fix: support workflow_run events for github status and pr comments

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Fixed
+
+- Add support for `workflow_run` events to correctly set GitHub commit status and PR comments when action is triggered from a workflow_run context (e.g., when using secure workflow patterns for fork PRs)
+
 ## [1.6.0] - 2025-05-16
 
 ### Added

action.yml

@@ -321,10 +321,18 @@ runs:
         script: |
           const cid = '${{ steps.merkleize.outputs.cid }}';
 
-          // For PR events, we need to use the head SHA
-          const sha = (context.eventName === 'pull_request' || context.eventName === 'pull_request_target')
-            ? context.payload.pull_request.head.sha
-            : context.sha;
+          // Determine the correct SHA based on the event type
+          let sha;
+          if (context.eventName === 'workflow_run') {
+            // For workflow_run events triggered by PRs, use the PR's head SHA
+            sha = context.payload.workflow_run.head_sha;
+          } else if (context.eventName === 'pull_request' || context.eventName === 'pull_request_target') {
+            // For PR events, use the head SHA
+            sha = context.payload.pull_request.head.sha;
+          } else {
+            // For push events, use the commit SHA
+            sha = context.sha;
+          }
 
           await github.rest.repos.createCommitStatus({
             owner: context.repo.owner,
@@ -336,26 +344,47 @@ runs:
             context: 'IPFS'
           });
 
+    - name: Get PR number for workflow_run
+      if: ${{ inputs.set-pr-comment == 'true' && github.event_name == 'workflow_run' }}
+      id: pr-number
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ inputs.github-token }}
+        script: |
+          // For workflow_run events, we need to find the PR number from the workflow run
+          if (context.payload.workflow_run.event === 'pull_request') {
+            const pulls = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              head: `${context.payload.workflow_run.head_repository.owner.login}:${context.payload.workflow_run.head_branch}`,
+              state: 'open'
+            });
+            if (pulls.data.length > 0) {
+              core.setOutput('number', pulls.data[0].number);
+              core.setOutput('sha', context.payload.workflow_run.head_sha);
+            }
+          }
+
     - name: Find Comment to update
-      if: ${{ inputs.set-pr-comment == 'true' && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') }}
+      if: ${{ inputs.set-pr-comment == 'true' && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target' || (github.event_name == 'workflow_run' && steps.pr-number.outputs.number)) }}
       uses: peter-evans/find-comment@v3
       id: fc
       with:
-        issue-number: ${{ github.event.pull_request.number }}
+        issue-number: ${{ github.event.pull_request.number || steps.pr-number.outputs.number }}
         comment-author: 'github-actions[bot]'
         body-includes: '🚀 Build'
         token: ${{ inputs.github-token }}
 
     - name: Create or update comment
-      if: ${{ inputs.set-pr-comment == 'true' && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') }}
+      if: ${{ inputs.set-pr-comment == 'true' && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target' || (github.event_name == 'workflow_run' && steps.pr-number.outputs.number)) }}
       uses: peter-evans/create-or-update-comment@v4
       with:
         token: ${{ inputs.github-token }}
         comment-id: ${{ steps.fc.outputs.comment-id }}
-        issue-number: ${{ github.event.pull_request.number }}
+        issue-number: ${{ github.event.pull_request.number || steps.pr-number.outputs.number }}
         body: |
           ### 🚀 Build Preview on IPFS ready
-          - 🔎 Commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          - 🔎 Commit: ${{ github.event.pull_request.head.sha || steps.pr-number.outputs.sha || github.sha }}
           - 🔏 CID `${{ steps.merkleize.outputs.cid }}`
           - 📦 Preview:
             - [dweb.link](https://dweb.link/ipfs/${{ steps.merkleize.outputs.cid }})