Repository navigation
feat(cli): upload fork PRs on v2 by swapping the job's GITHUB_TOKEN - #1293
Merged
trunk-io[bot] merged 2 commits intoNov 9, 2026
Merged
trunk-io[bot] merged 2 commits into
trunk-io[bot] merged 2 commits into
Conversation
|
😎 Merged successfully - details. |
acatxnamedvirtue
force-pushed
the
tylerbeebe/trunk-23482-analytics-cli-upload-fork-prs-on-v2
branch
from
November 6, 2026 18:41
c9773be to
d2d0306
Compare
acatxnamedvirtue
changed the title
acatxnamedvirtue
force-pushed
the
tylerbeebe/trunk-23482-analytics-cli-upload-fork-prs-on-v2
branch
from
November 6, 2026 19:10
d2d0306 to
ebc98d7
Compare
acatxnamedvirtue
changed the title
TylerJang27
approved these changes
Nov 9, 2026
This was referenced Nov 9, 2026
On GitHub Actions, an `upload` for a pull request from a fork with --allow-forked-pr-uploads, no token, no public repo id and a test collection id now asks the decision route with v1's collection-lane header and no credential. On v2 it exchanges the job's GITHUB_TOKEN, the PR number and pull_request.head.sha at POST /v2/auth/github-actions/login, the lane impacted targets uses, and sends the login on x-trunk-token, never Authorization, on the upload, quarantine-status and all-quarantined-tests calls. Any failure keeps the run on v1's collection lane, as today: a missing GITHUB_TOKEN, or a refused or unreadable exchange, logs a warning with the status and the server's error code. Neither the GITHUB_TOKEN nor the login is logged. The v2 client's credential is now a small enum: an API key on Authorization or a Trunk login on x-trunk-token. Runs with a token or a public repo id, and credential-free runs that are not a GitHub Actions fork PR, are unchanged: the latter still never ask the decision route. TRUNK-23482 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… on the swap Review follow-up. use_upload_api_version's doc now says it takes the decision route's answer as given, overriding it only when a fork PR's GITHUB_TOKEN swap fails. The swap request carries x-trunk-allow-forked-pr-uploads like the rest of the fork-lane traffic, and the mock login route checks for it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
acatxnamedvirtue
force-pushed
the
tylerbeebe/trunk-23482-analytics-cli-upload-fork-prs-on-v2
branch
from
November 9, 2026 17:47
9e50900 to
5a5757f
Compare
Contributor
Author
|
/trunk merge |
acatxnamedvirtue
added a commit
that referenced
this pull request
Nov 9, 2026
…1293) * feat(cli): upload fork PRs on v2 by swapping the job's GITHUB_TOKEN On GitHub Actions, an `upload` for a pull request from a fork with --allow-forked-pr-uploads, no token, no public repo id and a test collection id now asks the decision route with v1's collection-lane header and no credential. On v2 it exchanges the job's GITHUB_TOKEN, the PR number and pull_request.head.sha at POST /v2/auth/github-actions/login, the lane impacted targets uses, and sends the login on x-trunk-token, never Authorization, on the upload, quarantine-status and all-quarantined-tests calls. Any failure keeps the run on v1's collection lane, as today: a missing GITHUB_TOKEN, or a refused or unreadable exchange, logs a warning with the status and the server's error code. Neither the GITHUB_TOKEN nor the login is logged. The v2 client's credential is now a small enum: an API key on Authorization or a Trunk login on x-trunk-token. Runs with a token or a public repo id, and credential-free runs that are not a GitHub Actions fork PR, are unchanged: the latter still never ask the decision route. TRUNK-23482 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(api): say the decision route is trusted, and send the fork opt-in on the swap Review follow-up. use_upload_api_version's doc now says it takes the decision route's answer as given, overriding it only when a fork PR's GITHUB_TOKEN swap fails. The swap request carries x-trunk-allow-forked-pr-uploads like the rest of the fork-lane traffic, and the mock login route checks for it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 46eeea6)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On GitHub Actions, an
uploadof a fork pull request with--allow-forked-pr-uploads, no token, no public repo id and a test collection id can now upload over Trunk API v2. Until now it always used v1, and 1.0.0 is v2-only.How it works
x-trunk-allow-forked-pr-uploadsheader and no credential (trunk-io/trunk#35089).v2it swaps the job'sGITHUB_TOKEN, the PR number andpull_request.head.shaatPOST /v2/auth/github-actions/login. This is the same lane impacted targets uses, live in trunk2 since #7717/#7718.x-trunk-token, neverAuthorization, on the upload, quarantine-status and all-quarantined-tests calls.GITHUB_TOKEN, or a refused or unreadable swap. It logs one warning with the HTTP status and the server's error code. TheGITHUB_TOKENand the login are never logged.What does not change
Out of scope: test-runner plugins, login caching, renewal and a separate 429 retry.
The v2 client's credential is now a small enum: an API key on
Authorization, or a Trunk login onx-trunk-token. Accepting a Trunk JWT for--tokenin 1.0.0 (TRUNK-23372) can reuse it.The
--allow-forked-pr-uploadshelp now says it works with no credential on v1, and on v2 only for a fork PR on GitHub Actions, using the job'sGITHUB_TOKEN. analytics-uploader passes it by default (trunk-io/analytics-uploader#155); when running the CLI directly, setGITHUB_TOKEN: ${{ github.token }}.Release: this gets cherry-picked onto
0.17.xfor 0.17.0. The cherry-pick has one test-file conflict (main's newer log-routing tests), resolved by keeping only the fork tests; there the fork tests assert logs on stdout, since 0.17.x does not route logs to stderr.Tests
x-trunk-tokenwith noAuthorization; refusals (400/401/422/502/503/429/unreadable) falling back to v1; a missingGITHUB_TOKEN; a decision of v1 or 401 meaning no swap; a non-fork run never asking; a token run never swapping.Part of TRUNK-23482
🤖 Generated with Claude Code