Fork pull requests

A pull_request run from a fork gets a read-only token and no OIDC token, so the step prints a notice and skips the push. A workflow_run workflow runs in your repository once the build finishes, with your permissions. It downloads the numbers the fork's build measured and pushes them for the pull request.

It never checks out or runs the fork's code, and buildstats only lets these runs write to a pull request, never to your default branch.

In the build workflow, write the metrics to a JSON file in the metric format and upload it. Keep your regular buildstats step for pushes and pull requests from your own branches.

1- run: echo '{"bundle_size": 1832}' > buildstats.json2- uses: actions/upload-artifact@v73  with:4    name: buildstats5    path: buildstats.json

Add a second workflow. workflows must match the name of the build workflow, and the last condition leaves pull requests from your own branches to the regular step.

1name: buildstats2 3on:4  workflow_run:5    workflows: [Build]6    types: [completed]7 8permissions:9  actions: read10  contents: read11  id-token: write12  pull-requests: write13 14jobs:15  push:16    if: >-17      github.event.workflow_run.event == 'pull_request' &&18      github.event.workflow_run.conclusion == 'success' &&19      github.event.workflow_run.head_repository.full_name != github.repository20    runs-on: ubuntu-latest21    steps:22      - uses: actions/download-artifact@v823        with:24          name: buildstats25          run-id: ${{ github.event.workflow_run.id }}26          github-token: ${{ github.token }}27      - uses: buildstats-io/action@v128        with:29          file: buildstats.json30          sha: ${{ github.event.workflow_run.head_sha }}

The step finds the pull request for head_sha, records the metrics on it and updates its comment.

• GitHub only runs workflow_run workflows that are on the default branch, so merge this one before you try it on a fork.
• The fork controls the numbers in the artifact, and they can only land on its own pull request.
• pull_request_target runs record on the pull request too, with the number and head commit from the event. They run with your permissions, so never build the fork's code in them.