Skip to content

examples: rebase job requires a same-repo head branch - #130

Merged
mmcky merged 1 commit into
mainfrom
harden-rebase-fork-guard
Jul 21, 2026
Merged

examples: rebase job requires a same-repo head branch#130
mmcky merged 1 commit into
mainfrom
harden-rebase-fork-guard

Conversation

@mmcky

@mmcky mmcky commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Copilot hardening suggestion from the estate PAT rollout (.fr#17 comment). Fork PRs never receive secrets — the PAT was not exposed — but a merged fork PR whose branch happened to match a translation prefix would start the rebase job with an empty token and fail red. The head-repo check skips it instead. Applied simultaneously to both harness targets and all five estate copies so the template and its copies stay in step.

🤖 Generated with Claude Code

Copilot hardening suggestion from the estate PAT rollout
(lecture-python-programming.fr#17). Fork PRs never receive secrets, so
the PAT was not exposed — but a merged fork PR whose branch happened to
match a translation prefix would start the job with an empty token and
fail red. The head-repo check skips it instead. Belt-and-braces plus
noise elimination, now that the template's token line is expected to
carry a PAT in this org (action-translation#125).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens the example “Rebase Translation PRs” workflow so it only runs for merged translation PRs whose head branch is in the same repository, preventing runs on merged fork PRs that can’t access secrets and would otherwise fail due to an empty token.

Changes:

  • Add a same-repo guard (head.repo.full_name == github.repository) to the job-level if: condition.
  • Expand inline documentation explaining why the additional guard exists (fork PR secret unavailability and failure mode).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants