Update workflows to better handle fork contributions

.github/workflows/bundle_size.yml

@@ -3,16 +3,23 @@ name: Check bundle size
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   size:
-    if: ${{ github.repository == 'primer/brand' }}
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name == github.repository }}
     name: Report bundle size
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout PR branch
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create main branch worktree
         run: git worktree add /tmp/main ${{ github.event.pull_request.base.sha }}
@@ -53,12 +60,14 @@ jobs:
         id: size-report
         run: |
           REPORT=$(node packages/repo-configs/scripts/bundle-size-report.js /tmp/pr-sizes.json /tmp/main-sizes.json)
-          echo "comment-body<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$REPORT" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
+          {
+            echo "comment-body<<EOF"
+            echo "$REPORT"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Add or update bundle size comment
-        uses: phulsechinmay/rewritable-pr-comment@v0.3.0
+        uses: phulsechinmay/rewritable-pr-comment@a1b041997fa84ec3e524ee9dee5ba0b5f4e73604 # v0.3.0
         with:
           message: ${{ steps.size-report.outputs.comment-body }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/bundle_size_forks.yml

@@ -0,0 +1,67 @@
+name: Check bundle size (forks)
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  size:
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name != github.repository }}
+    name: Report bundle size (fork)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Create main branch worktree
+        run: git worktree add /tmp/main ${{ github.event.pull_request.base.sha }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Caching dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Install and build (PR)
+        run: |
+          npm ci
+          npm run build:lib
+
+      - name: Measure bundle size (PR)
+        run: npx size-limit --json > /tmp/pr-sizes.json
+
+      - name: Install and build (main branch)
+        working-directory: /tmp/main
+        run: |
+          npm ci
+          cp ${{ github.workspace }}/.size-limit.js .size-limit.js
+          npm run build:lib
+
+      - name: Measure bundle size (main branch)
+        working-directory: /tmp/main
+        run: npx size-limit --json > /tmp/main-sizes.json 2>/dev/null || echo "[]" > /tmp/main-sizes.json
+
+      - name: Generate size report
+        run: |
+          node packages/repo-configs/scripts/bundle-size-report.js /tmp/pr-sizes.json /tmp/main-sizes.json > bundle-size-report.md
+          cat bundle-size-report.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload bundle size report
+        uses: actions/upload-artifact@v7
+        with:
+          name: bundle-size-report
+          path: bundle-size-report.md
+          retention-days: 14

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
       - next-minor
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     if: ${{ github.repository == 'primer/brand' }}
@@ -15,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v6

.github/workflows/deploy_docs_preview.yml

@@ -4,16 +4,16 @@ on:
   pull_request:
 
 permissions:
-  checks: write
   contents: read
-  deployments: write
-  pages: write
-  id-token: write
 
 jobs:
   deploy:
-    if: ${{ github.repository == 'primer/brand' }}
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name == github.repository }}
     name: Preview
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     # SHA for security hardening. Points at 2.4.0 release
     uses: primer/.github/.github/workflows/deploy_preview.yml@2bbbbf004e8281856e08f6607eb46a7ee59e65ed # v2.4.0
     with:

.github/workflows/deploy_docs_preview_forks.yml

@@ -1,19 +1,19 @@
-name: Deploy
+name: Deploy base preview for forks
 
 on:
   pull_request_target:
 
 permissions:
-  checks: write
   contents: read
-  deployments: write
-  pages: write
-  id-token: write
 
 jobs:
   deploy:
-    if: ${{ github.repository != github.event.pull_request.head.repo.full_name }}
-    name: Preview
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name != github.repository }}
+    name: Base preview
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     # SHA for security hardening. Points at 2.4.0 release
     uses: primer/.github/.github/workflows/deploy_preview.yml@2bbbbf004e8281856e08f6607eb46a7ee59e65ed # v2.4.0
     with:

.github/workflows/integration_test_astro.yml

@@ -8,6 +8,9 @@ on:
     - cron: '0 0 * * *' # end of each day (UTC)
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: ${{ github.repository == 'primer/brand' }}
@@ -28,6 +31,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v6

.github/workflows/integration_test_nextjs.yml

@@ -8,6 +8,9 @@ on:
     - cron: '0 0 * * *' # end of each day (UTC)
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: ${{ github.repository == 'primer/brand' }}
@@ -28,6 +31,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v6

.github/workflows/ui_test_accessibility.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   accessibility:
     if: ${{ github.repository == 'primer/brand' }}
@@ -15,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v6

.github/workflows/ui_test_diff_comment.yml

@@ -5,21 +5,31 @@ on:
     paths:
       - 'packages/react/**'
       - '.github/workflows/ui_test_diff_comment.yml'
+      - '.github/workflows/ui_test_diff_comment_forks.yml'
+
+permissions:
+  contents: read
 
 jobs:
   coverage-diff:
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name == github.repository }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout current branch
         uses: actions/checkout@v6
         with:
           path: current
+          persist-credentials: false
 
       - name: Checkout main branch
         uses: actions/checkout@v6
         with:
           ref: main
           path: main
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v6

.github/workflows/ui_test_diff_comment_forks.yml

@@ -0,0 +1,81 @@
+name: Unit test coverage diff (forks)
+
+on:
+  pull_request:
+    paths:
+      - 'packages/react/**'
+      - '.github/workflows/ui_test_diff_comment.yml'
+      - '.github/workflows/ui_test_diff_comment_forks.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  coverage-diff:
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name != github.repository }}
+    name: Coverage diff (fork)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout current branch
+        uses: actions/checkout@v6
+        with:
+          path: current
+          persist-credentials: false
+
+      - name: Checkout main branch
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          path: main
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.14.1
+
+      - name: Cache dependencies (current)
+        uses: actions/cache@v5
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-current-${{ hashFiles('current/**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-current-
+
+      - name: Cache dependencies (main)
+        uses: actions/cache@v5
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-main-${{ hashFiles('main/**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-main-
+
+      - name: Install dependencies (current branch)
+        working-directory: current
+        run: npm ci
+
+      - name: Install dependencies (main branch)
+        working-directory: main
+        run: npm ci
+
+      - name: Run tests with coverage (current branch)
+        working-directory: current/packages/react
+        run: npm run test -- --coverage --coverageReporters=json-summary --coverageReporters=json --passWithNoTests --watchAll=false
+
+      - name: Run tests with coverage (main branch)
+        working-directory: main/packages/react
+        run: npm run test -- --coverage --coverageReporters=json-summary --coverageReporters=json --passWithNoTests --watchAll=false
+
+      - name: Generate coverage report
+        working-directory: current
+        run: |
+          npm exec -- tsx packages/repo-configs/scripts/get-coverage.ts > coverage-diff.md
+          cat coverage-diff.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-diff
+          path: current/coverage-diff.md
+          retention-days: 14

.github/workflows/ui_test_primitives_diff.yml

@@ -3,20 +3,29 @@ name: UI test
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    if: ${{ github.repository == 'primer/brand' }}
+    if: ${{ github.repository == 'primer/brand' && github.event.pull_request.head.repo.full_name == github.repository }}
     name: Primitives diff
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Checkout reference branch
         uses: actions/checkout@v6
         with:
           ref: ${{ github.base_ref }}
           path: temp-main
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@v6