From cef9cfe81183bbd6ab4674cb5236d57434bcf410 Mon Sep 17 00:00:00 2001
From: Yaroslav98214 <diakovichyaroslav30@gmail.com>
Date: Thu, 16 Jul 2026 17:49:59 +0000
Subject: [PATCH] ci(coderabbit-gate): tolerate status-publish 403 on fork prs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

the gate job publishes the required `coderabbit-approved` commit status
via POST /repos/{repo}/statuses/{sha}. for a pr opened from a fork the
GITHUB_TOKEN can't write a status onto the fork's head sha, so the api
returns 403 "resource not accessible by integration". that failed the
whole job and put a red check on every external contribution — even when
the review verdict was `approved`.

the unset status already blocks native auto-merge on its own (the ruleset
keeps waiting for it), so failing this infra job adds only noise for
outside contributors. treat a 403 on a fork head as expected: warn and
succeed. same-repo prs still hard-fail if the publish fails.
---
 .github/workflows/coderabbit-gate.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/coderabbit-gate.yml b/.github/workflows/coderabbit-gate.yml
index 8a091165..0479b63d 100644
--- a/.github/workflows/coderabbit-gate.yml
+++ b/.github/workflows/coderabbit-gate.yml
@@ -47,6 +47,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           STATE: ${{ steps.gate.outputs.state }}
           VERDICT: ${{ steps.gate.outputs.verdict }}
@@ -56,8 +57,22 @@ jobs:
             changes)  desc="CodeRabbit requested changes — resolve them to merge." ;;
             *)        desc="Waiting for CodeRabbit to review this commit." ;;
           esac
-          gh api --method POST "repos/$REPO/statuses/$HEAD_SHA" \
-            -f state="$STATE" -f context="coderabbit-approved" -f description="$desc"
+          # the GITHUB_TOKEN can't write a commit status onto a fork's head sha —
+          # POST .../statuses returns 403 "resource not accessible by integration"
+          # for a pr opened from a fork. that's expected and unfixable with this
+          # token, so don't fail this infra job over it: the required status simply
+          # stays unset, native auto-merge waits, and a maintainer merges the fork
+          # pr by hand. same-repo prs must still publish, so only forks are tolerated.
+          if gh api --method POST "repos/$REPO/statuses/$HEAD_SHA" \
+               -f state="$STATE" -f context="coderabbit-approved" -f description="$desc"; then
+            exit 0
+          fi
+          if [ "$HEAD_REPO" != "$REPO" ]; then
+            echo "::warning::could not publish the coderabbit-approved status on a fork pr head ($HEAD_REPO); a maintainer must merge this pr manually (or wire a token with statuses:write for cross-fork writes)."
+            exit 0
+          fi
+          echo "::error::failed to publish the coderabbit-approved status"
+          exit 1
       - name: auto-close after 3 rejected rounds
         if: steps.gate.outputs.close == 'true'
         env: