fix(ci): skip secret-dependent jobs on fork PRs [BLDX-1113]#1521
Merged
Aryamanz29 merged 4 commits intomainfrom Apr 22, 2026
Merged
fix(ci): skip secret-dependent jobs on fork PRs [BLDX-1113]#1521Aryamanz29 merged 4 commits intomainfrom
Aryamanz29 merged 4 commits intomainfrom
Conversation
Aryamanz29
requested review from
OnkarVO7,
atlan-ci,
cmgrote,
louisnow and
vaibhavatlan
as code owners
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
vaibhavatlan
previously approved these changes
Apr 22, 2026
Collaborator
vaibhavatlan
left a comment
vaibhavatlan
left a comment
There was a problem hiding this comment.
Good catch! Looks good to me
Add fork detection to jobs that require org secrets (ORG_PAT_GITHUB, CHAINGUARD_*, database credentials). Fork PRs now gracefully skip these jobs instead of failing with "token not supplied". Jobs gated on fork != true: - Conventional Commits (needs ORG_PAT_GITHUB) - Trivy Container Scan (needs Chainguard creds) - Run Examples (needs Postgres/Snowflake creds) - E2E Apps (needs ORG_PAT to trigger external workflows) Jobs that still run on forks: - Changes detection, Docstring coverage, Trivy code scan - Unit tests, Integration tests - Helm lint, E2E K8s
Workflow-only PRs were stuck because the paths-filter never set code=true, so required checks (Unit Tests matrix) never ran and GitHub waited forever for status to be reported. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
📜 Docstring Coverage ReportRESULT: PASSED (minimum: 30.0%, actual: 80.1%) Detailed Coverage Report |
Contributor
📦 Trivy Vulnerability Scan Results
Report SummaryCould not generate summary table (data length mismatch: 9 vs 8). Scan Result Detailsrequirements.txtuv.lock |
Contributor
📦 Trivy Secret Scan Results
Report SummaryCould not generate summary table (data length mismatch: 9 vs 8). Scan Result Detailsrequirements.txtuv.lock |
Collaborator
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
Contributor
|
🛠 Full Test Coverage Report: https://k.atlan.dev/coverage/application-sdk/pr/1521 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fork PRs fail because org secrets aren't available. This adds fork detection so secret-dependent jobs skip gracefully instead of crashing.
Changes
Added
github.event.pull_request.head.repo.fork != truecondition to 4 jobs:ORG_PAT_GITHUBCHAINGUARD_*credentialsORG_PAT_GITHUBto trigger external workflowsWhat still runs on forks
Changes detection, docstring coverage, Trivy code scan, unit tests, integration tests, Helm lint, E2E K8s — all work without secrets.
Closes #756
Linear
https://linear.app/atlan-epd/issue/BLDX-1113