Merge pull request #444 from ranxianglei/2026-09-14_fork-pr-artifact

fix(ci): skip npm publish for fork PRs to avoid ENEEDAUTH (#413)

Author: ranxianglei

.github/workflows/pr-artifact.yml

@@ -25,6 +25,11 @@ jobs:
             - run: npm run build
 
             - name: Publish to npm with PR tag
+              # Fork PRs have no access to NPM_TOKEN (secrets are withheld from
+              # forks) — publishing would fail with ENEEDAUTH and kill the whole
+              # job, so fork PRs skip npm but still get the tarball artifact +
+              # comment below (#413; same fix as opencode-acp#366 / billion-context#670).
+              if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
               run: |
                   PR_NUMBER="${{ github.event.pull_request.number }}"
                   RUN_NUMBER="${{ github.run_number }}"
@@ -58,27 +63,37 @@ jobs:
                   retention-days: 30
 
             - name: Comment on PR with install instructions
+              # Fork PRs get a read-only GITHUB_TOKEN (same withholding policy as
+              # secrets) — issues.createComment would 403 there, so don't let that
+              # fail the otherwise-green fork build (#413).
+              continue-on-error: true
               uses: actions/github-script@v7
               with:
                   script: |
                       const prNumber = context.payload.pull_request.number;
                       const sha = context.payload.pull_request.head.sha.slice(0, 7);
                       const branch = context.payload.pull_request.head.ref;
                       const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+                      const isFork = context.payload.pull_request.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`;
 
                       const body = [
                           '## 📦 Built Extension Artifact',
                           '',
                           `**Branch:** \`${branch}\` (${sha})`,
                           '',
-                          '### Option A — Install from npm PR tag (recommended)',
-                          '',
-                          '```bash',
-                          'pi install npm:billion-context-pi@pr-' + prNumber,
-                          '```',
-                          '',
-                          'Each push to this PR publishes a new version under the `pr-' + prNumber + '` npm tag.',
-                          '',
+                          ...(isFork ? [
+                              '> ℹ️ This PR comes from a fork — npm PR-tag publishing is skipped (no registry credentials). Use the artifact below.',
+                              '',
+                          ] : [
+                              '### Option A — Install from npm PR tag (recommended)',
+                              '',
+                              '```bash',
+                              'pi install npm:billion-context-pi@pr-' + prNumber,
+                              '```',
+                              '',
+                              'Each push to this PR publishes a new version under the `pr-' + prNumber + '` npm tag.',
+                              '',
+                          ]),
                           '### Option B — Download artifact',
                           '',
                           `1. Download the artifact from the [Actions run](${runUrl})`,