CI: required-adjacent deps job cannot run on fork PRs (checks out head_ref from base repo)

[logan-nc]

The deps job in .github/workflows/make_test.yml checks out the PR branch by name:

  deps:
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}

head_ref is just the branch name and actions/checkout resolves it against the base repository, so for any PR from a fork the fetch fails (git fetch ... origin +refs/heads/<branch>* -> exit 1 after retries) and the job fails deterministically. This is why #280 and #281 showed a red deps check while all same-repo PRs pass it. The failure is unrelated to PR content and re-runs cannot fix it.

The job also auto-commits a regenerated install/DEPENDENCIES.inc back to the branch (contents: write + push), which likewise cannot work for fork branches.

Workaround used to unblock #280/#281: mirrored the fork PR head SHAs into the base repo under the same branch names (git push origin <sha>:refs/heads/<branch>), re-ran the job, and it passed. The mirror branches should be deleted after those PRs merge.

Proposed fix: default checkout (the PR merge ref) for the regeneration check, and replace the auto-commit with a failure + instructions when DEPENDENCIES.inc is stale on a fork PR — e.g.:

      - uses: actions/checkout@v4          # default: merge ref, works for forks
      - run: python3 gen_deps.py > DEPENDENCIES.inc
        working-directory: install
      - name: Commit if changed (same-repo PRs only)
        if: github.event.pull_request.head.repo.full_name == github.repository
        run: ...existing push logic...
      - name: Fail if stale (fork PRs)
        if: github.event.pull_request.head.repo.full_name != github.repository
        run: git diff --exit-code install/DEPENDENCIES.inc || (echo "DEPENDENCIES.inc is stale; run install/gen_deps.py and commit" && exit 1)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rewp8poxoQyorK48SwxEUv