Accuracy Report (forks) #24

	name: Accuracy Report (forks)

	# Posts the per-module accuracy comment + Check for FORK PRs, which the in-build
	# `accuracy-report` job cannot do (a fork `pull_request` run gets a read-only
	# token). SECURITY: `workflow_run` runs the workflow definition + code from the
	# DEFAULT branch (trusted), AFTER the fork's build. It only consumes the fork's
	# BMF artifacts (JSON data — parsed/rendered, never executed) and never checks
	# out or runs fork code. No gh-pages write (no contents:write), so forks get the
	# aggregate comment + Check only; the report link points at the develop dashboard.
	on:
	workflow_run:
	workflows: ["Build Linux"]
	types: [completed]

	# Serialize per-fork-PR runs.
	concurrency:
	group: accuracy-fork-${{ github.event.workflow_run.head_sha }}
	cancel-in-progress: true

	permissions:
	checks: write
	pull-requests: write

	jobs:
	fork-report:
	if: >-
	${{ github.event.workflow_run.event == 'pull_request' &&
	github.event.workflow_run.head_repository.fork == true }}
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
	with:
	persist-credentials: false # default-branch (trusted) scripts only

	- name: Set up uv
	uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v7
	with:
	enable-cache: true

	- name: Render aggregate comment + Check and post to the fork PR
	shell: bash
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	RUN_ID: ${{ github.event.workflow_run.id }}
	HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
	run: bash .github/scripts/accuracy-fork-report.sh

Navigation Menu