fix(ci): skip npm publish for fork PRs so artifact still builds

[ranxianglei]

Problem

pr-artifact.yml runs npm publish --tag pr-N with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} before npm pack, the artifact upload and the install-instructions comment. For pull_request runs coming from a fork, GitHub passes no base-repo secrets (read-only token), so NODE_AUTH_TOKEN is empty and publish exits ENEEDAUTH — on every fork contribution, e.g. #287. The failing step aborts the job, so fork PRs lose the tarball, the Actions artifact and the PR comment entirely.

The job is not in master's required-check list (test (22), test (24), pr-validation), so this never blocks merge — but it does block the artifact that fork contributors use to test pre-merge.

Change

One line: guard the publish step so it only runs when the PR head is in this repository:

- name: Publish to npm with PR tag
  if: github.event.pull_request.head.repo.full_name == github.repository

Fork PRs now skip only the publish step and still get npm pack + artifact upload + install-instructions comment. Owner-branch PRs are unchanged.

Notes

• Suggested by @joshwapohlmann in fix(prune,compress): never split a tool call/result pair or an assistant run across a fold #287; implemented here on the owner side since nothing in a fork branch can change secret availability.
• Cosmetic follow-up (out of scope): for fork PRs the bot comment's "Option A — npm tag" line is moot until someone publishes manually; Option B (artifact download) works as-is.
• After this merges, re-running the failed build-artifact run for fix(prune,compress): never split a tool call/result pair or an assistant run across a fold #287 will produce its artifact (pull_request events use the base branch's workflow files).

[github-actions]

📦 Built Package Artifact

Branch: 2026-09-14_guard-fork-pr-publish (a5182af)

Option A — Install from npm PR tag (recommended)

In your adapter project:

npm install acp-kernel@pr-288

Each push to this PR publishes a new version under the pr-288 npm tag.

Option B — Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf acp-kernel-pr288.tgz
npm install ./package

---

This comment is automatically updated on each push.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 PR Review — #288 ✅ Recommend merge

Diff cleanliness — Clean. Exactly one added line on the Publish to npm with PR tag step in .github/workflows/pr-artifact.yml; no unrelated files, no whitespace/shuffle, no generated artifacts. Every line maps to the stated purpose.

Bug verification (triage — reproduced, not just reported)

• PR fix(prune,compress): never split a tool call/result pair or an assistant run across a fold #287 is a genuine fork: head.repo.full_name = joshwapohlmann/acp-kernel, fork = true.
• Its build-artifact run (id 34819819833, branch 2026-09-14_tool-pair-integrity) failed inside the publish step: log shows npm error code ENEEDAUTH → ##[error]Process completed with exit code 1., immediately followed by "Post job cleanup" — so npm pack, the artifact upload, and the install-instructions comment never ran. That matches the reported impact exactly.

Root cause vs. symptom — The symptom is "fork PRs lose their artifact." The root cause isn't in the workflow logic; it's GitHub's security model: pull_request events from a fork receive a read-only token and no base-repo secrets, so ${{ secrets.NPM_TOKEN }} resolves empty and npm publish can never authenticate. Because the publish step unconditionally requires that secret, it hard-fails on every fork contribution. Fixing the symptom without addressing this would be whack-a-mole — the guard does address it.

Why this fix is sound — if: github.event.pull_request.head.repo.full_name == github.repository is the canonical owner-vs-fork discriminator:

• Owner-branch PR: head repo == base repo → publish runs, unchanged. Verified live: PR fix(ci): skip npm publish for fork PRs so artifact still builds #288's own "PR Build Artifact" run completed success (the modified file parses and still publishes from the owner side).
• Fork PR: head repo != base repo → publish skipped, job continues to npm pack + artifact upload + comment (Option B works).
• Nice side effect: skipping the whole step also skips the in-step npm version bump, so fork tarballs carry the honest base version rather than a fake unpublished -pr-N.R.
• YAML validated locally (guard lands correctly on the publish step: keys name/if/run/env); GitHub Actions already executed the modified file successfully on fix(ci): skip npm publish for fork PRs so artifact still builds #288.

Out-of-scope note — Agree with the author: the bot comment's "Option A — npm tag" line is moot for fork PRs until someone publishes manually; leaving it as-is is the right call. Not a blocker.

No blocking issues, nothing to fix on the branch. Per repo policy, source changes need ≥2 agent reviews before merge and merging itself is human-only — I have not merged.

中文摘要： 修复了 fork PR 因拿不到 NPM_TOKEN 导致 npm publish 报 ENEEDAUTH、进而丢失 tarball/Actions artifact/安装说明评论的问题——用一行 if 仅在 PR head 属于本仓库时执行发布步骤，fork PR 只跳过发布、保留打包与上传；已用 #287 失败日志复现确认（ENEEDAUTH→exit 1，后续步骤未运行）、diff 干净、且 #288 自身 CI 已通过，可以合并。