fork PR 指向 dev 时目标分支检查仍因删除标签权限失败

[Zker67]

问题

fork 提交的 PR 即使目标分支已经是 dev，enforce 检查仍会失败。

失败点在目标分支检查 workflow：当 baseBranch === "dev" 时，它会直接调用删除 wrong-target-branch 标签的接口。对于来自 fork 的 PR，GITHUB_TOKEN 没有修改上游仓库标签的权限，GitHub API 返回 403：Resource not accessible by integration。

影响

合法的 fork PR 会被错误标记为检查失败，维护者需要手动判断该失败是否可以忽略。这会影响外部贡献者提交 PR。

复现

PR #21 的目标分支是 dev，但 enforce job 失败：

RequestError [HttpError]: Resource not accessible by integration
url: https://api.github.com/repos/zqbxdev/webchat2api/issues/21/labels/wrong-target-branch
method: DELETE
status: 403

同一个 PR 的 review 检查已经通过，失败只来自目标分支检查里删除标签的权限问题。

建议

在 baseBranch === "dev" 时不要无条件删除标签。可以先读取当前 PR 标签，只有标签确实存在时再尝试删除；或者在删除标签返回 403 时仅记录警告并通过检查，因为此时目标分支已经满足要求。

[github-actions]

AI issue labeler summary (classification based on trusted dev branch evidence): Labels: bug, ci, priority: medium Evidence-sensitive labels considered: bug Confidence: 0.97 Reason: Issue reports a concrete CI defect: fork PRs targeting dev can fail the target-branch enforcement job due to an unconditional label deletion call that may return 403 with fork token permissions. Code evidence summary: Dev branch evidence supports applying bug/ci: .github/workflows/pr-target-branch.yml shows that when baseBranch === 'dev', the workflow always calls removeWrongTargetBranchLabel(), which invokes github.rest.issues.removeLabel(...) and rethrows any non-404 error. A fork-triggered pull_request_target run can hit 403 (Resource not accessible by integration) for label mutation, causing job failure even though target branch is correct. No dev evidence indicates this path is already guarded (e.g., pre-check label existence with safe handling, or swallowing 403 in the dev-base case), so fixed-in-dev/awaiting-release is not supported. Bounded dev branch evidence used: - .github/workflows/pr-target-branch.yml: baseBranch==='dev' unconditionally calls removeWrongTargetBranchLabel() - removeWrongTargetBranchLabel only ignores 404; non-404 (including 403) is thrown - Workflow trigger is pull_request_target, matching reported fork PR context - Workflow permissions include issues:write but fork integration restrictions can still block label mutation - No matching dev test/workflow guard found for 403 on label removal in dev-target path

[zqbxdev]

已确认这个问题在 dev 分支中已经修复。

根本原因是：当 PR 的目标分支已经是 dev 时，目标分支检查 workflow 仍会尝试删除 wrong-target-branch 标签；fork PR 场景下 GITHUB_TOKEN 可能没有修改上游仓库标签的权限，导致 GitHub API 返回 403 Resource not accessible by integration，从而让合法 PR 的 enforce job 失败。

修复提交：52bcf49bb6bb670e2fab44b59b5d3c4976027416 (ci: tolerate label cleanup permission errors)

该提交已让 .github/workflows/pr-target-branch.yml 在删除标签时同时容忍 404 和 403：404 表示标签已不存在，403 表示 fork/权限场景下无法清理标签；两种情况都不会再让目标分支已经正确的 PR 检查失败。

本次复核结果：

• dev 已同步到 origin/dev，当前 HEAD 为 9ea6a2da46fb1b539b20eaedcc496609052e618a
• workflow 中的 403 cleanup guard 已存在
• .github/workflows/pr-target-branch.yml LSP diagnostics clean
• python3 -m compileall -q services .github 通过
• python3 -m unittest test.test_v1_responses test.test_grok_provider 通过：Ran 80 tests ... OK (skipped=6)

感谢 @Zker67 报告这个 fork PR CI 权限问题。