From 2619a2e265dd665ab598243dd4debe789c2eed96 Mon Sep 17 00:00:00 2001
From: thc1006 <84045975+thc1006@users.noreply.github.com>
Date: Sat, 8 Aug 2026 21:52:52 +0800
Subject: [PATCH] Skip the PR comment on runs that cannot post it

The comment step fails on every pull request from a fork, and only those:

  Lint                success
  Format check        success
  Run script          success
  Upload report.html  success
  Comment on PR       failure   HttpError 403, resource not accessible

This repository is public, so a `pull_request` run whose head is a fork gets a
read-only GITHUB_TOKEN. `permissions: pull-requests: write` cannot raise that,
only narrow what the event already grants. Every earlier run came from a branch
on the repository itself, which does get a write token, so the step had not been
reached from a fork until #2.

Skipped rather than tolerated with continue-on-error: a step that cannot succeed
is better not attempted. The report is unaffected either way, since it is
uploaded as the `report` artifact one step earlier.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
---
 .github/workflows/ci.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd9113a..4bf9da2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,9 +52,14 @@ jobs:
           path: _output/report.html
           archive: false
 
+      # Skipped for forks: a `pull_request` run whose head is a fork gets a
+      # read-only GITHUB_TOKEN whatever `permissions` says, so this step can
+      # only 403. The report is on the run either way, as the `report` artifact.
       - name: Comment on PR
         uses: actions/github-script@v9
-        if: github.event_name == 'pull_request'
+        if: >-
+          github.event_name == 'pull_request'
+          && !github.event.pull_request.head.repo.fork
         with:
           script: |
             github.rest.issues.createComment({