33#
44# Purpose: Automate labeling, assignment, and welcoming of pull requests for forked PRs.
55#
6- # Configuration: All settings are loaded from modular .github/env/ files for
6+ # Configuration: All settings are loaded from modular .github/env/*.env files for
77# centralized management across all workflows.
88#
99# Triggers: Pull request events (opened, reopened, ready for review, closed, synchronize)
@@ -108,7 +108,7 @@ concurrency:
108108# --------------------------------------------------------------------
109109# Environment Variables
110110# --------------------------------------------------------------------
111- # Note: Configuration variables are loaded from modular .github/env/ files
111+ # Note: Configuration variables are loaded from modular .github/env/*.env files
112112
113113jobs :
114114 # ------------------------------------------------------------
@@ -117,8 +117,8 @@ jobs:
117117 load-env :
118118 name : 🌍 Load Environment (Base Repo)
119119 runs-on : ubuntu-latest
120- # Early exit: Skip entire workflow for same-repo PRs ( handled by main workflow)
121- if : github.event.pull_request.head.repo.full_name != github.repository
120+ # Only run for fork PRs - same-repo PRs are handled by pull-request-management.yml
121+ if : ${{ github.event.pull_request.head.repo.full_name != github.repository }}
122122 # No write perms here
123123 permissions :
124124 contents : read
@@ -127,14 +127,14 @@ jobs:
127127 steps :
128128 # ┌─────────────────────────────────────────────────────────────────────┐
129129 # │ SECURITY SCANNERS: This checkout is SAFE despite pull_request_target│
130- # │ │
131- # │ Justification: │
130+ # │ │
131+ # │ Justification: │
132132 # │ - Only checks out TRUSTED base branch (ref: github.base_ref) │
133133 # │ - NEVER checks out PR head code from untrusted fork │
134134 # │ - Implements recommended two-workflow security pattern │
135135 # │ - Uses sparse checkout (minimal attack surface) │
136136 # │ - No executable code from PR is ever run │
137- # │ │
137+ # │ │
138138 # │ Pattern: Two-workflow security model (see SECURITY.md) │
139139 # │ References: githubactions:S7631, semgrep:github-actions-checkout │
140140 # └─────────────────────────────────────────────────────────────────────┘
@@ -177,6 +177,8 @@ jobs:
177177 detect-fork :
178178 name : 🔍 Detect Fork PR
179179 runs-on : ubuntu-latest
180+ # Only run for fork PRs - same-repo PRs are handled by pull-request-management.yml
181+ if : ${{ github.event.pull_request.head.repo.full_name != github.repository }}
180182 permissions :
181183 contents : read
182184 outputs :
@@ -478,7 +480,8 @@ jobs:
478480 summary :
479481 name : 📊 Summary
480482 runs-on : ubuntu-latest
481- if : always()
483+ # Only run for fork PRs, but always show summary regardless of job status
484+ if : always() && github.event.pull_request.head.repo.full_name != github.repository
482485 needs : [load-env, detect-fork, handle-fork, clean-cache]
483486 steps :
484487 - name : 📄 Write summary
0 commit comments