ci: publish fork-PR test reports via workflow_run#1173
Merged
Conversation
GitHub forces GITHUB_TOKEN to read-only for pull_request runs from forks, so dorny/test-reporter's Checks API call (POST .../check-runs) returned 403 "Resource not accessible by integration" and failed every fork PR, even when all tests passed. Split reporting out of the build (the same pattern adopted in AutoMapper): - ci.yml now runs with a read-only token and only uploads the .trx files as a test-results-Windows artifact. checks:write is dropped — the build no longer touches the Checks API. Push to MyGet stays main-only. - test-report.yml is triggered by workflow_run when CI completes. It runs in the base-repository context with checks:write, downloads the test-results-* artifacts, and publishes one inline check per platform. This restores real test reports for fork PRs instead of failing them. Supersedes the continue-on-error stop-gap. Closes #1172 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jbogard
force-pushed
the
ci/test-reporter-fork-safe
branch
from
0378dc5 to
b28cfac
Compare
jbogard
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the CI pipeline to avoid failing fork-based PRs when publishing inline test reports, by splitting test execution (PR context) from check publication (base-repo context via workflow_run).
Changes:
- Replace in-workflow test reporting in
CIwith artifact upload of.trxresults. - Add a
workflow_run-triggered workflow that downloads test artifacts and publishes test reports via the Checks API.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/ci.yml | Stops calling the Checks API during PR CI; uploads .trx files as test-results-* artifacts instead. |
| .github/workflows/test-report.yml | New workflow that runs in base-repo context on CI completion and publishes inline test reports from uploaded artifacts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
CI does not use OIDC (no azure/login or other token exchange); the only secret is the main-only Push to MyGet. Remove id-token:write to follow least privilege, per review feedback on #1173. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the fork-PR CI failure tracked in #1172, using the same
workflow_runpattern just adopted in AutoMapper (LuckyPennySoftware/AutoMapper#4643). Fork PRs get real inline test reports instead of a swallowed failure.Problem
For
pull_requestruns from a fork, GitHub forcibly downgradesGITHUB_TOKENto read-only.dorny/test-reportercalls the Checks API to publish results, which needschecks: write; with a read-only token it gets403 Resource not accessible by integrationand (defaultfail-on-error: true) fails the job even when all tests pass.Fix — split building from reporting
ci.yml(runs on the PR, read-only token, no secrets):Report Test Resultsstep withUpload Test Results— the.trxfiles are uploaded as atest-results-Windowsartifact.checks: writefrompermissions; the build no longer touches the Checks API.Push to MyGetstaysmain-only.test-report.yml(new, triggered byworkflow_runwhen CI completes):checks: write, so it has a writable token even for fork PRs.test-results-*artifacts and publishes one inline check per platform (Test Results (Windows)).fail-on-empty: falseso a build that fails before producing.trxdoesn't add a spurious red report.Rollout note
workflow_runonly fires for the copy oftest-report.ymlon the default branch, so reports for fork PRs start working once this lands onmain.Closes #1172
🤖 Generated with Claude Code