From 8bddda70f544b6fd0921a2d96c40cb640480bab8 Mon Sep 17 00:00:00 2001 From: Jan Calanog Date: Wed, 19 Aug 2026 21:52:45 +0200 Subject: [PATCH] Clarify fork PR failures for Codex cross-link validation Co-authored-by: Cursor --- .github/workflows/codex-preview.yml | 3 +-- codex/build/action.yml | 13 +++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codex-preview.yml b/.github/workflows/codex-preview.yml index 34c2706..7f294cc 100644 --- a/.github/workflows/codex-preview.yml +++ b/.github/workflows/codex-preview.yml @@ -99,8 +99,7 @@ jobs: && github.event.pull_request.head.repo.full_name != github.repository && needs.check.outputs.any_modified == 'true' run: | - echo "::warning::Preview deployments are only available for PRs from the same repository, not from forks." \ - "You can either change the event to pull_request_target or push the branch to the upstream repository instead." + echo "::warning::Preview deployments and Elastic Internal Docs cross-links are not available for PRs from forks. Fork pull_request jobs cannot clone elastic/codex-link-index or deploy previews. Push the branch to the upstream repository instead." - name: Skip build if: needs.check.outputs.any_modified == 'false' run: | diff --git a/codex/build/action.yml b/codex/build/action.yml index 35f5a5a..d4f6d37 100644 --- a/codex/build/action.yml +++ b/codex/build/action.yml @@ -67,6 +67,19 @@ runs: with: vault-instance: "ci-prod" vault-role: "${{ steps.generate-vault-role.outputs.result }}" + - name: Explain codex-link-index token fetch failure + if: steps.fetch-ephemeral-token.outcome == 'failure' + shell: bash + env: + EVENT_NAME: ${{ github.event_name }} + HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }} + REPOSITORY: ${{ github.repository }} + run: | + if [[ "${EVENT_NAME}" == "pull_request" && "${HEAD_REPOSITORY}" != "${REPOSITORY}" ]]; then + echo "::error::Fork pull_request jobs cannot clone elastic/codex-link-index. GitHub does not mint an OIDC token for fork PRs, so cross-links declared in docset.yml cannot be validated. Push the branch to ${REPOSITORY} and open the PR from there." + else + echo "::warning::Could not fetch a GitHub token for elastic/codex-link-index. Cross-links declared in docset.yml may fail to resolve. Confirm permissions.id-token: write on this job and that catalog-info registers a token policy for this workflow." + fi - name: Build shell: bash run: |