acetheking987/bsky-social-app
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

ci: gate per-PR OTA on the fork guard, not author_association

Browse Source 
The author_association check skipped the job for private org members:
the pull_request webhook payload exposes only the public-safe association,
which downgrades a private member to CONTRIBUTOR/NONE, so MEMBER never
matched and no staff PR could publish.

Drop that clause and rely on the fork guard alone. A branch can only exist
in this repo if someone with write access pushed it, so an outside
contributor (fork-only) never runs this job; same-repo PRs are staff-
authored. This matches the fork-guard gate the other jobs in this workflow
already use.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Austin McKinley
2026-07-22 16:02:15 -07:00
parent c5093818ae
commit 519293d4d0
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pull-request-commit.yml
+7 -7
View File
@@ -228,18 +228,18 @@ jobs:
# Automatic per-PR OTA preview, published to the pull-request-<N> channel on # Automatic per-PR OTA preview, published to the pull-request-<N> channel on
# denis. Replaces the old `@github-actions ota` comment trigger. Gated to # denis. Replaces the old `@github-actions ota` comment trigger. Gated to
# same-repo PRs (fork guard) opened by someone with repo write access, so a # same-repo PRs (fork guard): a branch can only exist in this repo if someone
# fork or an external contributor's PR can never run with the denis publish # with write access pushed it, so an outside contributor (who can only open a
# role in scope. # PR from a fork) never runs this job with the denis publish role in scope.
# This matches the fork-guard gate the other jobs in this workflow use;
# author_association is deliberately NOT checked (it can't identify a private
# org member and would skip their PRs).
publish-pr-ota: publish-pr-ota:
name: Publish PR OTA to denis name: Publish PR OTA to denis
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: >- if: >-
github.event_name == 'pull_request' && github.event_name == 'pull_request' &&
github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.repo.full_name == github.repository
(github.event.pull_request.author_association == 'MEMBER' ||
github.event.pull_request.author_association == 'OWNER' ||
github.event.pull_request.author_association == 'COLLABORATOR')
concurrency: concurrency:
group: pr-ota-${{ github.event.pull_request.number }} group: pr-ota-${{ github.event.pull_request.number }}
cancel-in-progress: true cancel-in-progress: true