secrets are empty strings in fork pull requests

"""Find workflow failures caused by secrets being empty in fork pull requests.

Secrets are not withheld with an error on a fork PR -- they resolve to empty
strings, so the job runs and fails downstream for a reason that looks unrelated.
This narrows the search to runs where that is possible.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("fork_pr_secret_audit")

API = "https://api.github.com"


def is_fork_run(run):
    """Pure decision function over one workflow-run object.

    Secrets are unavailable when a pull_request event comes from a different
    repository. Same-repo PRs from branches DO get secrets, which is why comparing
    the repository names matters more than the event name alone.
    """
    if run.get("event") != "pull_request":
        return False
    head = (run.get("head_repository") or {}).get("full_name")
    base = (run.get("repository") or {}).get("full_name")
    return bool(head and base and head != base)


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--repo", required=True, help="owner/name")
    ap.add_argument("--limit", type=int, default=100)
    args = ap.parse_args()

    token = os.environ.get("GITHUB_TOKEN")
    if not token:
        log.error("set GITHUB_TOKEN")
        return 2
    headers = {"Authorization": f"Bearer {token}",
               "Accept": "application/vnd.github+json"}

    r = requests.get(f"{API}/repos/{args.repo}/actions/runs",
                     headers=headers, params={"per_page": args.limit}, timeout=30)
    r.raise_for_status()
    runs = r.json().get("workflow_runs", [])

    fork_runs = [x for x in runs if is_fork_run(x)]
    failed = [x for x in fork_runs if x.get("conclusion") == "failure"]

    log.info("%d recent run(s); %d from forks; %d of those failed",
             len(runs), len(fork_runs), len(failed))
    for run in failed:
        log.warning("FORK PR FAILURE  #%s %s -- %s",
                    run.get("run_number"),
                    (run.get("head_repository") or {}).get("full_name"),
                    run.get("html_url"))
    if failed:
        log.warning("secrets resolve to EMPTY STRINGS in these runs, so a step using "
                    "one fails downstream rather than reporting a missing secret")
    return 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Find workflow failures caused by secrets being empty in fork pull requests.
 *
 * Secrets are not withheld with an error on a fork PR -- they resolve to empty
 * strings, so the job runs and fails downstream for a reason that looks unrelated.
 */
const API = 'https://api.github.com';

/**
 * Pure decision function over one workflow-run object.
 *
 * Secrets are unavailable when a pull_request event comes from a different
 * repository. Same-repo PRs from branches DO get secrets, which is why comparing
 * repository names matters more than the event name alone.
 */
export function isForkRun(run) {
  if (run.event !== 'pull_request') return false;
  const head = run.head_repository?.full_name;
  const base = run.repository?.full_name;
  return Boolean(head && base && head !== base);
}

async function main() {
  const repo = process.argv[process.argv.indexOf('--repo') + 1];
  const token = process.env.GITHUB_TOKEN;
  if (!token) { console.error('set GITHUB_TOKEN'); process.exit(2); }

  const res = await fetch(`${API}/repos/${repo}/actions/runs?per_page=100`, {
    headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json' },
  });
  if (!res.ok) { console.error(`${res.status} ${res.statusText}`); process.exit(1); }
  const { workflow_runs: runs = [] } = await res.json();

  const forkRuns = runs.filter(isForkRun);
  const failed = forkRuns.filter((r) => r.conclusion === 'failure');
  console.log(`${runs.length} recent run(s); ${forkRuns.length} from forks; ${failed.length} failed`);
  for (const run of failed) {
    console.warn(`FORK PR FAILURE  #${run.run_number} ${run.head_repository?.full_name} -- ${run.html_url}`);
  }
  if (failed.length) {
    console.warn('secrets resolve to EMPTY STRINGS in these runs, so a step using one '
      + 'fails downstream rather than reporting a missing secret');
  }
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from fork_pr_secret_audit import is_fork_run


def run(event="pull_request", head="contributor/proj", base="owner/proj"):
    return {"event": event,
            "head_repository": {"full_name": head},
            "repository": {"full_name": base}}


def test_fork_pr_is_detected():
    assert is_fork_run(run()) is True


def test_same_repo_branch_pr_keeps_its_secrets():
    """Also a pull_request event, but from a branch. Secrets ARE available."""
    assert is_fork_run(run(head="owner/proj")) is False


def test_push_events_are_not_affected():
    assert is_fork_run(run(event="push")) is False


def test_missing_head_repository_is_not_assumed_to_be_a_fork():
    r = run()
    r["head_repository"] = None
    assert is_fork_run(r) is False

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { isForkRun } from './fork-pr-secret-audit.mjs';

const run = ({ event = 'pull_request', head = 'contributor/proj', base = 'owner/proj' } = {}) => ({
  event, head_repository: { full_name: head }, repository: { full_name: base },
});

test('a fork PR is detected', () => {
  assert.equal(isForkRun(run()), true);
});

test('a same-repo branch PR keeps its secrets', () => {
  assert.equal(isForkRun(run({ head: 'owner/proj' })), false);
});

test('push events are not affected', () => {
  assert.equal(isForkRun(run({ event: 'push' })), false);
});

test('a missing head repository is not assumed to be a fork', () => {
  const r = run(); r.head_repository = null;
  assert.equal(isForkRun(r), false);
});