From 455d88755c59ad5929ac76d9a9ada5648157a3c2 Mon Sep 17 00:00:00 2001 From: thc1006 <84045975+thc1006@users.noreply.github.com> Date: Sat, 8 Aug 2026 11:05:16 +0800 Subject: [PATCH] CI: write the changelog entry for pull requests from forks too GitHub withholds secrets from a `pull_request` run whose head is a fork, so RELEASE_TOKEN arrived empty and the checkout stopped five seconds in with "Input required and not supplied: token". Nothing else refers to the changelog, so the merge completed and the entry was simply absent. The split was clean in both directions across every run still on record: #1097, #1070 and #1052 came from forks and failed; #1079, #1082 and #1056 came from branches here and passed. `pull_request_target` receives the secrets. It is usually the dangerous trigger, but not here: the job checks out RocketPy-Team/RocketPy at develop rather than the pull request, and there is no reference to head.sha, head.ref or head.repo anywhere in the file, so no contributor code runs. Title and body were already being handled as untrusted, passed through the environment and read in Python rather than interpolated into a shell. `github.event.pull_request` keeps the same shape, so the merged guard and PR_NUMBER carry over unchanged. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com> --- .github/workflows/changelog.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 6ad2ec49b..8bd87ad43 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -1,6 +1,10 @@ name: Populate Changelog on: - pull_request: + # `pull_request_target`, not `pull_request`: secrets are withheld from a + # `pull_request` run whose head is a fork, so RELEASE_TOKEN arrived empty and + # the checkout below failed for every outside contribution. Nothing here runs + # code from the pull request, only the trusted tree checked out below. + pull_request_target: types: [closed] branches: - develop