From 62c9a778c0772a70d1cb71b9b4e52a1d855d1a6d Mon Sep 17 00:00:00 2001
From: Million <15158090088@163.com>
Date: Thu, 30 Jul 2026 14:26:09 +0800
Subject: [PATCH] fix(ci): use pull_request_target so fork PRs trigger opencode
 review

The workflow used pull_request with a head.repo.fork == false guard,
but Leoyzen/agentpool is itself a fork, so the guard skipped ALL PRs.

Switch to pull_request_target (runs in base repo security context,
giving fork PRs access to secrets) and explicitly checkout the PR
head SHA to review the PR's actual code instead of the base branch.
---
 .github/workflows/opencode-review.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index 93301da3e..59355d586 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -1,11 +1,13 @@
 name: OpenCode PR Review
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review]
 
 # Non-blocking: posts a review comment, does not block merge
-# Fork PRs are skipped — they cannot access repo secrets (DEEPSEEK_API_KEY, REVIEW_GITHUB_TOKEN)
+# Uses pull_request_target so fork PRs also trigger review with access to repo secrets.
+# The workflow runs in the base repo's security context, but we explicitly checkout
+# the PR head SHA to ensure we review the PR's actual code, not the base branch.
 permissions:
   contents: read
   pull-requests: write
@@ -17,14 +19,15 @@ concurrency:
 
 jobs:
   review:
-    # Skip draft PRs and fork PRs — fork PRs cannot access repo secrets
-    if: github.event.pull_request.draft == false && github.event.pull_request.head.repo.fork == false
+    # Skip draft PRs only — fork PRs are supported via pull_request_target
+    if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository
+      - name: Checkout PR head
         uses: actions/checkout@v6
         with:
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
           persist-credentials: false