)]}'
{
  "commit": "87bdf2f2c2258198c73281b96beb87839fe71c5d",
  "tree": "2d386c70b4c02bf8b26208bc6371110747ed8f15",
  "parents": [
    "4c2979833c723ae84b63af16a8a8988231375065"
  ],
  "author": {
    "name": "Mingyu Chen (Rayner)",
    "email": "morningman@163.com",
    "time": "Fri Apr 24 14:27:17 2026 -0700"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Fri Apr 24 14:27:17 2026 -0700"
  },
  "message": "fix(ci): make Docs AI Review workflow work for fork PRs (#3577)\n\n## Summary\n\nFix two related issues in `.github/workflows/docs-ai-review.yml` so that\nthe Docs AI Review packet + advisory comment works for fork-originated\nPRs (which is the common case in this repo).\n\n- **Rerun on push when labeled.** The `pull_request` trigger previously\nonly listed the `labeled` action, so the workflow ran exactly once when\nthe `ai-review-docs` label was first applied and did not re-run when the\nPR was updated with new commits. Add `synchronize` and `reopened` to the\ntypes list, and gate those two actions on the `ai-review-docs` label\nalready being present on the PR.\n- **Split the advisory comment into a `workflow_run` workflow.** Pull\nrequests from forks run `pull_request` workflows with a read-only\n`GITHUB_TOKEN` regardless of declared `permissions:`, so the inline\ncomment step could never post on fork PRs and returned 403 on both the\nGraphQL `addComment` mutation (via `gh pr comment`) and the REST\n`issues/{n}/comments` endpoint. Following the standard GitHub pattern:\n- `docs-ai-review.yml` (pull_request trigger) now only prepares the\npacket and uploads it, together with a `pr-metadata.json` describing PR\nnumber / head SHA / base SHA / trigger name.\n- A new `docs-ai-review-comment.yml` (`workflow_run` trigger) downloads\nthe artifact from the completed run, parses the metadata, and upserts\nthe advisory comment via REST. Because `workflow_run` runs in the\nbase-repo context, its `GITHUB_TOKEN` honors `issues: write` even for\nfork PRs.\n\nThe comment workflow does not check out or execute any code from the\nfork — it only consumes the prebuilt packet and metadata JSON — so it\navoids the footgun usually associated with giving write permissions to\nfork-triggered runs.\n\n## Test plan\n\n- [ ] After merge, open a fresh fork PR and add the `ai-review-docs`\nlabel — confirm `Docs AI Review` runs (prepare packet + upload\nartifact).\n- [ ] Confirm `Docs AI Review Comment` fires via `workflow_run`\nafterwards and upserts a comment with the packet metadata.\n- [ ] Push a follow-up commit to the same PR — confirm `Docs AI Review`\nreruns on `synchronize` because the label is still applied, and the\nadvisory comment is updated in place (PATCH path).\n- [ ] Post `/review-docs` as a COLLABORATOR/MEMBER on a PR — confirm\n`Docs AI Review` runs via `issue_comment` and the comment workflow\nfollows.\n- [ ] Remove the label, push again — confirm `Docs AI Review` no longer\nruns.",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "30c74954b89ec78fe33e93f1f705e7e6c42120ab",
      "new_mode": 33188,
      "new_path": ".github/workflows/docs-ai-review-comment.yml"
    },
    {
      "type": "modify",
      "old_id": "62380b496e56e335d407e72d0d9414a2d31fb071",
      "old_mode": 33188,
      "old_path": ".github/workflows/docs-ai-review.yml",
      "new_id": "e83d2033aaede41fb5064372b5184f66e713b34a",
      "new_mode": 33188,
      "new_path": ".github/workflows/docs-ai-review.yml"
    }
  ]
}