fix: allow CI pipeline to run for fork PRs

[samuelstolicny]

Summary

• Skip the merge-branch step for PRs from forks since GITHUB_TOKEN cannot push to external repositories
• Add !failure() && !cancelled() conditions to downstream jobs so they continue running when merge-branch is skipped

Fixes the "Resource not accessible by integration" error when CI is triggered by PRs from forks.

Test plan

• Verify CI runs successfully for PRs from forks (merge-branch should be skipped)
  test: validate CI fix for fork PRs #1946 - PR from fork tested here
• Verify CI still works normally for internal PRs (merge-branch should run)
  This PR itself tests normal flow for internal PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved CI/CD pipeline reliability with enhanced condition handling and better failure/cancellation state management across build, test, and deployment stages.
  • Added protective safeguards to pull request processing to prevent unintended submissions from external forks.
  • Strengthened workflow robustness through refined job state awareness and flow control.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

This pull request adds conditional logic to the GitHub Actions CI pipeline to prevent job execution when previous jobs have failed or been cancelled, and adds a check to prevent external forks from pushing to the main repository.

Changes

Cohort / File(s)	Summary
GitHub Actions CI Pipeline Configuration .github/workflows/CI-pipeline.yml	Added fork-pr PR skip condition to merge-branch job preventing pushes from external forks. Extended check-changes condition with failure/cancellation checks. Introduced guard conditions (not failed and not cancelled) to gotest, golangci, build-and-push, edit-kustomization, and deploy-and-monitor jobs. Updated final deploy condition to respect failure and cancellation states.

Possibly related PRs

• chore: update repository dependencies #1803: Modifies the same CI pipeline file and updates the golangci job configuration, creating a direct connection to this PR's changes affecting the same job.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title claims to 'allow CI pipeline to run for fork PRs' but the actual changes skip the merge-branch step for fork PRs and add guard conditions to downstream jobs.	The title is vague about the core fix—consider clarifying that it skips merge-branch for forks and adds job guards, e.g., 'fix: skip merge-branch for fork PRs and guard downstream jobs'

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/CI-pipeline.yml (1)

257-269: Missing fork check on the commit/push step.

This step also uses GITHUB_TOKEN to push commits to the repository. For fork PRs, this will fail with the same "Resource not accessible by integration" error that this PR aims to fix for merge-branch.

Add the fork check to the step condition:

Proposed fix

       # Auto commit the changes
       - name: Commit new kustomization.yaml to feature branch
-        if: ${{ needs.build-and-push.outputs.ARRAY_OF_CHANGES != '' && github.event.pull_request.draft == false }}
+        if: ${{ needs.build-and-push.outputs.ARRAY_OF_CHANGES != '' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository }}
         working-directory: ./manifests

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a3f545d and 0fef5bf.

📒 Files selected for processing (1)

• .github/workflows/CI-pipeline.yml

🔇 Additional comments (6)

.github/workflows/CI-pipeline.yml (6)

13-15: LGTM! Fork detection logic is correct.

Comparing github.event.pull_request.head.repo.full_name with github.repository is the standard approach to detect fork PRs in GitHub Actions.

---

30-33: LGTM! Correct pattern for handling skipped dependencies.

The !failure() && !cancelled() condition allows this job to run when merge-branch is skipped (for fork PRs), since a skipped job is neither failed nor cancelled.

---

73-76: LGTM!

Consistent application of the !failure() && !cancelled() guard condition.

---

91-95: LGTM!

Consistent with the other job conditions.

---

134-137: LGTM!

Consistent guard condition.

---

272-280: Guard condition is correct, but verify expected behavior for fork PRs.

The !failure() && !cancelled() addition is correct. However, this job uses secrets like E2E_CLUSTER_KUBECONFIG (line 372) and CREATE_STATIC_NODES (line 424) which are not available to fork PRs by default.

Please confirm the expected behavior: Should this job be skipped entirely for fork PRs (by adding the fork check to the job-level if), or is it acceptable for it to fail when secrets are unavailable?

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

[bernardhalas]

LGTM, thank you!