dgr-fixes: current upstream master + reviewed PR branches

.github/workflows/auto-version.yml

@@ -20,17 +20,22 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with: 
-          submodules: true
-          ref: ${{env.CURRENT_BRANCH}}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.head_ref || github.ref_name }}
+          fetch-depth: 0
+          persist-credentials: false
       - name: Update version
         id: update
         uses: vers-one/dotnet-project-version-updater@v1.7
         with:
           file: ./src/ACadSharp/ACadSharp.csproj
           version: ${{env.VERSION_FORMAT}}
       - name: Push changes
-        run: ./push-changes.sh
+        run: bash push-changes.sh
         shell: bash
         env:
-          VERSION: ${{steps.update.outputs.newVersion}}
-          BRANCH: ${{env.CURRENT_BRANCH}}
+          BRANCH: ${{github.head_ref || github.ref_name}}
+          VERSION: ${{steps.update.outputs.newVersion}}          
+          HEAD_REPO: ${{github.event.pull_request.head.repo.full_name}}
+          PUSH_TOKEN: ${{secrets.PUSH_TOKEN}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

push-changes.sh

@@ -1,16 +1,51 @@
-echo Prepare commit
-#Get commit details
-author=`git log -1 --format="%an"`
-email=`git log -1 --format="%ae"`
+#!/usr/bin/env bash
+set -e
+
+echo "Prepare commit"
+
+if [ -z "$BRANCH" ] || [ -z "$VERSION" ]; then
+  echo "BRANCH or VERSION not set"
+  exit 1
+fi
+
+# Target repo: the fork for contributor PRs, otherwise this repo
+TARGET_REPO="${HEAD_REPO:-$GITHUB_REPOSITORY}"
+
+# Fork pushes require the PAT; GITHUB_TOKEN can never push to forks
+if [ "$TARGET_REPO" != "$GITHUB_REPOSITORY" ]; then
+  if [ -z "$PUSH_TOKEN" ]; then
+    echo "PUSH_TOKEN is empty: secrets are not available (use pull_request_target and pass secrets.PUSH_TOKEN)"
+    exit 1
+  fi
+  TOKEN="$PUSH_TOKEN"
+else
+  TOKEN="${PUSH_TOKEN:-$GITHUB_TOKEN}"
+fi
+
+if [ -z "$TOKEN" ]; then
+  echo "No token available"
+  exit 1
+fi
+
+# Remove the GITHUB_TOKEN auth header persisted by actions/checkout
+git config --local --unset-all http.https://github.com/.extraheader || true
+
+# Get commit details
+author=$(git log -1 --format="%an")
+email=$(git log -1 --format="%ae")
 
 git config --local user.email "$email"
-git config --local user.name "$author" 
+git config --local user.name "$author"
+
 git add .
 if git diff-index --quiet HEAD; then
   echo "Nothing changed"
   exit 0
 fi
 
-echo "Pushing changes $BRANCH"
+echo "Pushing changes to $TARGET_REPO:$BRANCH"
 git commit -m "Update project version to $VERSION"
-git push origin $BRANCH
+
+git remote remove target 2>/dev/null || true
+git remote add target "https://x-access-token:${TOKEN}@github.com/${TARGET_REPO}.git"
+git push target "HEAD:$BRANCH"