From 519293d4d09148243381a5f9b8723a024c31890e Mon Sep 17 00:00:00 2001 From: Austin McKinley Date: Wed, 22 Jul 2026 16:02:15 -0700 Subject: [PATCH] ci: gate per-PR OTA on the fork guard, not author_association The author_association check skipped the job for private org members: the pull_request webhook payload exposes only the public-safe association, which downgrades a private member to CONTRIBUTOR/NONE, so MEMBER never matched and no staff PR could publish. Drop that clause and rely on the fork guard alone. A branch can only exist in this repo if someone with write access pushed it, so an outside contributor (fork-only) never runs this job; same-repo PRs are staff- authored. This matches the fork-guard gate the other jobs in this workflow already use. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/pull-request-commit.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pull-request-commit.yml b/.github/workflows/pull-request-commit.yml index 7143c6379d..133e7ede46 100644 --- a/.github/workflows/pull-request-commit.yml +++ b/.github/workflows/pull-request-commit.yml @@ -228,18 +228,18 @@ jobs: # Automatic per-PR OTA preview, published to the pull-request- channel on # denis. Replaces the old `@github-actions ota` comment trigger. Gated to - # same-repo PRs (fork guard) opened by someone with repo write access, so a - # fork or an external contributor's PR can never run with the denis publish - # role in scope. + # same-repo PRs (fork guard): a branch can only exist in this repo if someone + # with write access pushed it, so an outside contributor (who can only open a + # PR from a fork) never runs this job with the denis publish role in scope. + # This matches the fork-guard gate the other jobs in this workflow use; + # author_association is deliberately NOT checked (it can't identify a private + # org member and would skip their PRs). publish-pr-ota: name: Publish PR OTA to denis runs-on: ubuntu-latest if: >- github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository && - (github.event.pull_request.author_association == 'MEMBER' || - github.event.pull_request.author_association == 'OWNER' || - github.event.pull_request.author_association == 'COLLABORATOR') + github.event.pull_request.head.repo.full_name == github.repository concurrency: group: pr-ota-${{ github.event.pull_request.number }} cancel-in-progress: true