Fix PR runs on forks

[John Stairs (johnstairs)]

GitHub action runs on PRs from forks were not working because they do not have the same permissions. Specifically, we skip publishing to ghcr.io and we use managed identity for Tyger authentication because the ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variables, which allow FIC/OIDC flows, are not available.

[Copilot]

🔵 Needs a closer look

Unresolved workflow dependency and Dependabot detection issues affect intended PR checks.

Pull request overview

Updates PR CI to support forked and Dependabot PRs without unavailable secrets or GHCR publishing.

Changes:

• Selects GitHub or managed-identity authentication.
• Skips GHCR publishing for fork and Dependabot PRs.
• Adjusts image, binary, and private-link job dependencies.

File summaries

File	Summary
.github/workflows/pr-ci.yml	Updates authentication, publishing conditions, and CI job dependencies.

Review details

Suppressed comments (2)

.github/workflows/pr-ci.yml:219

• This condition skips publish-ghcr for fork and Dependabot PRs, but verify-binaries still lists that job in its needs at lines 600–606. GitHub skips a job when one of its required jobs is skipped, so the binary-install verification (and any required check based on it) will also be skipped for the PRs this change is intended to support. Remove publish-ghcr from verify-binaries.needs or otherwise make that dependency non-blocking for these PRs.

    if: github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)

.github/workflows/pr-ci.yml:219

• github.actor is the user who triggered or re-ran the workflow, not necessarily the pull request author. If a maintainer re-runs a Dependabot PR, this predicate can become true, and the job will attempt to publish with the unavailable Dependabot-PR credentials; check github.event.pull_request.user.login (and the event type) instead when excluding Dependabot PRs.

    if: github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.