From 00fa3e10db0a7bfd799449203d35c14f5df0fb4e Mon Sep 17 00:00:00 2001
From: MiMoHo <37556964+MiMoHo@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:07:48 +0200
Subject: [PATCH] fix(ai-policy): do not fail fork pull requests on the
 labelling step

Runs triggered from forks only get a read-only token and no secrets, so
adding the "AI assisted" label fails with HTTP 403. That fails the whole
job for exactly the pull requests that follow the policy and declare AI
use with an Assisted-by trailer. The label step before it already
ignores this error.

Mark the step as continue-on-error. The check for a coding-agent
Signed-off-by still fails the job.

Fixes #767

AI-Assisted-By: Claude Opus 5.5 (xhigh)
Signed-off-by: MiMoHo <37556964+MiMoHo@users.noreply.github.com>
---
 .github/workflows/ai-policy.yml  | 3 +++
 workflow-templates/ai-policy.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/ai-policy.yml b/.github/workflows/ai-policy.yml
index 4b4653ee..9b6d4943 100644
--- a/.github/workflows/ai-policy.yml
+++ b/.github/workflows/ai-policy.yml
@@ -140,6 +140,9 @@ jobs:
 
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
+        # Fork-triggered runs only get a read-only token, so labelling fails with HTTP 403.
+        # The label is informational; the checks below must still decide the job result.
+        continue-on-error: true
         env:
           # Fall back to the default token when the PAT is unavailable
           # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
diff --git a/workflow-templates/ai-policy.yml b/workflow-templates/ai-policy.yml
index 4b4653ee..9b6d4943 100644
--- a/workflow-templates/ai-policy.yml
+++ b/workflow-templates/ai-policy.yml
@@ -140,6 +140,9 @@ jobs:
 
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
+        # Fork-triggered runs only get a read-only token, so labelling fails with HTTP 403.
+        # The label is informational; the checks below must still decide the job result.
+        continue-on-error: true
         env:
           # Fall back to the default token when the PAT is unavailable
           # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)