run. What goes away is a red check that never meant anything.
Guards
Two, both mutation-tested:
uses:is a known PR-writing action lacks the fork exemption — keyed on the action, not the step name, because a name is free text;Removing the exemption fails the first; renaming the action fails the second.
Relation to #847
#847 is about a reviewer that fails its quota and still reports green. This is the mirror image — a step that reports red without anything being wrong — and the same underlying problem: a check whose colour does not mean what a reader takes it to mean. It does not close #847.
pytest tests/unit: 3691 passed. Pre-commit (incl. actionlint): all hooks pass.Local CodeRabbit round
Reviewed
3f9e08ec: 0 findings.Summary by Sourcery
Skip pull-request coverage comments from forks while preserving coverage uploads and artifacts.
Bug Fixes:
Enhancements:
Tests: