From b481a06c49be70365690cd1ba814c30c6432ef16 Mon Sep 17 00:00:00 2001 From: Adarsh Prashar Date: Sun, 31 May 2026 19:35:26 +0530 Subject: [PATCH] ci: skip the automatic Claude review on fork PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub doesn't expose repo secrets (CLAUDE_CODE_OAUTH_TOKEN) to PRs from forks, so the review action can't authenticate and the job always fails — a spurious red check on every external contribution (e.g. #35). Gate the job to same-repo PRs (head.repo.full_name == the repo) so fork PRs skip it cleanly instead. External PRs are still reviewable on demand: the maintainer comments "@claude", which runs claude.yml on issue_comment in the base-repo context where the secret is available (and is locked to prashar32). --- .github/workflows/claude-pr-review.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index 26320f2..ad1dcc5 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -5,6 +5,12 @@ name: Claude PR Review # generate it locally once with `claude setup-token` and add it as a repo secret. # Re-review on demand by commenting "@claude" (see claude.yml). Add `synchronize` # below if you also want a fresh review on every push. +# +# Fork PRs are skipped (not failed): GitHub does not expose repo secrets to PRs +# from forks, so the token is unavailable and the action can only fail. External +# contributions are instead reviewed on demand — the maintainer comments "@claude" +# (claude.yml runs on issue_comment in the base-repo context, where the secret IS +# available, and is locked to prashar32). on: pull_request: types: [opened, reopened] @@ -16,6 +22,9 @@ permissions: jobs: review: + # Same-repo PRs only. On a fork PR head.repo.full_name differs from the repo, + # the secret is absent, and this job would always fail — so skip it there. + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: actions/checkout@v6