[PR #12] [MERGED] cursor-review: skip fork PRs; degrade to job summary on read-only token #25

New issue

Closed

opened 2026-10-26 22:35:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:30 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/12
Author: @mattmillerai
Created: 6/22/2026
Status: ✅ Merged
Merged: 6/22/2026
Merged by: @mattmillerai

Base: main ← Head: fix/cursor-review-fork-pr-403

📝 Commits (1)

eebcd8a Skip cursor-review on fork PRs; degrade to job summary on read-only token

📊 Changes

2 files changed (+112 additions, -20 deletions)

View changed files

📝 .github/cursor-review/post-review.py (+97 -20)
📝 .github/workflows/cursor-review.yml (+15 -0)

📄 Description

What

Two complementary fixes so cursor-review stops failing red on PRs it fundamentally can't review.

Why

A fork PR (Comfy-Desktop#973) failed the cursor-review check. Tracing it:

The linked panel cell (adversarial (gemini-3.1-pro)) actually passed — every panel cell did.

The run went red in Consolidate panel → Post review:

No-findings review POST failed: gh: Resource not accessible by integration (HTTP 403)

Root cause: on a PR from a fork, the pull_request event gives the workflow no secrets and a read-only GITHUB_TOKEN. So:

CURSOR_API_KEY is empty → cursor-agent errors Authentication required on all 8 cells → every cell produces empty output → judge skipped → "no findings".
The read-only token can't POST a review → HTTP 403 → job fails.

The review can neither analyze nor post on a fork PR, yet it still ran the full 8-cell matrix + judge and failed the check on every external contribution.

Changes

1. Gate — skip fork PRs (cursor-review.yml)
Skip when head.repo.full_name != github.repository (the cross-repo signal, == isCrossRepository). No wasted matrix, no red X — the check is simply skipped, the standard outcome for a workflow that needs secrets a fork PR can't have.

2. post-review.py — degrade to job summary on a read-only-token 403 (defense-in-depth)
If a review POST fails with Resource not accessible by integration / HTTP 403, render the review into the job step summary and exit 0 instead of failing. Covers same-repo runs that can still hit a read-only token (read-only default workflow permissions, token-downgrading events). Genuine non-permission failures (e.g. HTTP 422) still exit 1 — no silent swallow.

Testing

python3 -m py_compile post-review.py and YAML parse — both clean.
Smoke-tested post-review.py with a fake gh:
- read-only 403 (the #973 case) → writes review to $GITHUB_STEP_SUMMARY, exit 0 ✓
- non-permission 422 → still exit 1 (inline + fallback both fail) ✓
- happy path (POST succeeds) → exit 0, nothing written to summary ✓

Not done (and why)

pull_request_target would grant a write token on fork PRs, but cursor-review checks out and runs an agent over untrusted PR code — handing that a privileged token is the textbook fork-PR footgun. The proper "review forks too" path is a separate workflow_run job that posts from base-repo context; out of scope here.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/12 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 6/22/2026 **Status:** ✅ Merged **Merged:** 6/22/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `fix/cursor-review-fork-pr-403` --- ### 📝 Commits (1) - [`eebcd8a`](https://github.com/Comfy-Org/github-workflows/commit/eebcd8ac88bfac60f4095cf157e81798920c13a4) Skip cursor-review on fork PRs; degrade to job summary on read-only token ### 📊 Changes **2 files changed** (+112 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `.github/cursor-review/post-review.py` (+97 -20) 📝 `.github/workflows/cursor-review.yml` (+15 -0) </details> ### 📄 Description ## What Two complementary fixes so cursor-review stops failing red on PRs it fundamentally can't review. ## Why A fork PR ([Comfy-Desktop#973](https://github.com/Comfy-Org/Comfy-Desktop/pull/973)) failed the `cursor-review` check. Tracing it: - The linked panel cell (`adversarial (gemini-3.1-pro)`) actually **passed** — every panel cell did. - The run went red in `Consolidate panel → Post review`: ``` No-findings review POST failed: gh: Resource not accessible by integration (HTTP 403) ``` Root cause: on a PR from a fork, the `pull_request` event gives the workflow **no secrets and a read-only `GITHUB_TOKEN`**. So: 1. `CURSOR_API_KEY` is empty → `cursor-agent` errors `Authentication required` on all 8 cells → every cell produces empty output → judge skipped → "no findings". 2. The read-only token can't POST a review → HTTP 403 → job fails. The review can **neither analyze nor post** on a fork PR, yet it still ran the full 8-cell matrix + judge and failed the check on every external contribution. ## Changes **1. Gate — skip fork PRs** (`cursor-review.yml`) Skip when `head.repo.full_name != github.repository` (the cross-repo signal, == `isCrossRepository`). No wasted matrix, no red X — the check is simply skipped, the standard outcome for a workflow that needs secrets a fork PR can't have. **2. `post-review.py` — degrade to job summary on a read-only-token 403** (defense-in-depth) If a review POST fails with `Resource not accessible by integration` / `HTTP 403`, render the review into the **job step summary** and exit 0 instead of failing. Covers same-repo runs that can still hit a read-only token (read-only default workflow permissions, token-downgrading events). Genuine non-permission failures (e.g. HTTP 422) still exit 1 — no silent swallow. ## Testing - `python3 -m py_compile post-review.py` and YAML parse — both clean. - Smoke-tested `post-review.py` with a fake `gh`: - read-only 403 (the #973 case) → writes review to `$GITHUB_STEP_SUMMARY`, **exit 0** ✓ - non-permission 422 → still **exit 1** (inline + fallback both fail) ✓ - happy path (POST succeeds) → **exit 0**, nothing written to summary ✓ ## Not done (and why) `pull_request_target` would grant a write token on fork PRs, but cursor-review checks out and runs an agent over untrusted PR code — handing that a privileged token is the textbook fork-PR footgun. The proper "review forks too" path is a separate `workflow_run` job that posts from base-repo context; out of scope here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:30 +00:00