ci: fix SQLFluff annotation permissions for fork PRs - #2148
Conversation
Fork PRs need an explicit checks:write grant so the annotation action can post findings without relying on the default GITHUB_TOKEN scope.
Avoid running the annotations action against a missing annotations.json on PRs that do not touch mimic-iv/concepts, and tolerate unauthorized check writes with ignore-unauthorized-error.
Spell out why the workflow sets checks:write and ignore-unauthorized-error so future edits do not reintroduce continue-on-error.
Point contributors at the workflow that reviews changed MIMIC-IV concept SQL.
Mirrors the PR workflow so contributors can lint mimic-iv/concepts changes before pushing.
|
This unblocks fork PRs: every recent Chessing234 mimic-iv PR is red only on the Annotate step ( |
ignore-unauthorized-error does not catch the fork 403 (Resource not accessible by integration). Skip Annotate when head.repo != base repo so lint-mimic-iv can stay green.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
@alistairewj this is the focused SQLFluff annotate-permissions follow-up split out of #2128 ( |
7435551 to
d83dbaf
Compare
fork annotate fix lives in MIT-LCP#2148
same fix as MIT-LCP#2148 — skip annotate when head repo is a fork
|
@alistairewj small ci-only PR — skips sqlfluff annotate on fork PRs. green on my side, ready when you have a moment. |
no need to tag me to bump, I follow the repo |
|
understood, sorry for the noise — won't tag you to bump again. Generated by Claude Code |
2 participants
Summary
contents: read+checks: write, skip annotate when no concept SQL changed, and setignore-unauthorized-error: true.Test plan
mimic-iv/concepts/**/*.sql— SQLFluff job should skip lint/annotate cleanly.sqlfile — annotations post (or are ignored gracefully on forks)./scripts/lint_changed_mimic_iv_concepts.shagainst a branch with concept editsMade with Cursor