[d-morrison]

🤖 Generated with Claude Code

https://claude.ai/code/session_019xfc9prTTV5VeAucmWBrnw

---

Closes #1653.

The shared preview build job builds fork PRs on the caller's runs-on. For a private repository that is a lab runner or the WWU cluster, so a fork PR would run its own code there. Each migrated caller had to carry its own guard, and the first six dropped it.

The build job's if: now requires github.event.pull_request.head.repo.full_name == github.repository || !github.event.repository.private. A private repository never builds a fork PR; a public repository's fork PRs build on the caller's runner as before. The closed-event rule and the label rules are unchanged.

test_a_private_repository_never_builds_a_fork_pr in preview/tests/test_action_wiring.py pins both clauses. It fails on main and passes here (pytest preview/tests/test_action_wiring.py, 44 passed).

Takes effect for callers once v3 slides. The callers' own guards can drop after that.

CI-only change.

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

I fetched PR gha#1655 live. It is open, not a draft and not merged, and its head is 6b2b2b036c36a5e5ca9ad9a45b212cf5fdcc4384. That is the commit I reviewed, so the verdict applies to the current head.

The review stands: the earlier review of 2026-11-08T05:27:55Z also found it ready, and nothing in the diff has changed since. I did not run preview/tests/test_action_wiring.py.

Two non-blocking suggestions from the first review still apply:

• The comment on the new guard should say it also affects non-PR callers on private repositories.
• A changelog.d/ fragment should be added.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "6b2b2b036c36a5e5ca9ad9a45b212cf5fdcc4384",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "The build-job if guard in preview.yml composes correctly with the existing closed and label clauses, and the merge of main changed nothing in the PR's files.",
  "holistic_assessment": "The change is minimal and in scope for gha#1653, adds no permissions or interface changes, and the wiring test pins both guard substrings."
}

Reviewed commit: 6b2b2b0

Reviewed commit: 6b2b2b0

[github-actions]

💰 Cost: $0.7388 (review) — run