fix(ci): support fork PR workflows for community contributors

.github/workflows/coverage.yml

@@ -113,18 +113,30 @@ jobs:
               f.write('body<<EOF\n')
               f.write(body + '\n')
               f.write('EOF\n')
+
+          with open('/tmp/coverage_comment.md', 'w') as f:
+              f.write(body)
           PYEOF
 
+      - name: Save comment as artifact (for fork PRs)
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-comment
+          path: /tmp/coverage_comment.md
+          retention-days: 1
+
       - name: Find existing comment
         uses: peter-evans/find-comment@v3
         id: fc
+        if: github.event.pull_request.head.repo.full_name == github.repository
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
           body-includes: '<!-- pr-coverage-bot -->'
 
       - name: Create or update comment
         uses: peter-evans/create-or-update-comment@v4
+        if: github.event.pull_request.head.repo.full_name == github.repository
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/fork-pr-comment.yml

@@ -0,0 +1,87 @@
+name: Post Fork PR Comments
+
+# Runs after Coverage / Metrics Gate complete — has write access to post comments
+# even when the triggering PR came from a fork.
+on:
+  workflow_run:
+    workflows: ["Coverage", "Metrics Gate"]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+  actions: read
+
+jobs:
+  comment:
+    # Only run for fork PRs (same-repo PRs post comments directly)
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine artifact name
+        id: meta
+        run: |
+          WF="${{ github.event.workflow_run.name }}"
+          if [ "$WF" = "Coverage" ]; then
+            echo "artifact=coverage-comment" >> "$GITHUB_OUTPUT"
+            echo "marker=<!-- pr-coverage-bot -->" >> "$GITHUB_OUTPUT"
+          elif [ "$WF" = "Metrics Gate" ]; then
+            echo "artifact=metrics-comment" >> "$GITHUB_OUTPUT"
+            echo "marker=<!-- pr-metrics-bot -->" >> "$GITHUB_OUTPUT"
+          else
+            echo "Unknown workflow: $WF"
+            exit 1
+          fi
+
+      - name: Get PR number
+        id: pr
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const result = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              head: `${context.payload.workflow_run.head_repository.owner.login}:${context.payload.workflow_run.head_branch}`,
+            });
+            if (result.data.length > 0) {
+              core.setOutput('number', result.data[0].number);
+            } else {
+              core.setFailed('Could not find PR for this workflow run');
+            }
+
+      - name: Download artifact
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ steps.meta.outputs.artifact }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path: /tmp/comment
+
+      - name: Find comment file
+        if: steps.download.outcome == 'success'
+        id: file
+        run: |
+          FILE=$(find /tmp/comment -name '*.md' | head -1)
+          echo "path=${FILE}" >> "$GITHUB_OUTPUT"
+
+      - name: Find existing comment
+        if: steps.download.outcome == 'success'
+        uses: peter-evans/find-comment@v3
+        id: fc
+        with:
+          issue-number: ${{ steps.pr.outputs.number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: ${{ steps.meta.outputs.marker }}
+
+      - name: Create or update comment
+        if: steps.download.outcome == 'success'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          issue-number: ${{ steps.pr.outputs.number }}
+          body-path: ${{ steps.file.outputs.path }}
+          edit-mode: replace

.github/workflows/metrics.yml

@@ -603,16 +603,25 @@ jobs:
 
           echo "gate_fail=${GATE_FAIL}" >> "$GITHUB_OUTPUT"
 
+      - name: Save comment as artifact (for fork PRs)
+        uses: actions/upload-artifact@v4
+        with:
+          name: metrics-comment
+          path: /tmp/metrics_comment.md
+          retention-days: 1
+
       - name: Find existing metrics comment
         uses: peter-evans/find-comment@v3
         id: fc
+        if: github.event.pull_request.head.repo.full_name == github.repository
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
           body-includes: '<!-- pr-metrics-bot -->'
 
       - name: Create or update metrics comment
         uses: peter-evans/create-or-update-comment@v4
+        if: github.event.pull_request.head.repo.full_name == github.repository
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/screenshot.yml

@@ -22,7 +22,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.head_ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event.pull_request.head.ref || github.ref }}
           fetch-depth: 0
 
       - name: Build screenshot Docker image
@@ -51,6 +52,7 @@ jobs:
 
       # Push screenshots to a ref so we can embed them in the PR comment
       - name: Push screenshots to ref
+        if: github.event.pull_request.head.repo.full_name == github.repository
         id: push_ref
         run: |
           REF_NAME="screenshots/pr-${{ github.event.pull_request.number || 'manual' }}"
@@ -69,9 +71,10 @@ jobs:
           echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
           # Return to PR branch
-          git checkout "${{ github.head_ref }}" 2>/dev/null || git checkout "${{ github.sha }}"
+          git checkout "${{ github.event.pull_request.head.ref }}" 2>/dev/null || git checkout "${{ github.sha }}"
 
       - name: Generate PR comment body
+        if: github.event.pull_request.head.repo.full_name == github.repository
         id: comment
         run: |
           REF="${{ steps.push_ref.outputs.ref }}"
@@ -143,15 +146,15 @@ jobs:
       - name: Find existing screenshot comment
         uses: peter-evans/find-comment@v3
         id: fc
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
           body-includes: '<!-- pr-screenshot-bot -->'
 
       - name: Create or update screenshot comment
         uses: peter-evans/create-or-update-comment@v4
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}