ci(cache-qualification): skip the OIDC probe for fork PRs

[jdalton]

Root cause

Fork pull requests run with a read-only GITHUB_TOKEN and GitHub refuses to issue an OIDC token for them — id-token: write in permissions: is silently ignored for fork PRs. As a result ACTIONS_ID_TOKEN_REQUEST_URL is empty, and the cache-qualification cache-auth probe (a curl to that URL) exits with curl error 3 ("URL malformed"). The final gate then hard-errors on cache-qualification: failure, red-lining every fork PR even when the rest of CI is green.

This never reproduces on main or same-repo PRs because those contexts do get an OIDC token, so the probe runs normally.

Fix

Two targeted changes in .github/workflows/ci.yml, both gating only on the fork condition:

1. cache-qualification job — append && github.event.pull_request.head.repo.fork != true to its if:, so it skips (neutral, not failed) on fork PRs. Same-repo PRs and main pushes keep the existing if: behavior and still run the probe.
2. final gate — add a FORK_PR: ${{ github.event.pull_request.head.repo.fork }} env var and, when it is "true", add cache-qualification to SKIP_OK. The gate already has this exact pattern for the workflow_dispatch non-main case, so this mirrors the proven shape.

Net behavior:

Event	cache-qualification	final
fork PR	skipped (allowed)	pass
same-repo PR	runs	pass only if probe succeeds
main push	runs	pass only if probe succeeds

Provenance

This is the same ci.yml change already applied inline on three feature PRs so they could pass CI from forks:

• #1325
• #1326
• #1327

Landing it standalone on main means:

• Those three PRs can drop their inline copy and merge cleanly (no ci.yml conflict between them).
• Future fork PRs to jdx/aube pass CI without needing to re-apply the workaround.

The diff is ci.yml-only — no feature code, no mise.toml, no behavior change for non-fork events.

[coderabbitai]

Warning

Review limit reached

@jdalton, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 20 minutes

Limit details: You’ve used all 4 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e2b3d0d-c631-4a89-bacc-1ab3d6499a01

📥 Commits

Reviewing files that changed from the base of the PR and between b34dfb2 and 06e7ef2.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR prevents fork pull requests from failing when GitHub withholds the OIDC token required by cache qualification.

• Skips cache-qualification specifically for fork pull requests.
• Allows that expected skipped result in the final CI gate.
• Preserves cache qualification for same-repository pull requests, main pushes, and eligible manual runs.

Confidence Score: 5/5

The PR appears safe to merge because the new fork-specific skip is narrowly scoped and consistently handled by the final gate.

The cache qualification job and final aggregator use matching fork and manual-dispatch conditions, while non-fork pull requests and main runs continue requiring successful cache qualification.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	The fork-specific job condition and final-gate exception are aligned across all configured workflow event types, with no actionable defect identified.

_{Reviews (1): Last reviewed commit: "ci(cache-qualification): skip the OIDC p..." | Re-trigger Greptile}