don't run add-reaction on PRs of forked repos

pkg/workflow/expressions.go

@@ -208,11 +208,18 @@ func buildReactionCondition() ConditionNode {
 	var terms []ConditionNode
 
 	terms = append(terms, BuildEventTypeEquals("issues"))
-	terms = append(terms, BuildEventTypeEquals("pull_request"))
 	terms = append(terms, BuildEventTypeEquals("issue_comment"))
 	terms = append(terms, BuildEventTypeEquals("pull_request_comment"))
 	terms = append(terms, BuildEventTypeEquals("pull_request_review_comment"))
 
+	// For pull_request events, we need to ensure it's not from a forked repository
+	// since forked repositories have read-only permissions and cannot add reactions
+	pullRequestCondition := &AndNode{
+		Left:  BuildEventTypeEquals("pull_request"),
+		Right: BuildNotFromFork(),
+	}
+	terms = append(terms, pullRequestCondition)
+
 	// Use DisjunctionNode to avoid deep nesting
 	return &DisjunctionNode{Terms: terms}
 }
@@ -285,6 +292,15 @@ func BuildActionEquals(action string) *ComparisonNode {
 	)
 }
 
+// BuildNotFromFork creates a condition to check that a pull request is not from a forked repository
+// This prevents the job from running on forked PRs where write permissions are not available
+func BuildNotFromFork() *ComparisonNode {
+	return BuildEquals(
+		BuildPropertyAccess("github.event.pull_request.head.repo.full_name"),
+		BuildPropertyAccess("github.repository"),
+	)
+}
+
 // BuildEventTypeEquals creates a condition to check if the event type equals a specific value
 func BuildEventTypeEquals(eventType string) *ComparisonNode {
 	return BuildEquals(

pkg/workflow/expressions_test.go

@@ -146,10 +146,12 @@ func TestBuildReactionCondition(t *testing.T) {
 	// The result should be a flat OR chain without deep nesting
 	expectedSubstrings := []string{
 		"github.event_name == 'issues'",
-		"github.event_name == 'pull_request'",
 		"github.event_name == 'issue_comment'",
 		"github.event_name == 'pull_request_comment'",
 		"github.event_name == 'pull_request_review_comment'",
+		"github.event_name == 'pull_request'",
+		"github.event.pull_request.head.repo.full_name == github.repository",
+		"&&",
 		"||",
 	}
 
@@ -159,10 +161,10 @@ func TestBuildReactionCondition(t *testing.T) {
 		}
 	}
 
-	// With DisjunctionNode, the output should be flat without extra parentheses at the start/end
-	expectedOutput := "github.event_name == 'issues' || github.event_name == 'pull_request' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_comment' || github.event_name == 'pull_request_review_comment'"
-	if rendered != expectedOutput {
-		t.Errorf("Expected exact output '%s', but got: %s", expectedOutput, rendered)
+	// With the fork check, the pull_request condition should be more complex
+	// It should contain both the event name check and the not-from-fork check
+	if !strings.Contains(rendered, "(github.event_name == 'pull_request') && (github.event.pull_request.head.repo.full_name == github.repository)") {
+		t.Errorf("Expected pull_request condition to include fork check, but got: %s", rendered)
 	}
 }
 
@@ -949,3 +951,13 @@ func TestHelperFunctionsForMultiline(t *testing.T) {
 		}
 	})
 }
+
+func TestBuildNotFromFork(t *testing.T) {
+	result := BuildNotFromFork()
+	rendered := result.Render()
+
+	expected := "github.event.pull_request.head.repo.full_name == github.repository"
+	if rendered != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, rendered)
+	}
+}