fix(ci): stop fork PRs failing on write-scoped checks

[goosewobbler]

Description

Validate PR Title and Release Preview fail with Resource not accessible by integration on every external contributor PR.

Root cause: a pull_request run from a forked repository gets a read-only GITHUB_TOKEN regardless of what the workflow's permissions: block requests. That's a GitHub platform rule, not a misconfiguration — so any write call 403s.

Evidence:

PR	Fork?	Validate PR Title	Release Preview
#556	no	pass	pass
#557	no	pass	pass
#527	yes	fail	fail

1. Validate PR Title — create-a-commit-status 403

Traced to the action's source: the POST /repos/:owner/:repo/statuses/:sha call sits inside if (wip), so it only happens because we pass wip: true. And it runs before the title verdict is evaluated:

if (wip) {
  await client.request('POST /repos/:owner/:repo/statuses/:sha', { … });  // 403 on forks
}
if (!isWip && validationError) {
  throw validationError;
}

So the check is a 100% false negative for external contributors — #527's title (fix(tauri): use CSS pixels for embedded window rect) is valid conventional-commits and still failed.

The action's own comment says wip is for "repositories which don't support draft pull requests" — private repos on the free plan. This repo is public, so draft PRs already cover that. Dropping wip: true removes the only write the workflow made, so statuses: write goes with it.

2. Release Preview — create-an-issue-comment 403

This one genuinely needs pull-requests: write, and it does actions/checkout + runs releasekit over the tree. Switching it to pull_request_target would either preview the base branch (useless) or run untrusted PR code with a writable token and secrets — the classic pwn-request. So it's split into the pattern GitHub documents for exactly this:

• release-preview.yml (pull_request, contents: read) — runs releasekit with preview-dry-run: true, which returns the markdown via the existing preview-markdown output instead of posting, then uploads it as an artifact.
• release-preview-comment.yml (workflow_run, pull-requests: write) — downloads the artifact from the triggering run and posts it. Runs in the base-repo context, never checks out PR code.

No releasekit changes needed — preview-dry-run and preview-markdown already exist. The comment reuses releasekit's own <!-- releasekit-preview --> marker, so existing preview comments update in place rather than duplicating, and both fork and same-repo PRs now take one consistent path.

The consumer treats the artifact as untrusted, because a fork controls the workflow definition that produces it. The target PR is resolved from the triggering run's own metadata — head SHA and source repo and branch, all GitHub-supplied — so the body can only ever land on the PR that produced it. Consumers are serialised per branch and stamped with the producing run number, so a superseded run cannot overwrite a newer preview.

3. CI / Required — create-a-commit-status 403 (the blocking one)

The ci-required ruleset requires the CI / Required status context:

$ gh api /repos/webdriverio/desktop-mobile/rulesets/18026650 --jq '.rules[] | select(.type=="required_status_checks") | .parameters.required_status_checks[].context'
CI / Required

That context is published by ci-status's final step via gh api .../statuses/$SHA. On a fork PR that call 403s, which fails the step, which fails the job — so the context is never published at all. The ruleset then sits unsatisfied with nothing capable of resolving it, which means external contributions are not merely red, they are unmergeable.

Same split as above:

• ci.yml — the publish step is skipped when the head repo is a fork, since it cannot succeed there. head.repo.fork is null on push/workflow_dispatch, so those keep publishing inline exactly as before.
• ci-required-status.yml (workflow_run, statuses: write) — publishes the context for fork runs from the base-repo context.

The verdict is not taken from anything the fork produces: it reads the conclusion GitHub recorded for the CI Summary job. That job's needs list already encodes the curated required-job set (quarantined legs like e2e-flutter-ios-macos are deliberately excluded there), so ci-status.needs remains the single source of truth and no job list is duplicated. An absent or non-success summary publishes failure rather than nothing, so the context is never left pending with no way to resolve it.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Internal/tooling change (build scripts, CI, etc.)

Testing

• actionlint .github/workflows/*.yml — clean (this is what the lint job runs)
• All three files parse
• Verified actions/download-artifact@v8 supports run-id + github-token for cross-run download, and matched the action versions already used in this repo (upload-artifact@v7, download-artifact@v8, github-script@v9)

Three things that can't be demonstrated on this PR

1. workflow_run workflows only ever run from the copy on the default branch. The comment half therefore does nothing until this merges — this PR's own checks can't exercise it. First real validation is the next PR opened after merge.
2. pull_request workflows run from the PR's merge ref, so already-open fork PRs (fix(tauri): use CSS pixels for embedded window rect #527, feat(tauri): support child webview handles #532) keep using the old pr-title.yml and ci.yml until their base is updated. Re-running after merge, or their next push, picks up the fix.
3. Same for ci-required-status.yml — being a workflow_run workflow it is inert until merged, so the first fork PR to run CI after merge is the real test of the CI / Required path.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CsgeivZCqduTQmWK55zqiT

[greptile-apps]

Greptile Summary

This PR restructures write-scoped checks so fork pull requests can complete without receiving a writable token.

• Removes the unnecessary commit-status write from PR-title validation.
• Produces release-preview markdown in the read-only PR workflow and posts it from a privileged workflow_run consumer.
• Publishes the required CI status for fork runs from a base-repository workflow using the recorded CI summary result.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported privileged-target and stale-update issues are addressed by authoritative target resolution, ambiguity refusal, branch-scoped serialization, and monotonic run stamps.

Important Files Changed

Filename	Overview
.github/workflows/release-preview-comment.yml	Adds a privileged artifact consumer that independently resolves the triggering PR and serializes marker-comment updates to prevent cross-PR and stale-run writes.
.github/workflows/release-preview.yml	Converts release preview generation into a read-only producer that stages markdown and uploads it for the privileged consumer.
.github/workflows/ci-required-status.yml	Adds a base-context workflow-run consumer that publishes the required commit status for completed fork CI runs.
.github/workflows/ci.yml	Skips the impossible inline status write for fork pull requests while preserving it for trusted event contexts.
.github/workflows/pr-title.yml	Removes the WIP mode and status permission that caused otherwise valid fork PR titles to fail on a write request.

Sequence Diagram

sequenceDiagram
    participant PR as Fork PR
    participant Preview as Release Preview workflow
    participant Artifact as Preview artifact
    participant Comment as Privileged comment workflow
    participant CI as CI workflow
    participant Status as Required-status workflow

    PR->>Preview: pull_request event
    Preview->>Preview: Compute preview with read-only token
    Preview->>Artifact: Upload preview markdown
    Artifact->>Comment: workflow_run completion
    Comment->>Comment: Resolve PR from run metadata
    Comment->>PR: Create or update preview comment

    PR->>CI: pull_request event
    CI->>CI: Run required jobs and CI Summary
    CI->>Status: workflow_run completion
    Status->>Status: Read CI Summary conclusion
    Status->>PR: Publish CI / Required status

Loading

_{Reviews (7): Last reviewed commit: "fix(ci): publish CI / Required for fork ..." | Re-trigger Greptile}