fix(ci): build-artifact fails on fork PRs — NPM_TOKEN secret unavailable to pull_request from forks #366

🤖 ework agent · qwen3.8-27b

来源: 分析 PR #341 时发现

Problem

The build-artifact job (.github/workflows/pr-artifact.yml) fails with ENEEDAUTH on every PR opened from a fork repository. Every PR from a same-repo branch succeeds.

Evidence (PR #341, head 34473c3)

Job log (actions/jobs/100839297387/logs):

Publishing version 1.14.27-pr.341.98 with tag pr-341
npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/

Workflow run history for pr-artifact.yml: all runs whose head repo is ranxianglei/opencode-acp → success; the single run whose head repo is a fork → failure.

Root cause

GitHub does not pass repository secrets to workflows triggered by pull_request events from forks. The "Publish to npm with PR tag" step sets NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}, which is empty for fork PRs, so npm publish aborts with ENEEDAUTH before the tarball / artifact-upload / install-instructions-comment steps ever run.

Impact

• External contributors' PRs get no opencode-acp@pr-N npm tag, and because the failing step precedes them, the tarball artifact and the "📦 Built Plugin Artifact" install-instructions comment are also never produced.
• The red check flips PR mergeable_state to unstable (cosmetic noise — pr-validation is the required gate).

Suggested fix

Gate the publish step on the secret actually being available, and keep the remaining steps running for fork PRs:

# robust form (no env restructuring needed):
- name: Publish to npm with PR tag
  if: github.event.pull_request.head.repo.full_name == github.repository
  ...

Alternative: hoist NODE_AUTH_TOKEN to job-level env: and use if: env.NODE_AUTH_TOKEN != ''.

With the guard in place, fork PRs skip the npm tag but still get the tarball artifact and install instructions (the github:owner/repo#branch and artifact-download options do not require publishing).

Mirrored from ework issue #366