ci: make Recommend integration tests workflow fork-safe

.github/workflows/recommend-integration-tests.yml

@@ -49,23 +49,51 @@ jobs:
               repo: context.repo.repo
             }
 
+            // When this workflow runs for a PR opened from a fork, the
+            // GITHUB_TOKEN has read-only access to the upstream repo and
+            // any write call (addLabels / createComment) returns
+            // `Resource not accessible by integration` (HTTP 403). That
+            // is the right security boundary, but it causes this check
+            // to fail on every fork PR which is misleading: the failure
+            // is not a problem with the PR's source code.
+            //
+            // Soft-fail those writes so the check stays green for fork
+            // PRs. Maintainers can still apply the label manually if
+            // they want to recommend integration tests for the change.
+            const isFork = context.payload.pull_request?.head?.repo?.full_name !== context.payload.repository?.full_name
+            const softWrite = async (operation, fn) => {
+              try {
+                await fn()
+              } catch (error) {
+                if (error.status === 403) {
+                  core.info(`Skipped ${operation}: GITHUB_TOKEN cannot write to this repository from a forked PR. A maintainer can apply the '${INTEGRATION_LABEL_NAMES.recommended}' label manually if integration tests are warranted.`)
+                  return
+                }
+                throw error
+              }
+            }
+
             const labels = await github.paginate(github.rest.issues.listLabelsOnIssue, issue);
             const integrationLabels = labels.filter(label => label.name.startsWith('integration-tests'))
             const hasPassingLabel = integrationLabels.find(label => label.name === INTEGRATION_LABEL_NAMES.passing)
 
             if (integrationLabels.length === 0) {
               // recommend integration tests
-              await github.rest.issues.addLabels({...issue, labels: [INTEGRATION_LABEL_NAMES.recommended]})
-              await github.rest.issues.createComment({
-                ...issue,
-                body: '<!-- recommend-integration-tests.yml -->\n\n # ⚠️ Action required \n\n :wave: Hi, this pull request contains changes to the source code that github/github-ui depends on. If you are GitHub staff, test these changes with github/github-ui using the [integration workflow](https://github.com/github/github-ui/actions/workflows/primer-react-pr-test.yml). Check the [integration testing docs](https://gh.io/testing_primer_at_dotcom) for step-by-step instructions. Or, apply the `integration-tests: skipped manually` label to skip these checks.\n\nTo publish a canary release for integration testing, apply the `Canary Release` label to this PR.'
-              })
+              await softWrite('addLabels', () => github.rest.issues.addLabels({...issue, labels: [INTEGRATION_LABEL_NAMES.recommended]}))
+              if (!isFork) {
+                await softWrite('createComment', () => github.rest.issues.createComment({
+                  ...issue,
+                  body: '<!-- recommend-integration-tests.yml -->\n\n # ⚠️ Action required \n\n :wave: Hi, this pull request contains changes to the source code that github/github-ui depends on. If you are GitHub staff, test these changes with github/github-ui using the [integration workflow](https://github.com/github/github-ui/actions/workflows/primer-react-pr-test.yml). Check the [integration testing docs](https://gh.io/testing_primer_at_dotcom) for step-by-step instructions. Or, apply the `integration-tests: skipped manually` label to skip these checks.\n\nTo publish a canary release for integration testing, apply the `Canary Release` label to this PR.'
+                }))
+              }
             } else if (hasPassingLabel) {
               // recommend running integration tests again as there are new commits that might change the status
               // note: we don't remove 'integration-tests: passing' label because this is only a suggestion/nudge
-              await github.rest.issues.addLabels({...issue, labels: [INTEGRATION_LABEL_NAMES.recommended]})
-              await github.rest.issues.createComment({
-                ...issue,
-                body: '<!-- recommend-integration-tests.yml -->\n\n # ⚠️ Action required \n\n :wave: Hi, there are new commits since the last successful integration test. If you are GitHub staff, test these changes with github/github-ui using the [integration workflow](https://github.com/github/github-ui/actions/workflows/primer-react-pr-test.yml). Check the [integration testing docs](https://gh.io/testing_primer_at_dotcom) for step-by-step instructions. Or, apply the `integration-tests: skipped manually` label to skip these checks.'
-              })
+              await softWrite('addLabels', () => github.rest.issues.addLabels({...issue, labels: [INTEGRATION_LABEL_NAMES.recommended]}))
+              if (!isFork) {
+                await softWrite('createComment', () => github.rest.issues.createComment({
+                  ...issue,
+                  body: '<!-- recommend-integration-tests.yml -->\n\n # ⚠️ Action required \n\n :wave: Hi, there are new commits since the last successful integration test. If you are GitHub staff, test these changes with github/github-ui using the [integration workflow](https://github.com/github/github-ui/actions/workflows/primer-react-pr-test.yml). Check the [integration testing docs](https://gh.io/testing_primer_at_dotcom) for step-by-step instructions. Or, apply the `integration-tests: skipped manually` label to skip these checks.'
+                }))
+              }
             }