Fork pull requests cannot pass CI because catalogue tests need App secrets #267

🤖 Generated with Claude Code in an interactive session with the maintainer.

Evidence

Codex found this on #243. Several catalogue CI jobs, such as the create-release dry runs and other App-backed tests, need APP_PRIVATE_KEY. GitHub withholds that from pull requests opened from forks, so those jobs fail, and CI - Required Checks fails with them. devantler-tech/actions already behaves this way. Once the catalogue lives here, a fork pull request to this repository fails CI too, even one that only fixes a typo in the organization profile or a deploy/ manifest. Dependabot pull requests are not affected: they pass in actions, so the key reaches them through Dependabot secrets.

Problem

External contributions to this repository can no longer pass its required check, whatever they touch.

Constraint

Simply skipping the secret-backed jobs for forks is not a fix. A fork pull request that changes exactly the workflows those jobs test would then pass the required check without testing them, which is the kind of gate bypass #243 removed.

Direction

Make a fork pull request that does not touch the catalogue (actions/, .scripts/, .github/) skip only the credential-dependent catalogue tests, and let the required check pass on the checks that still apply. A fork pull request that does touch the catalogue keeps failing closed and is re-pushed as a same-repository branch by a maintainer.

Acceptance criteria

• A fork pull request touching only non-catalogue paths can pass CI - Required Checks, and validate-manifests plus every secret-free test still runs.
• A fork pull request touching the catalogue still cannot pass without the credential-dependent tests.
• Both paths are tested, and the eligibility decision reads the changed paths from GitHub, never from anything the pull request controls.

Rough size: M.