From 7d4311fe58026ab3c02b37ff0e8e45fb71bcf2ce Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Wed, 29 Jul 2026 01:11:10 +0000 Subject: [PATCH] Skip the desktop jobs on fork PRs instead of failing them Every desktop-v* release in this repo is a draft, and GitHub lists drafts only to a token with push access, which is why resolving one needs contents: write. A pull request from a fork receives a read-only token no matter what the workflow declares, so on those runs the resolver cannot see any release and the job died on "no desktop-v* release visible", accusing the repo of having no bundle when the real cause is the trigger. This workflow runs on pull_request for changes to itself and the stripping scripts, so an outside contributor editing either would have hit that. Guard the three jobs on the head repo not being a fork. A skipped job is honest here: it does not claim to have tested a bundle it was never able to download, and it is not reported as a pass. --- .github/workflows/desktop-app-clean-machine-ci.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/desktop-app-clean-machine-ci.yml b/.github/workflows/desktop-app-clean-machine-ci.yml index 67f7710494..a2e92a271b 100644 --- a/.github/workflows/desktop-app-clean-machine-ci.yml +++ b/.github/workflows/desktop-app-clean-machine-ci.yml @@ -74,6 +74,10 @@ env: jobs: # ── macOS: .dmg, Apple Silicon ──────────────────────────────────────────── macos: + # A fork PR's token is read-only however this workflow declares permissions, so it + # cannot list the draft releases every desktop-v* bundle is published as. Skip + # rather than fail: it is a property of the trigger, not a broken release. + if: github.event.pull_request.head.repo.fork != true name: desktop macOS ${{ matrix.os }} runs-on: ${{ matrix.os }} timeout-minutes: 45 @@ -258,6 +262,10 @@ jobs: # ── Linux: .deb and .AppImage, with a real webview under Xvfb ──────────── linux: + # A fork PR's token is read-only however this workflow declares permissions, so it + # cannot list the draft releases every desktop-v* bundle is published as. Skip + # rather than fail: it is a property of the trigger, not a broken release. + if: github.event.pull_request.head.repo.fork != true name: desktop linux ${{ matrix.kind }} runs-on: ubuntu-22.04 timeout-minutes: 45 @@ -426,6 +434,10 @@ jobs: # ── Windows: NSIS setup.exe, silent install ────────────────────────────── windows: + # A fork PR's token is read-only however this workflow declares permissions, so it + # cannot list the draft releases every desktop-v* bundle is published as. Skip + # rather than fail: it is a property of the trigger, not a broken release. + if: github.event.pull_request.head.repo.fork != true name: desktop windows runs-on: windows-latest # 60, not 45: this job runs the bundled installer, and a full torch install on a