From 36851c45970254dd4b9f0b917cdb08cd0c7574f8 Mon Sep 17 00:00:00 2001
From: Warren Lee <5959690+wrn14897@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:18:56 -0700
Subject: [PATCH] fix(ci): skip otel export job on fork PRs to avoid
 secret-less failures

External-contributor (fork) PRs do not receive repository secrets, so
secrets.OTLP_ENDPOINT is empty. The otel-cicd-action then builds the
endpoint as '/v1/traces' (no host), falls into the gRPC exporter path,
and fails with 'Name resolution failed for target dns:v1'.

Guard the OpenTelemetry Export Trace job so it only runs for same-repo
events (push, internal PRs, schedule) and skips on fork PRs. Add a
step-level env guard as defense-in-depth so an empty endpoint never
reaches the action even on same-repo runs where the secret is unset.

This job is not a required check, so this only removes the spurious red
status on external-contributor PRs; it does not change merge gating.
---
 .github/workflows/chart-test.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/chart-test.yml b/.github/workflows/chart-test.yml
index 529412e8..23b68311 100644
--- a/.github/workflows/chart-test.yml
+++ b/.github/workflows/chart-test.yml
@@ -95,12 +95,21 @@ jobs:
           kind delete cluster --name "test-${{ matrix.suite }}" || true
 
   otel-cicd-action:
-    if: always()
+    # Only run when secrets are available. Fork PRs (external contributors) do
+    # not receive repository secrets, so OTLP_ENDPOINT is empty and the export
+    # action fails with "Name resolution failed for target dns:v1". Skip the job
+    # on fork PRs and run it for same-repo events (push, internal PRs, schedule).
+    if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
     name: OpenTelemetry Export Trace
     runs-on: ubuntu-latest
     needs: [integration-test]
+    env:
+      OTLP_ENDPOINT: ${{ secrets.OTLP_ENDPOINT }}
     steps:
       - name: Export workflow
+        # Defense-in-depth: skip if the endpoint secret is unset even on
+        # same-repo runs, so an empty endpoint never reaches the action.
+        if: ${{ env.OTLP_ENDPOINT != '' }}
         uses: corentinmusard/otel-cicd-action@v4
         with:
           otlpEndpoint: ${{ secrets.OTLP_ENDPOINT }}/v1/traces