Run CI on fork pull requests

[helizaga]

Summary

• Run ShellCheck, completion verification, and BATS for pull requests from forks.
• Limit the workflow token to contents: read.
• Disable checkout credential persistence before contributor-controlled scripts execute.

Why

The existing job guards skip all CI for external contributions, so fork pull requests can appear green without running ShellCheck or tests. Plain pull_request workflows are GitHub's intended unprivileged path for validating fork code.

Security model

• Fork pull_request runs receive no repository secrets.
• GITHUB_TOKEN is limited to contents: read, the minimum recommended for checkout.
• persist-credentials: false keeps that token out of Git configuration used by subsequent scripts.
• The repository requires approval for all external contributors before workflows run.
• Jobs use GitHub-hosted ephemeral runners; no self-hosted infrastructure is exposed.

Validation

• Resulting workflow parses as valid YAML.
• ShellCheck passes.
• Generated completion files are current.
• Merge simulation against current main is conflict-free.
• GitHub Actions validates the actual pull-request merge commit after each push.

Summary by CodeRabbit

• Chores
  • Updated continuous integration workflows to improve security and ensure validation jobs run consistently for contributions from forks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: da85f435-98cc-46c8-861b-729062966159

📥 Commits

Reviewing files that changed from the base of the PR and between c2ae136 and f6d8354.

📒 Files selected for processing (1)

• .github/workflows/lint.yml

---

Walkthrough

The lint workflow now grants only contents: read, disables persisted checkout credentials, and runs the shellcheck, completions, and test jobs for fork pull requests.

Changes

Lint workflow access and fork execution

Layer / File(s)	Summary
Update lint workflow execution and permissions .github/workflows/lint.yml	The workflow uses contents: read. The checkout steps do not persist credentials. The shellcheck, completions, and test jobs no longer use fork pull-request guards.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• coderabbitai/git-worktree-runner#179: This PR reverses the fork pull-request job restrictions introduced by PR #179 while retaining workflow hardening changes.

Suggested reviewers: natoboram

Poem

🐰 Permissions trimmed, credentials fade,
Forked pull requests join the parade.
Shellcheck and tests now run with care,
Completions check every change there.
The lint workflow hops everywhere.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling CI workflows for pull requests from forks.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fork-pr-ci

---

_{Comment @coderabbitai help to get the list of available commands.}

[averyjennings]

Approve — no blockers.

This removes the three job-level if: fork guards from .github/workflows/lint.yml, restoring ShellCheck/Completions/BATS coverage for fork PRs. Verified it's a clean, intentional revert of #179's lint.yml change (the PR blob matches the exact pre-#179 version; #179's commit 828413f added precisely these three lines), not a stale-snapshot regression.

The security reasoning in the description holds up under inspection:

• The workflow triggers on plain pull_request, not pull_request_target — so fork runs get no repository secrets and a read-only GITHUB_TOKEN. permissions: read-all enforces read-only regardless.
• lint.yml references no secrets at all. The only secret-bearing workflow, homebrew.yml (HOMEBREW_TAP_TOKEN), triggers solely on release and workflow_dispatch — neither reachable from a fork PR.
• The three jobs only checkout, install tooling, and run linters/tests on an ephemeral runner. Residual risk is runner compute abuse, already covered by GitHub's contributor-approval gate (and the stricter "Require approval for all outside collaborators" setting noted in the description if you want it).

This is a strict improvement: previously the skipped jobs reported neutral/green, so fork PRs like #183 merged with zero real CI coverage. Now those checks actually run.