Files
magnus919_agent-skills/opensource-contributions/references/cross-fork-org-restriction.md
T
Magnus Hedemark c5c4d2434a feat: add opensource-contributions skill
Comprehensive open source contribution guidance with progressive disclosure.
Restructured from a single ~23K-token monolithic SKILL.md into a concise
~1.2K-token orchestrator with 10 focused reference files.

Changes:
- SKILL.md: 1,720 lines → 100 lines (AgentSkills.io compliant frontmatter)
- 10 new reference files covering phases 0a-4, pitfalls, default posture
- Portable PR template compliance checker script (stdlib-only)
- All personal context scrubbed for public export
- AGENTS.md + README.md updated with trigger table entry

Signed-off-by: Magnus Hedemark <magnus919@pm.me>
2026-05-28 21:43:30 -04:00

3.0 KiB

Cross-Fork PR Failure Due to Org Restriction — Case Study

Context

2026-05-18: Contributing to shlinkio/shlink (PHP URL shortener) from fork magnus919/shlink.

All the usual approaches failed:

Approach Error
gh pr create --head magnus919:feat/agents-md GraphQL: magnus919 does not have the correct permissions to execute CreatePullRequest
gh api repos/shlinkio/shlink/pulls -f head="magnus919:feat/agents-md" 404 Not Found
curl -X POST ... (raw HTTP) 404 Not Found

What DID Work

The GitHub compare URL always works and pre-fills the diff:

https://github.com/shlinkio/shlink/compare/develop...magnus919:feat/agents-md

This requires a human to click "Create Pull Request" — not fully automatable, but the only reliable fallback.

Diagnostic Steps

These confirmed the setup was correct — the problem was on GitHub's side, not ours:

# 1. Confirm fork exists and is recognized
gh api repos/magnus919/shlink --jq '{.parent.full_name, .fork}'  → shlinkio/shlink, true

# 2. Confirm branch exists on fork
gh api repos/magnus919/shlink/branches/feat/agents-md --jq '.name'  → feat/agents-md

# 3. Confirm upstream can see the branch via compare API (the key check)
gh api repos/shlinkio/shlink/compare/develop...magnus919:feat/agents-md --jq '.status'  → ahead

# 4. Confirm PR creation within the same fork works (isolates the issue to cross-fork)
gh api repos/magnus919/shlink/pulls -f title="Test" -f head="feat/agents-md" -f base="develop"201 Created

# 5. Check token scopes
gh auth status  → ✓ Logged in, repo scope present

# 6. List PRs on upstream repo (read access confirmed)
gh api repos/shlinkio/shlink/pulls --jq '.[].number'  → returns PR numbers

Steps 3-5 all passed, which means the issue was an org-level restriction on the shlinkio organization — likely third-party access restrictions preventing the OAuth token from creating PRs via the API, even though the compare endpoint could see the branch.

Root Cause Hypothesis

The shlinkio organization likely has one of:

  • Third-party application access restrictions (the OAuth token's app is not authorized for the org)
  • SAML SSO enforcement that requires gh auth refresh --sso
  • "Allow outside collaborators to submit pull requests" disabled at the org level

Since the compare endpoint works (status: ahead) but PR creation returns 404, the token has read access but not the write access needed to create cross-fork PRs to repos in restricted orgs.

Takeaways

For future cross-fork PR contributions to org repos:

  1. Try gh pr create and gh api first — they'll work for most orgs
  2. If both fail with 404 despite gh api repos/org/repo/compare/develop...you:branch returning ahead:
    • Try gh auth refresh --sso to authorize the token for the org
    • If that doesn't help, hand off via the compare URL
  3. The compare URL is the universal fallback that works regardless of org restrictions