ci(jsonDataValidation): 完善 JSON 数据验证工作流，支持 Fork PR 处理

- 新增 Fork PR 检测逻辑与相关环境变量
- 优化 checkout 步骤，适配同仓库 PR、手动触发与 Fork PR 场景
- 新增 Fork PR 的目标 JSON 文件同步步骤
- 完善自动修复回推的权限与密钥校验逻辑
- 更新工作流的环境变量传递与条件判断

Author: huiyadanli

.github/workflows/jsonDataValidation.yml

@@ -37,15 +37,22 @@ jobs:
         run: |
           # 根据触发类型设置环境变量
           if [ "${{ github.event_name }}" = "pull_request_target" ]; then
+            IS_FORK=false
+            if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
+              IS_FORK=true
+            fi
             echo "触发类型: PR触发"
             echo "trigger_type=pr" >> $GITHUB_OUTPUT
             echo "validate_path=pr_files" >> $GITHUB_OUTPUT
             echo "auto_fix=true" >> $GITHUB_OUTPUT
             echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
             echo "head_ref=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
             echo "head_repo=${{ github.event.pull_request.head.repo.full_name }}" >> $GITHUB_OUTPUT
+            echo "head_sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
             echo "base_ref=${{ github.event.pull_request.base.ref }}" >> $GITHUB_OUTPUT
             echo "base_sha=${{ github.event.pull_request.base.sha }}" >> $GITHUB_OUTPUT
+            echo "maintainer_can_modify=${{ github.event.pull_request.maintainer_can_modify }}" >> $GITHUB_OUTPUT
+            echo "is_fork=$IS_FORK" >> $GITHUB_OUTPUT
           else
             echo "触发类型: 手动触发"
             echo "trigger_type=manual" >> $GITHUB_OUTPUT
@@ -54,18 +61,31 @@ jobs:
             echo "pr_number=${{ github.event.inputs.pr_number }}" >> $GITHUB_OUTPUT
             echo "head_ref=" >> $GITHUB_OUTPUT
             echo "head_repo=" >> $GITHUB_OUTPUT
+            echo "head_sha=" >> $GITHUB_OUTPUT
             echo "base_ref=main" >> $GITHUB_OUTPUT
             echo "base_sha=" >> $GITHUB_OUTPUT
+            echo "maintainer_can_modify=false" >> $GITHUB_OUTPUT
+            echo "is_fork=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Checkout code
+      - name: Checkout PR code for same-repo PR or manual run
+        if: ${{ steps.set_env.outputs.trigger_type != 'pr' || steps.set_env.outputs.is_fork != 'true' }}
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
+      - name: Checkout base repository for fork PR
+        if: ${{ steps.set_env.outputs.trigger_type == 'pr' && steps.set_env.outputs.is_fork == 'true' }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.base.sha }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -81,7 +101,10 @@ jobs:
           echo "触发类型: ${{ steps.set_env.outputs.trigger_type }}"
           echo "验证路径: ${{ steps.set_env.outputs.validate_path }}"
           echo "自动修复: ${{ steps.set_env.outputs.auto_fix }}"
+          echo "是否为fork PR: ${{ steps.set_env.outputs.is_fork }}"
           echo "PR号: ${{ steps.set_env.outputs.pr_number }}"
+          echo "Head SHA: ${{ steps.set_env.outputs.head_sha }}"
+          echo "允许维护者修改: ${{ steps.set_env.outputs.maintainer_can_modify }}"
           echo "Current directory: $(pwd)"
           echo "List files in root:"
           ls -la
@@ -95,6 +118,7 @@ jobs:
 
       - name: Setup Git and repositories
         run: |
+          BOT_TOKEN="${{ secrets.PR_FIX_PAT }}"
           git config --global user.name "GitHub Actions Bot"
           git config --global user.email "actions@github.com"
           # 设置Git处理中文等特殊字符
@@ -116,8 +140,13 @@ jobs:
           
           # 确保origin指向PR的fork仓库
           if [ "$PR_REPO" != "$MAIN_REPO" ] && [ "${{ steps.set_env.outputs.trigger_type }}" = "pr" ]; then
-            ORIGIN_REPO="https://github.com/${PR_REPO}.git"
-            echo "PR来自fork仓库，设置origin指向: $ORIGIN_REPO"
+            if [ -n "$BOT_TOKEN" ] && [ "${{ steps.set_env.outputs.maintainer_can_modify }}" = "true" ]; then
+              ORIGIN_REPO="https://x-access-token:${BOT_TOKEN}@github.com/${PR_REPO}.git"
+              echo "PR来自fork仓库，已配置自动修复推送目标"
+            else
+              ORIGIN_REPO="https://github.com/${PR_REPO}.git"
+              echo "PR来自fork仓库，但缺少 PR_FIX_PAT 或未允许维护者修改，后续将无法自动回推"
+            fi
           else
             ORIGIN_REPO=$UPSTREAM_REPO
             echo "PR来自同一仓库或非PR触发，origin与upstream相同: $ORIGIN_REPO"
@@ -136,12 +165,10 @@ jobs:
           
           # 检查是否处于PR环境并切换到正确的分支
           if [ "${{ steps.set_env.outputs.trigger_type }}" = "pr" ] && [ -n "${{ steps.set_env.outputs.head_ref }}" ]; then
-            echo "检测到PR，切换到PR分支: ${{ steps.set_env.outputs.head_ref }}"
+            echo "检测到PR，准备工作分支"
             if [ "$PR_REPO" != "$MAIN_REPO" ]; then
-              # fork仓库的PR，需要先创建本地分支追踪fork的远程分支
-              git checkout -b "${{ steps.set_env.outputs.head_ref }}" --track "origin/${{ steps.set_env.outputs.head_ref }}" || \
-              git checkout -b "${{ steps.set_env.outputs.head_ref }}" --no-track && \
-              git push --set-upstream origin "${{ steps.set_env.outputs.head_ref }}"
+              # fork仓库的PR不要直接检出fork代码，避免在受信上下文执行不受信工作区
+              git checkout -B "pr-fix-${{ steps.set_env.outputs.pr_number }}" "${{ steps.set_env.outputs.base_sha }}"
             else
               # 同一仓库的PR
               git checkout "${{ steps.set_env.outputs.head_ref }}" || git checkout -b "${{ steps.set_env.outputs.head_ref }}"
@@ -159,6 +186,63 @@ jobs:
             git checkout -b temp-validation-branch
           fi
 
+      - name: Apply fork PR JSON files to workspace
+        if: ${{ steps.set_env.outputs.trigger_type == 'pr' && steps.set_env.outputs.is_fork == 'true' }}
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pull_number = Number('${{ steps.set_env.outputs.pr_number }}');
+            const headOwner = '${{ github.event.pull_request.head.repo.owner.login }}';
+            const headRepo = '${{ github.event.pull_request.head.repo.name }}';
+            const headSha = '${{ steps.set_env.outputs.head_sha }}';
+
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number,
+              per_page: 100
+            });
+
+            const targetFiles = files.filter(file => /^repo\/pathing\/.*\.json$/.test(file.filename));
+            core.info(`需要同步到工作区的 JSON 文件数: ${targetFiles.length}`);
+
+            for (const file of targetFiles) {
+              if (file.status === 'removed') {
+                if (fs.existsSync(file.filename)) {
+                  fs.unlinkSync(file.filename);
+                  core.info(`已删除文件: ${file.filename}`);
+                }
+                continue;
+              }
+
+              if (file.status === 'renamed' && file.previous_filename && fs.existsSync(file.previous_filename)) {
+                fs.unlinkSync(file.previous_filename);
+                core.info(`已删除旧文件: ${file.previous_filename}`);
+              }
+
+              const response = await github.rest.repos.getContent({
+                owner: headOwner,
+                repo: headRepo,
+                path: file.filename,
+                ref: headSha
+              });
+
+              if (Array.isArray(response.data) || !response.data.content) {
+                throw new Error(`无法读取文件内容: ${file.filename}`);
+              }
+
+              const content = Buffer.from(response.data.content, 'base64').toString('utf8');
+              fs.mkdirSync(path.dirname(file.filename), { recursive: true });
+              fs.writeFileSync(file.filename, content);
+              core.info(`已同步文件: ${file.filename}`);
+            }
+
       - name: Prepare validation script
         run: |
           # 检查build目录和validate.py文件是否存在
@@ -282,9 +366,12 @@ jobs:
           GITHUB_ACTOR: ${{ github.actor }}
           PR_NUMBER: ${{ steps.set_env.outputs.pr_number }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_FIX_PAT: ${{ secrets.PR_FIX_PAT }}
           HEAD_REF: ${{ steps.set_env.outputs.head_ref }}
           PR_REPO: ${{ steps.set_env.outputs.head_repo || github.repository }}
           CHANGED_FILES_B64: ${{ steps.changed_files.outputs.changed_files }}
+          IS_FORK: ${{ steps.set_env.outputs.is_fork }}
+          MAINTAINER_CAN_MODIFY: ${{ steps.set_env.outputs.maintainer_can_modify }}
         run: |
           set -e
           # 使用base64解码文件列表
@@ -358,6 +445,26 @@ jobs:
           
           # 检查是否有文件被修改
           if [ -n "$(git status --porcelain)" ]; then
+            if [ "$IS_FORK" = "true" ] && [ "$MAINTAINER_CAN_MODIFY" != "true" ]; then
+              echo "Fork PR 需要开启“允许维护者修改”才能自动回推"
+              {
+                echo "### ❌ 自动修复无法回推"
+                echo "当前 PR 来自 fork，但未开启“允许维护者修改(Allow edits by maintainers)”。"
+                echo "请开启后重新运行工作流。"
+              } > validation_notes.md
+              exit 1
+            fi
+
+            if [ "$IS_FORK" = "true" ] && [ -z "$PR_FIX_PAT" ]; then
+              echo "缺少 PR_FIX_PAT，无法将修复推回 fork PR"
+              {
+                echo "### ❌ 自动修复无法回推"
+                echo "当前 PR 来自 fork，工作流需要仓库 Secret `PR_FIX_PAT` 才能自动推回修复结果。"
+                echo "请配置该 Secret 后重新运行工作流。"
+              } > validation_notes.md
+              exit 1
+            fi
+
             echo "发现修改，提交更改"
             git add .
             git commit -m "自动修复 JSON 格式和版本号 [ci skip]"
@@ -366,7 +473,10 @@ jobs:
             CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
             echo "当前分支: ${CURRENT_BRANCH}"
             
-            if [ "$CURRENT_BRANCH" = "HEAD" ]; then
+            if [ "$IS_FORK" = "true" ]; then
+              echo "推送修复到 fork 分支: ${HEAD_REF}"
+              git push origin HEAD:${HEAD_REF}
+            elif [ "$CURRENT_BRANCH" = "HEAD" ]; then
               # 如果在detached HEAD状态，使用正确的方式推送
               if [ -n "${HEAD_REF}" ]; then
                 echo "在detached HEAD状态，使用HEAD_REF推送: ${HEAD_REF}"
@@ -500,7 +610,7 @@ jobs:
           fi
           
       - name: Add PR comment
-        if: ${{ always() && ((steps.set_env.outputs.trigger_type == 'pr') || (steps.set_env.outputs.trigger_type == 'manual' && steps.set_env.outputs.pr_number != '' && steps.pr_info.outputs.found == 'true')) }}
+        if: ${{ always() && (steps.set_env.outputs.trigger_type == 'pr' || (steps.set_env.outputs.trigger_type == 'manual' && steps.set_env.outputs.pr_number != '' && steps.pr_info.outputs.found == 'true')) }}
         continue-on-error: true
         uses: actions/github-script@v6
         with: