Three failures consistently flip community/fork PRs red even when every
substantive check passes (observed on PR #9941):
- Update Component Index: actions/checkout was given only the head ref,
defaulting the repository to the upstream where the fork branch does
not exist. Pass head.repo.full_name + head.ref so the head can be
checked out from the fork. Continue using the pull_request trigger so
fork code never runs in a privileged context.
- Merge Frontend Jest + Playwright Coverage Reports: codecov-action ran
with fail_ci_if_error: true and an empty token (forks can't read repo
secrets), turning a reporting step into a hard merge blocker. Skip the
upload when CODECOV_TOKEN is unavailable and match the python coverage
job's fail_ci_if_error: false.
- CI Success: roll-up gate cascading from the two above; clears
automatically once they pass.
4dfe24ab20