- Hoist NETLIFY_BUNDLE_ANALYZER_SITE_ID into job-level env so the
Netlify-publish step's `if:` can gate on it -- secrets aren't
available in step-level `if:` conditionals, so the previous check
always evaluated false and the job would fail before it, per GH
Actions' documented if-conditional context availability.
- Gate comment-on-alert on same-repo PRs in the bundle-size job. On a
fork PR GITHUB_TOKEN is forced read-only, so once the alert
threshold is crossed the action's pulls.createReview call 403s and
that error isn't caught by fail-on-alert, which only governs the
deliberate alert-threshold failure -- it propagates and fails the
job outright. Fork PRs still get the comparison via summary-always.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2db8f64239