From 66d66e290f77cc69b9c48fa5976b9b8d6c60b45d Mon Sep 17 00:00:00 2001 From: RagavRida Date: Fri, 12 Jun 2026 01:22:11 +0530 Subject: [PATCH] ci: skip report job for fork PRs to fix addComment 401 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GITHUB_TOKEN is scoped read-only on fork PRs by GitHub security policy, even when the workflow declares pull-requests/issues: write. This causes the 'Post PR comment' step to fail with: GraphQL: Resource not accessible by integration (addComment) Fix: gate the entire report job with: github.event.pull_request.head.repo.full_name == github.repository Fork contributors still see all eval results in job logs + uploaded artifacts. The comment only appears for maintainer PRs from the same repo where GITHUB_TOKEN has the necessary write scope. Ref: GitHub docs — 'Permissions for the GITHUB_TOKEN | Fork PRs' --- .github/workflows/evals.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml index 667e12a24..939c0dd36 100644 --- a/.github/workflows/evals.yml +++ b/.github/workflows/evals.yml @@ -157,7 +157,13 @@ jobs: report: runs-on: ubicloud-standard-8 needs: evals - if: always() && github.event_name == 'pull_request' + # Skip entirely for fork PRs: GITHUB_TOKEN is read-only on forks even with + # pull-requests/issues: write declared, so addComment always returns 401. + # Fork contributors still see all eval results in the job logs and artifacts. + if: > + always() && + github.event_name == 'pull_request' && + github.event.pull_request.head.repo.full_name == github.repository timeout-minutes: 5 permissions: contents: read