Fix benchmark workflow permissions for fork PRs#3459
Merged
Conversation
Split the benchmark workflow into two files to resolve the "Resource not accessible by integration" error (403) when commenting on PRs from forks. The `pull_request` event gives a read-only token for fork PRs, so the comment step always fails. Using a separate `workflow_run` workflow for commenting runs in the base repo context, which has write permissions. Also removes the base64 encoding workaround by passing results through artifacts directly as text files.
quaquel
added
the
trigger-benchmarks
Member
|
I triggered the benchmarks but no result is uploaded. Not sure if this is the correct way to test this? |
Member
Author
|
No it will only work after it's merged. I tested on my local fork: This is a GitHub limitation by design: the That's also why @jackiekazil's #3438 seemed to work: It was still using the correct (working) config from |
quaquel
approved these changes
Mar 6, 2026
Member
Member
Author
|
Validated: #3461 (comment) |
EwoutH
added a commit
that referenced
this pull request
Mar 15, 2026
Split the benchmark workflow into two files to resolve the "Resource not accessible by integration" error (403) when commenting on PRs from forks. The `pull_request` event gives a read-only token for fork PRs, so the comment step always fails. Using a separate `workflow_run` workflow for commenting runs in the base repo context, which has write permissions. Also removes the base64 encoding workaround by passing results through artifacts directly as text files.
EwoutH
added a commit
that referenced
this pull request
Mar 15, 2026
Split the benchmark workflow into two files to resolve the "Resource not accessible by integration" error (403) when commenting on PRs from forks. The `pull_request` event gives a read-only token for fork PRs, so the comment step always fails. Using a separate `workflow_run` workflow for commenting runs in the base repo context, which has write permissions. Also removes the base64 encoding workaround by passing results through artifacts directly as text files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the 403 "Resource not accessible by integration" error when the benchmark workflow tries to comment on PRs from forks.
Bug / Issue
After switching the benchmark workflow from
pull_request_targettopull_request, the comment step fails with a 403 for fork PRs. Thepull_requestevent restricts theGITHUB_TOKENto read-only for forks, regardless of declaredpermissions. Splitting into two jobs within the same workflow doesn't help (both jobs share the same restricted token.)Implementation
Split the single workflow into two files:
benchmarks.yml: Runs onpull_requestwith read-only permissions. Executes the benchmarks on both main and the PR branch, then uploads the comparison output and PR number as artifacts.benchmarks-comment.yml: Triggers onworkflow_runcompletion. Sinceworkflow_runalways runs in the base repo context, it has write permissions. Downloads the artifacts and posts the comment.This follows GitHub's recommended pattern for workflows that need write access on fork PRs.
As a side benefit, the base64 encoding workaround for passing the comparison output is no longer needed — results are passed as plain text through artifacts.
Testing
workflow_runjob picks up the artifacts and posts the comment successfully.Additional Notes
workflow_runjob only runs when the benchmark workflow succeeds (conclusion == 'success').pull_request_targetwould work but requires careful handling of the checkout step to avoid running untrusted code with elevated permissions.