Repository navigation
fix(ai-policy): do not fail fork pull requests on the labelling step - #815
Merged
nickvergessen merged 1 commit intoOct 16, 2026
Merged
Conversation
Runs triggered from forks only get a read-only token and no secrets, so adding the "AI assisted" label fails with HTTP 403. That fails the whole job for exactly the pull requests that follow the policy and declare AI use with an Assisted-by trailer. The label step before it already ignores this error. Mark the step as continue-on-error. The check for a coding-agent Signed-off-by still fails the job. Fixes nextcloud#767 AI-Assisted-By: Claude Opus 5.5 (xhigh) Signed-off-by: MiMoHo <37556964+MiMoHo@users.noreply.github.com>
nickvergessen
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #767
The AI Policy check fails on fork PRs whose commits carry an
Assisted-bytrailer, which means it fails the PRs that follow the policy. The cause is the labelling step: runs from forks only get a read-only token and no secrets, so adding the "AI assisted" label returns HTTP 403. The step right before it already ignores that error with|| true. #798 reported the same problem and was closed as a duplicate of #767.This marks the labelling step as
continue-on-error, as suggested in #798. The check for a coding-agentSigned-off-bystill fails the job, and the label keeps working for PRs from branches in this repository. Fork PRs don't get the label today either, because the step fails, so nothing is lost. The fallback togithub.tokenwas added for these runs, and this finishes that work.#767 suggests moving the label to a
pull_request_targetworkflow. I left that out because zizmor (@zizmorcore), which runs in lint-yaml here, reportspull_request_targetas a dangerous trigger, and GitHub Security Lab warns against combining it with untrusted PR code. #799 and #814 just moved the Dependabot and Renovate workflows away frompull_request_targetfor the same reason, and no workflow in this repository uses it any more. If the label is needed on fork PRs, a separateworkflow_runjob as described by GitHub Security Lab would be the safer way.This PR should test itself: it comes from a fork and its commit has an
AI-Assisted-Bytrailer. The run will probably need maintainer approval first.🤖 AI (if applicable)
AI-Assisted-By: Claude Opus 5.5 (xhigh)
The model drafted the change. I checked it against the issue and the workflow. The commit carries the same line as a trailer.