fix(ci): support fork PRs via pull_request_target in ai-review workflow (#133)

Author: b3nw

.fork/features/ci.md

@@ -54,3 +54,18 @@ Verification:
 - Env var names cross-checked against `action.yml`, `docs/configs/.ai-review.yaml`,
   and `docs/ci/github.yaml` from the upstream repo.
 - v0.69.0 confirmed as latest release (July 8, 2026).
+
+## 2026-09-03 — Support fork PRs via pull_request_target in AI PR Review workflow
+
+Branch: `fix/ci-ai-review-pull-request-target`
+Files:
+- `.github/workflows/ai-review.yml`
+
+Notes:
+- Replaces `on: pull_request` with `on: pull_request_target` so external contributor
+  fork PRs receive repository secrets/variables and no longer crash with Pydantic
+  validation errors.
+- Pins checkout ref to `github.event.pull_request.head.sha` with `actions/checkout@v4`.
+- Adds fallback between Secrets and Variables for `LLM_PROXY_URL`, `LLM_PROXY_API_KEY`,
+  and `LLM_PROXY_MODEL`.
+- Uses sensible fallback model `codex/gpt-5.6-sol` if `LLM_PROXY_MODEL` is empty.

.fork/stack.yml

@@ -55,6 +55,7 @@ rules:
     ci:
       - "feat(ci): fork-aware release notes with incremental topic diff"
       - "fix(ci): add AI PR review workflow"
+      - "fix(ci): support fork PRs via pull_request_target in ai-review workflow"
     tooling:
       - "feat(tooling): add AGENTS.md and .agent/ config for linear stack workflow"
       - "fix(tooling): scope fork-stack gate to canonical branch and tolerate transient commits"

.github/workflows/ai-review.yml

@@ -20,7 +20,7 @@
 name: AI PR Review
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
     branches:
       - dev
@@ -40,23 +40,24 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # Fetch full history so git diff operates correctly
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Run AI Review
         uses: Nikita-Filonov/ai-review@v0.69.0
         env:
           # --- LLM Provider & Model Configuration ---
           LLM__PROVIDER: "OPENAI"
-          LLM__META__MODEL: ${{ vars.LLM_PROXY_MODEL }}
+          LLM__META__MODEL: ${{ vars.LLM_PROXY_MODEL || secrets.LLM_PROXY_MODEL || 'codex/gpt-5.6-sol' }}
           LLM__META__MAX_TOKENS: "15000"
           LLM__META__TEMPERATURE: "0.2"
 
           # --- LLM Proxy Masked Routing ---
-          LLM__HTTP_CLIENT__API_URL: ${{ secrets.LLM_PROXY_URL }}
-          LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.LLM_PROXY_API_KEY }}
+          LLM__HTTP_CLIENT__API_URL: ${{ secrets.LLM_PROXY_URL || vars.LLM_PROXY_URL }}
+          LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.LLM_PROXY_API_KEY || vars.LLM_PROXY_API_KEY }}
           # Proxy adds a hop; extend timeout beyond the 120s default
           LLM__HTTP_CLIENT__TIMEOUT: "180"