Fix fork-based pull request label checks

Author: UltraProdigy

.github/workflows/label-test.yml

@@ -11,13 +11,24 @@ on:
         description: "Ref to check out from the central Label Sync repository."
         required: true
         type: string
+      review_signal_run_id:
+        description: "Review signal workflow run whose artifact identifies the pull request."
+        required: false
+        type: number
+        default: 0
+      review_signal_head_sha:
+        description: "Pull request head SHA recorded by the review signal workflow run."
+        required: false
+        type: string
+        default: ""
 
-# The repository and pull request under test are read from the caller's context rather
-# than passed as inputs: inside a reusable workflow, github.repository resolves to the
-# calling repository and github.event is the caller's triggering event. Keeping them out
-# of the input contract means the distributed caller workflows never need to change.
+# The target repository and event are read from the caller's context: inside a reusable
+# workflow, github.repository and github.event describe the calling workflow. The review
+# artifact is untrusted input and is validated against the workflow run's recorded head
+# SHA before the configured PAT or GitHub App token reruns the authoritative policy run.
 
 permissions:
+  actions: read
   contents: read
   issues: read
   pull-requests: read
@@ -27,6 +38,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Download review context
+        if: ${{ github.event_name == 'workflow_run' }}
+        uses: actions/download-artifact@v8
+        with:
+          name: label-test-review-context
+          path: ${{ runner.temp }}/label-test-review-context
+          run-id: ${{ inputs.review_signal_run_id }}
+          github-token: ${{ github.token }}
+
       - name: Check out Label Sync repository
         uses: actions/checkout@v7
         with:
@@ -64,8 +84,18 @@ jobs:
         run: node scripts/create-github-auth-token.mjs
 
       - name: Check PR labels and approvals
+        if: ${{ github.event_name == 'pull_request_target' }}
         env:
           TARGET_REPOSITORY: ${{ github.repository }}
           PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_TOKEN: ${{ github.token }}
         run: node scripts/check-pr-label-policy.mjs
+
+      - name: Rerun authoritative Label Test
+        if: ${{ github.event_name == 'workflow_run' }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          TARGET_REPOSITORY: ${{ github.repository }}
+          PULL_REQUEST_NUMBER_FILE: ${{ runner.temp }}/label-test-review-context/pr-number.txt
+          REVIEW_SIGNAL_HEAD_SHA: ${{ inputs.review_signal_head_sha }}
+        run: node scripts/rerun-label-policy.mjs

.github/workflows/refresh-label-test.yml

@@ -11,9 +11,18 @@ on:
         description: "Ref to check out from the central Label Sync repository."
         required: true
         type: string
+      review_signal_run_id:
+        description: "Unprivileged review workflow run containing the pull request number artifact."
+        required: true
+        type: number
+      review_signal_head_sha:
+        description: "Pull request head SHA recorded by GitHub for the review workflow run."
+        required: true
+        type: string
 
-# The repository and pull request are read from the caller's context rather than passed
-# as inputs. See the equivalent note in label-test.yml.
+# The target repository comes from the caller's trusted workflow_run context. The pull
+# request number crosses the privilege boundary as untrusted artifact data and is checked
+# against review_signal_head_sha before the workflow uses elevated credentials.
 
 permissions:
   actions: write
@@ -24,6 +33,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Download review context
+        uses: actions/download-artifact@v8
+        with:
+          name: label-test-review-context
+          path: ${{ runner.temp }}/label-test-review-context
+          run-id: ${{ inputs.review_signal_run_id }}
+          github-token: ${{ github.token }}
+
       - name: Check out Label Sync repository
         uses: actions/checkout@v7
         with:
@@ -35,9 +52,35 @@ jobs:
         with:
           node-version: "24"
 
+      - name: Load properties
+        id: properties
+        env:
+          GITHUB_REPOSITORY: ${{ inputs.label_sync_repository }}
+        run: node scripts/export-properties.mjs
+
+      - name: Resolve PAT auth token
+        id: pat_auth
+        if: ${{ steps.properties.outputs.auth_mode == 'pat' }}
+        env:
+          AUTH_MODE: pat
+          PAT_TOKEN: ${{ secrets[steps.properties.outputs.pat_token_secret_name] }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node scripts/create-github-auth-token.mjs
+
+      - name: Resolve GitHub App auth token
+        id: app_auth
+        if: ${{ steps.properties.outputs.auth_mode == 'githubApp' }}
+        env:
+          AUTH_MODE: githubApp
+          GITHUB_APP_ID: ${{ secrets[steps.properties.outputs.github_app_id_secret_name] }}
+          GITHUB_APP_PRIVATE_KEY: ${{ secrets[steps.properties.outputs.github_app_private_key_secret_name] }}
+          GITHUB_APP_INSTALLATION_ID: ${{ secrets[steps.properties.outputs.github_app_installation_id_secret_name] }}
+        run: node scripts/create-github-auth-token.mjs
+
       - name: Rerun authoritative Label Test
         env:
           GITHUB_TOKEN: ${{ github.token }}
           TARGET_REPOSITORY: ${{ github.repository }}
-          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+          PULL_REQUEST_NUMBER_FILE: ${{ runner.temp }}/label-test-review-context/pr-number.txt
+          REVIEW_SIGNAL_HEAD_SHA: ${{ inputs.review_signal_head_sha }}
         run: node scripts/rerun-label-policy.mjs

README.md

@@ -192,20 +192,20 @@ Behavior:
 
 For team approval checks, the workflow token must be able to read the configured organization team membership. The same `properties.authentication` setup used by the label sync workflows is used for the reusable Label Test workflow.
 
-The policy check runs on `pull_request_target` only, so it publishes exactly one check. Review submissions, edits, and dismissals do not create a second policy check. Instead, a separate review-refresh workflow reruns the latest completed policy run for that pull request, letting a new approval replace an earlier failed result on the same check.
+The policy job runs on `pull_request_target` only. Review submissions, edits, and dismissals are recorded by a separate unprivileged workflow, then the existing Label Test workflow handles its completion through `workflow_run` and reruns the latest completed policy run for that pull request. This lets a new approval replace an earlier failed result on the same required check.
 
-`pull_request_review` always executes from the target repository's default branch, the pull request number comes from GitHub's event payload rather than contributor-controlled data, and the refresh job never checks out pull request code. It only calls the Actions rerun API, so granting it `actions: write` is safe for fork pull requests.
+Fork `pull_request_review` runs cannot access repository secrets or an `actions: write` token. The review workflow therefore only uploads the pull request number as a short-lived artifact. Its `workflow_run` continuation executes from the target repository's default branch with the configured authentication, downloads the artifact outside the workspace, and verifies the referenced pull request still has the head SHA recorded by GitHub for the review run before calling the Actions rerun API. Neither stage checks out or executes pull request code.
 
 A pull request shows one check until someone submits a review, and two afterwards. The refresh workflow reacts to every review regardless of labels, because GitHub cannot filter a workflow trigger by pull request label, and narrowing it with a job-level condition would publish a permanently skipped check instead. Reducing this to a single check in all cases would require a GitHub App posting a check run through the Checks API rather than distributed workflows.
 
 ### 05 - Distribute-Label-Workflow
 
 Run `05 - Distribute-Label-Workflow` manually to install or update the Label Test workflows in selected repositories. It writes these files in each selected target repository:
 
-- `.github/workflows/label-test.yml`: the single required policy check, on `pull_request_target`
-- `.github/workflows/label-test-review-refresh.yml`: reruns the policy check after a review
+- `.github/workflows/label-test.yml`: the required policy check on `pull_request_target` and its privileged `workflow_run` continuation
+- `.github/workflows/label-test-review-refresh.yml`: records review context without secrets for the privileged continuation
 
-The refresh implementation remains in the central Label-Sync repository as the reusable `Refresh Label Test` workflow. Distribution also removes the obsolete `.github/workflows/label-test-review-signal.yml` file if a target received the earlier artifact-handshake layout. The generated workflows call back to the repository and default branch that ran the distributor, so forks distribute callers that point to the fork.
+The refresh implementation remains in the central Label-Sync repository as the reusable `Refresh Label Test` workflow. Distribution also removes the obsolete `.github/workflows/label-test-review-signal.yml` filename if a target received that earlier layout; the signal now lives at `.github/workflows/label-test-review-refresh.yml`. The generated workflows call back to the repository and default branch that ran the distributor, so forks distribute callers that point to the fork.
 
 Inputs:
 

scripts/distribute-label-test-workflows.mjs

@@ -127,13 +127,19 @@ on:
       - labeled
       - unlabeled
       - ready_for_review
+  workflow_run:
+    workflows:
+      - Label Test Review Refresh
+    types:
+      - completed
 
 permissions:
   contents: read
 
 jobs:
   label-test:
     permissions:
+      actions: read
       contents: read
       checks: write
       issues: write
@@ -143,6 +149,8 @@ jobs:
     with:
       label_sync_repository: ${sourceRepository}
       label_sync_ref: ${sourceRef}
+      review_signal_run_id: \${{ github.event.workflow_run.id || 0 }}
+      review_signal_head_sha: \${{ github.event.workflow_run.head_sha || '' }}
     secrets: inherit
 `;
 }
@@ -164,18 +172,25 @@ permissions:
   contents: read
 
 jobs:
-  refresh-label-test:
-    name: Refresh Label Test
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-      pull-requests: read
-    uses: ${sourceRepository}/.github/workflows/refresh-label-test.yml@${sourceRef}
-    with:
-      label_sync_repository: ${sourceRepository}
-      label_sync_ref: ${sourceRef}
-    secrets: inherit
+  record-label-test-review:
+    name: Record Label Test Review
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Record pull request number
+        env:
+          PULL_REQUEST_NUMBER: \${{ github.event.pull_request.number }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/label-test-review-context"
+          printf '%s\\n' "$PULL_REQUEST_NUMBER" > "$RUNNER_TEMP/label-test-review-context/pr-number.txt"
+
+      - name: Upload review context
+        uses: actions/upload-artifact@v7
+        with:
+          name: label-test-review-context
+          path: \${{ runner.temp }}/label-test-review-context/pr-number.txt
+          if-no-files-found: error
+          retention-days: 1
 `;
 }