ci(ci): report PR analysis for forks without mutations #51439

Closed
yeelam-gordon opened 4:16pm on October 20, 2026 wanted to merge 428 Δ into microsoft/powertoys main from
fix/pr-analysis-fork-readonly

Pull Request Overview

  • Opened on October 20, 2026
  • Status Closed
  • Commit count 1 with first commit October 20, 2026

Total Delta

428 Total Diff Delta

Open Days

Open 16 weekdays

Test Delta

381 Diff Delta in Test Files
Breakdown by Phase

How long has this pull request spent in each phase of its lifecycle?

Fraction of total time Business days Phase
 
0 days Authoring 1 commit before pull request opened for review
 
0 days Awaiting first review
 
0 days Revising work with 0 commits in response to 2 reviews that left 10 comments
 
7 days Merge to deploy

Total time for pull request 0 business days from first commit authored to deploy

Author avatar

ci(ci): report PR analysis for forks without mutations

Summary of the Pull Request

Run PR intake and telemetry analysis on fork PRs without trying to post comments, change labels, or request reviewers. Fork contributors see the findings and suggested actions in the Actions job summary and logs instead.

Both workflows switch from pull_request_target to pull_request. Same-repository branches keep comments, labels, stale-comment cleanup, and telemetry reviewer requests, but no longer receive screenshot reminders.

Telemetry and screenshot findings are best-effort guidance, not new failing requirements.

PR Checklist


  • [ ] Closes: #xxx
    <!-- - [ ] Closes: #yyy (add separate lines for additional resolved issues) -->

  • [x] Communication: I've discussed this with core contributors already. If the work hasn't been agreed, this work might be rejected

  • [x] Tests: Added/updated and all pass

  • [ ] Localization: All end-user-facing strings can be localized

  • [x] Dev docs: Added/updated

  • [ ] New binaries: Added on the required places



  • [ ] Documentation updated: If checked, please file a pull request on our docs repo and link it here: #xxx

Detailed Description of the Pull Request / Additional comments



  • Warnings: Fork UI changes may get a screenshot suggestion. Telemetry matches suggest reviewing DATA_AND_PRIVACY.md and following the telemetry process. Neither finding fails a check, requires a new label, or starts the author-feedback closure timer.


  • What can fail intake: An explicitly invalid closing reference, a merge conflict, unavailable mergeability, or a stale fork Needs-Author-Feedback label awaiting maintainer removal under the existing closure policy.


  • How to clear those failures: Correct or remove the invalid closing reference, resolve the conflict, rerun after GitHub computes mergeability, or ask a maintainer to remove the stale label. Reruns fetch current PR data and labels; unchanged unresolved requirements still fail. A missing issue link is only a suggestion.


  • Telemetry failures: Only analysis errors, such as API failures or stale PR revisions—not telemetry matches or missing event documentation.

The follow-up removes the added literal-event/documentation scanner rather than adding a language parser. This fixes both reported false failures: event examples in block comments and comment insertions beside unchanged events.

Both workflows run helpers from the target repository's base commit, not PR-head code. Draft handling, event types, concurrency, and telemetry manual dispatch remain. No spelling workflow, repository policy, or branch-rule changes.

Validation Steps Performed


  • Reproduced both telemetry review cases as failing regression tests before the fix.

  • 74 focused tests pass on Node 24.13.0 and the workflow's Node 22.23.3. Coverage includes advisory warnings, same-repository screenshot suppression/cleanup, fork zero-write behavior, manual dispatch, and unresolved/resolved reruns.

  • Both helpers pass node --check; both workflows pass actionlint -shellcheck=; git diff --check passes.

Exact commands run from C:\s\pt-pr-analysis-fork-readonly for commit 3870362787:

node --test --test-timeout=30000 .github/scripts/pr-intake/tests/pr-intake.test.mjs .github/scripts/tests/telemetry-pr-check.test.js

# Exit 0; Node 24.13.0; 74/74 tests passed (47 intake, 27 telemetry).

npx.cmd --yes --package=node@22 node --test --test-timeout=30000 .github/scripts/pr-intake/tests/pr-intake.test.mjs .github/scripts/tests/telemetry-pr-check.test.js
# Exit 0; Node 22.23.3; 74/74 tests passed (47 intake, 27 telemetry).

node --check .github/scripts/pr-intake/pr-intake.mjs
# Exit 0; syntax check passed.

node --check .github/scripts/telemetry-pr-check.js
# Exit 0; syntax check passed.

& C:\Users\yeelam\AppData\Local\Temp\pr-workflow-migration\tools\actionlint.exe -shellcheck= .github/workflows/pr-intake.yml .github/workflows/telemetry-pr-check.yml
# Exit 0; both workflows passed with no diagnostics.

git diff --check bce86ab181..HEAD
# Exit 0; no whitespace errors.

These are local API-mocked tests, not hosted proof of the migrated workflows. The earlier successful intake/telemetry runs used baseline pull_request_target code. Because checkout uses the base commit, runs of this PR do not validate the candidate helpers before they are available in the trusted base.

Current hosted limitation: the new intake run checked out base bce86ab181, whose old helper tried to update a comment and failed with Resource not accessible by integration. It did not run the fixed helper. Candidate hosted confirmation remains outstanding once the helper changes are available in the trusted base; no permission or policy workaround is included.

Comments Threads Pending Resolution

zadjii-msft reviewed on October 20, 2026
zadjii-msft left a comment

^ see above

ljharb reviewed on October 20, 2026
ljharb left a comment

### 🟡 Changes recommended

Telemetry detection can fail unrelated changes by treating unchanged calls and block-comment examples as newly added events.

2 open issues

- Medium severity [Avoid classifying telemetry calls inside block comments](https://github.com/microsoft/PowerToys/pull/51439#discussion_r4326089414) · New
- Medium severity [Prevent insertion-only changes from flagging unchanged events](https://github.com/microsoft/PowerToys/pull/51439#discussion_r4326089497) · New

What changed in this PR

Enables read-only PR intake and telemetry analysis for community forks while preserving same-repository automation.

**Changes:**
- Switches workflows to `pull_request` with trusted base-source checkout.
- Adds summaries, required-action failures, and mutation guards.
- Expands mocked regression tests and documents fork behavior.

| File | Description |
| ---- | ----------- |
| `.github/​workflows/​telemetry-pr-check.yml` | Enables fork analysis and trusted checkout. |
| `.github/​workflows/​pr-intake.yml` | Updates trigger, checkout, and timeout. |
| `.github/​scripts/​tests/​telemetry-pr-check.test.js` | Adds telemetry behavior and CLI tests. |
| `.github/​scripts/​telemetry-pr-check.js` | Adds reporting, documentation checks, and mutation guards. |
| `.github/​scripts/​pr-intake/​tests/​pr-intake.test.mjs` | Tests fork reporting and required-action exits. |
| `.github/​scripts/​pr-intake/​README.md` | Documents read-only analysis and rerun behavior. |
| `.github/​scripts/​pr-intake/​pr-intake.mjs` | Adds guarded writes, summaries, and failure status. |

Review effort: Balanced

.github/scripts/telemetry-pr-check.js
.github/scripts/telemetry-pr-check.js

Resolved Comment Threads

No resolved comments have been left on this PR.