From 8607c9bb80843ced3ef606825b5116f04530f082 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 2 Jul 2026 08:45:18 +0000 Subject: [PATCH 1/2] ci: run Nx locally for fork PRs without Nx Cloud access Fork PRs don't receive repository secrets, so NX_CLOUD_ACCESS_TOKEN is empty and the nx-cloud start-ci-run step fails for external contributors. Detect fork PRs and skip Nx Cloud distribution, running nx affected locally with NX_NO_CLOUD instead. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LKPMobWjRwcz9TDzS3Kryp --- .github/workflows/ci.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9eb2cd24..793b1aa3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,12 @@ jobs: main: name: Main runs-on: ubuntu-latest + env: + # GitHub does not expose repository secrets to workflows triggered by + # PRs from forks, so NX_CLOUD_ACCESS_TOKEN is empty for contributor PRs. + # Detect those runs and fall back to running Nx locally (no cloud), which + # keeps CI green without leaking the token to untrusted fork code. + IS_FORK_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} steps: - uses: actions/checkout@v4 with: @@ -31,8 +37,9 @@ jobs: # This enables task distribution via Nx Cloud # Run this command as early as possible, before dependencies are installed # Learn more at https://nx.dev/ci/reference/nx-cloud-cli#npx-nxcloud-startcirun - # Uncomment this line to enable task distribution - - run: pnpm dlx nx-cloud start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="build" + # Skipped for fork PRs, which have no access to the Nx Cloud token. + - if: ${{ env.IS_FORK_PR == 'false' }} + run: pnpm dlx nx-cloud start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="build" # Cache node_modules - uses: actions/setup-node@v4 @@ -47,3 +54,7 @@ jobs: # - run: pnpm exec nx-cloud record -- echo Hello World # Nx Affected runs only tasks affected by the changes in this PR/commit. Learn more: https://nx.dev/ci/features/affected - run: pnpm exec nx affected -t lint test build + env: + # Fork PRs run without Nx Cloud (no token); disable it entirely so Nx + # runs tasks locally on the runner instead of attempting to connect. + NX_NO_CLOUD: ${{ env.IS_FORK_PR }} From b70d4ff39f905fd4d78c6f5e62f6b9da9a45fbfe Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 10 Jul 2026 06:40:36 +0000 Subject: [PATCH 2/2] ci: use Nx Cloud only on main, run PRs locally Disable Nx Cloud for all pull requests and only distribute/write the remote cache on pushes to main. This removes the dependency on the Nx Cloud access token for PRs (secrets are unavailable to fork PRs), so contributor PRs pass without any token exposure or fork special-casing. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LKPMobWjRwcz9TDzS3Kryp --- .github/workflows/ci.yml | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 793b1aa3..611d2c08 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,12 +17,6 @@ jobs: main: name: Main runs-on: ubuntu-latest - env: - # GitHub does not expose repository secrets to workflows triggered by - # PRs from forks, so NX_CLOUD_ACCESS_TOKEN is empty for contributor PRs. - # Detect those runs and fall back to running Nx locally (no cloud), which - # keeps CI green without leaking the token to untrusted fork code. - IS_FORK_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} steps: - uses: actions/checkout@v4 with: @@ -37,8 +31,9 @@ jobs: # This enables task distribution via Nx Cloud # Run this command as early as possible, before dependencies are installed # Learn more at https://nx.dev/ci/reference/nx-cloud-cli#npx-nxcloud-startcirun - # Skipped for fork PRs, which have no access to the Nx Cloud token. - - if: ${{ env.IS_FORK_PR == 'false' }} + # Only runs on pushes to main. PRs (including forks, which have no access + # to the Nx Cloud token) run Nx locally, so distribution is skipped. + - if: ${{ github.event_name == 'push' }} run: pnpm dlx nx-cloud start-ci-run --distribute-on="3 linux-medium-js" --stop-agents-after="build" # Cache node_modules @@ -55,6 +50,6 @@ jobs: # Nx Affected runs only tasks affected by the changes in this PR/commit. Learn more: https://nx.dev/ci/features/affected - run: pnpm exec nx affected -t lint test build env: - # Fork PRs run without Nx Cloud (no token); disable it entirely so Nx - # runs tasks locally on the runner instead of attempting to connect. - NX_NO_CLOUD: ${{ env.IS_FORK_PR }} + # PRs run without Nx Cloud so they don't depend on the access token + # (unavailable to forks). Only pushes to main use the remote cache. + NX_NO_CLOUD: ${{ github.event_name == 'pull_request' }}