MagicBeanDev/Site
Watch
6
0
Fork
You've already forked Site
 2
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

ci(preview): a fork's labelled preview checks out, and works without a write token #5

Merged
HumanBean merged 1 commit from ci-preview-fork into main 2026-11-13 05:53:04 +00:00
Conversation 1 Commits 1 Files changed 1 +11 -5
HumanBean commented 2026-11-13 05:49:44 +00:00
Owner

The preview label from #4 failed on its first fork PR (run 12) for two reasons:

  • actions/checkout v7 refuses a fork's code under pull_request_target unless the step sets allow-unsafe-pr-checkout: true. It is set for the label run only: the maintainer's label, plus the check that the PR is still at that commit, is the opt-in.
  • A fork's run gets a read-only job token, so taking the label off got a 403, and the comment would have too. Both now use the PREVIEW_COMMENT_TOKEN secret when it is set (a Forgejo token with write:issue), and otherwise the job token. If the comment is refused, the job prints the link in its log with a warning instead of failing. The label then stays on: take it off by hand before adding it again.

Testing: this PR's own run covers the same-repo path. The label path runs from main, so it can only be tried after merging, by adding preview to #1 again.

🤖 Generated with Claude Code

The `preview` label from #4 failed on its first fork PR (run 12) for two reasons: - actions/checkout v7 refuses a fork's code under `pull_request_target` unless the step sets `allow-unsafe-pr-checkout: true`. It is set for the label run only: the maintainer's label, plus the check that the PR is still at that commit, is the opt-in. - A fork's run gets a read-only job token, so taking the label off got a 403, and the comment would have too. Both now use the `PREVIEW_COMMENT_TOKEN` secret when it is set (a Forgejo token with `write:issue`), and otherwise the job token. If the comment is refused, the job prints the link in its log with a warning instead of failing. The label then stays on: take it off by hand before adding it again. Testing: this PR's own run covers the same-repo path. The label path runs from `main`, so it can only be tried after merging, by adding `preview` to #1 again. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
ci(preview): a fork's labelled preview checks out, and works without a write token
All checks were successful
Preview / Preview on Cloudflare (pull_request) Successful in 11s
Details
31f00c2db5 
actions/checkout refuses a fork's code under pull_request_target without allow-unsafe-pr-checkout; the label and the
commit check are the opt-in. A fork's run gets a read-only job token (403), so commenting and taking the label off use
PREVIEW_COMMENT_TOKEN when it is set, and otherwise print the link in the log with a warning instead of failing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
forgejo-actions commented 2026-11-13 05:49:56 +00:00

Preview: https://pr-5-magicbean-site.hckr-5e0.workers.dev

This commit (31f00c2db5) on its own: https://c7895f9e-magicbean-site.hckr-5e0.workers.dev

<!-- preview-deploy --> **Preview:** https://pr-5-magicbean-site.hckr-5e0.workers.dev This commit (31f00c2db555) on its own: https://c7895f9e-magicbean-site.hckr-5e0.workers.dev
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
preview
Maintainers: preview this PR on Cloudflare (approves its current commit; comes off after the run)

No labels
preview
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
MagicBeanDev/Site!5
No description provided.