From 8333bb6e47a5a531263e2e0b8780a285ca2e84fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Diego=20Fernando=20Carri=C3=B3n?= Date: Mon, 27 Jul 2026 14:19:13 +0200 Subject: [PATCH] ci(preview-readme): skip fork PRs to fix checkout failure The preview-readme job checks out the head branch by name (ref: github.event.pull_request.head.ref) without setting repository, so actions/checkout fetches refs/heads/ from this repo. For a fork PR the branch lives only in the fork, so the fetch finds no ref and the step fails with 'git failed with exit code 1' (seen on PR #28, from gaul/s3proxy-chart). Every other workflow uses the default merge-ref checkout and is unaffected. Even with checkout fixed, the comment-posting steps need a write-scoped GITHUB_TOKEN, which the pull_request event does not grant fork PRs, so the preview feature is inherently limited to same-repo branches. Guard the job on head.repo.full_name == github.repository: internal branches still get the README preview; fork PRs skip it cleanly instead of reporting a spurious failure. --- .github/workflows/preview-readme.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/preview-readme.yaml b/.github/workflows/preview-readme.yaml index 6e79591..360bd61 100644 --- a/.github/workflows/preview-readme.yaml +++ b/.github/workflows/preview-readme.yaml @@ -10,6 +10,14 @@ on: jobs: preview-readme: + # This job checks out the head branch by name and posts the rendered README + # diff back as a PR comment. Both of those require the head branch to live in + # this repo and a write-scoped GITHUB_TOKEN. Neither holds for fork PRs: the + # branch exists only in the fork (so `actions/checkout` with a bare `ref:` + # fetches refs/heads/ from this repo and fails), and the + # pull_request event grants forks a read-only token (so createComment 403s). + # Skip forks; internal branches still get the preview. + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest timeout-minutes: 5 steps: