Pull request target fix

.github/workflows/pr-label-gate.yml

@@ -0,0 +1,21 @@
+name: PR Label Gate
+
+on:
+  pull_request:
+    types: [opened, labeled, unlabeled, synchronize]
+
+jobs:
+  check-fork-acknowledgment:
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for acknowledgment label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const labels = context.payload.pull_request.labels.map(l => l.name);
+            if (!labels.includes('post-merge-tests-ack')) {
+              core.setFailed(
+                'A reviewer with write access must add the "post-merge-tests-ack" label to acknowledge that tests will be verified post-merge.'
+              );
+            }

.github/workflows/workflow.yml

@@ -1,18 +1,18 @@
-on: [push, pull_request_target]
+on: [push, pull_request]
 name: Test and lint
 
 jobs:
 
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - run: npm test
 
   package_check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
       - name: "Ensure that code has been packaged and commited"
         run: |-
             npm install
@@ -21,12 +21,13 @@ jobs:
               (echo -e "\nPlease run 'npm run package' and commit the results" && exit 1)
 
   test:
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
 
       - name: Install doctl
         uses: ./
@@ -45,7 +46,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
 
       - name: Install doctl
         uses: ./
@@ -60,12 +61,13 @@ jobs:
           doctl compute region list 2>&1 | grep -qi "Unable to initialize DigitalOcean API client: access token is required"
 
   test_custom_version_linux_and_mac:
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
 
       - name: Install doctl
         uses: ./
@@ -82,9 +84,10 @@ jobs:
         run: doctl compute region list
 
   test_custom_version_windows:
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
 
       - name: Install doctl
         uses: ./
@@ -99,3 +102,43 @@ jobs:
 
       - name: Verify log-in
         run: doctl compute region list
+
+  ci_success:
+    runs-on: ubuntu-latest
+    needs:
+      - lint
+      - package_check
+      - test
+      - test_no_auth
+      - test_custom_version_linux_and_mac
+      - test_custom_version_windows
+    if: always()
+
+    steps:
+      - name: Validate job results
+        run: |
+          echo "Checking workflow results..."
+
+          NEEDS_JSON='${{ toJson(needs) }}'
+
+          # Detect fork PR
+          if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
+            echo "Fork PR detected → checking only mandatory jobs"
+            REQUIRED_JOBS=("lint" "package_check" "test_no_auth")
+          else
+            echo "Internal PR or push → checking all jobs"
+            REQUIRED_JOBS=("lint" "package_check" "test" "test_no_auth" "test_custom_version_linux_and_mac" "test_custom_version_windows")
+          fi
+
+          for job in "${REQUIRED_JOBS[@]}"; do
+            result=$(echo "$NEEDS_JSON" | jq -r ".\"$job\".result")
+
+            echo "$job → $result"
+
+            if [[ "$result" == "failure" || "$result" == "cancelled" ]]; then
+              echo "$job failed"
+              exit 1
+            fi
+          done
+
+          echo "All required jobs passed."

dist/index.js

@@ -10954,7 +10954,7 @@ async function downloadDoctlWithFallback(requestedVersion, type, architecture) {
             core.info(`Attempting to download doctl v${requestedVersion}`);
             return await downloadDoctl(requestedVersion, type, architecture);
         } catch (error) {
-            core.warning(`Failed to download requested version v${requestedVersion}, will try recent versions`);
+            core.warning(`Failed to download requested version v${requestedVersion} : ${error.message}, will try recent versions`);
         }
     }
 
@@ -10968,7 +10968,7 @@ async function downloadDoctlWithFallback(requestedVersion, type, architecture) {
             core.info(`Successfully downloaded doctl v${version}`);
             return { installPath, version };
         } catch (error) {
-            core.warning(`Failed to download doctl v${version}, trying next version`);
+            core.warning(`Failed to download doctl v${version} : ${error.message}, trying next version`);
             continue;
         }
     }
@@ -11014,7 +11014,7 @@ Failed to retrieve latest version; falling back to: ${fallbackVersion}`);
             actualVersion = version;
         } catch (error) {
             // If the download fails (e.g., missing artifacts), try fallback versions
-            core.warning(`Failed to download doctl v${version}, trying fallback versions`);
+            core.warning(`Failed to download doctl v${version} : ${error.message}, trying fallback versions`);
             const result = await downloadDoctlWithFallback(requestedVersion, process.platform, process.arch);
             path = await tc.cacheDir(result.installPath, 'doctl', result.version);
             actualVersion = result.version;

main.js

@@ -76,7 +76,7 @@ async function downloadDoctlWithFallback(requestedVersion, type, architecture) {
             core.info(`Attempting to download doctl v${requestedVersion}`);
             return await downloadDoctl(requestedVersion, type, architecture);
         } catch (error) {
-            core.warning(`Failed to download requested version v${requestedVersion}, will try recent versions`);
+            core.warning(`Failed to download requested version v${requestedVersion} : ${error.message}, will try recent versions`);
         }
     }
 
@@ -90,7 +90,7 @@ async function downloadDoctlWithFallback(requestedVersion, type, architecture) {
             core.info(`Successfully downloaded doctl v${version}`);
             return { installPath, version };
         } catch (error) {
-            core.warning(`Failed to download doctl v${version}, trying next version`);
+            core.warning(`Failed to download doctl v${version} : ${error.message}, trying next version`);
             continue;
         }
     }
@@ -136,7 +136,7 @@ Failed to retrieve latest version; falling back to: ${fallbackVersion}`);
             actualVersion = version;
         } catch (error) {
             // If the download fails (e.g., missing artifacts), try fallback versions
-            core.warning(`Failed to download doctl v${version}, trying fallback versions`);
+            core.warning(`Failed to download doctl v${version} : ${error.message}, trying fallback versions`);
             const result = await downloadDoctlWithFallback(requestedVersion, process.platform, process.arch);
             path = await tc.cacheDir(result.installPath, 'doctl', result.version);
             actualVersion = result.version;