From 0130f096c220aad71ce4ff0e039bd8329031914c Mon Sep 17 00:00:00 2001
From: Trask Stalnaker <trask.stalnaker@gmail.com>
Date: Thu, 9 Jul 2026 10:46:13 -0700
Subject: [PATCH 1/2] Ignore fork PRs in check suite webhooks

---
 .../netlify/functions/github-webhook.js       | 46 ++++++++++++++-----
 1 file changed, 35 insertions(+), 11 deletions(-)

diff --git a/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js b/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js
index 076587c2d..273423f9e 100644
--- a/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js
+++ b/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js
@@ -169,9 +169,10 @@ function extractPullRequestNumber(eventName, payload) {
     return payload.issue.number;
   }
 
-  const checkPullRequestNumber = extractPullRequestNumberFromPullRequests([
+  const checkPullRequestNumber = extractPullRequestNumberFromCheckSuitePullRequests(
     payload.check_suite && payload.check_suite.pull_requests,
-  ]);
+    payload.repository,
+  );
   if (checkPullRequestNumber) {
     return checkPullRequestNumber;
   }
@@ -187,20 +188,43 @@ function extractPullRequestNumber(eventName, payload) {
   ]);
 }
 
-function extractPullRequestNumberFromPullRequests(pullRequestLists) {
-  for (const pullRequests of pullRequestLists) {
-    if (!Array.isArray(pullRequests)) {
-      continue;
-    }
-    for (const pullRequest of pullRequests) {
-      if (pullRequest && Number.isInteger(pullRequest.number)) {
-        return pullRequest.number;
-      }
+function extractPullRequestNumberFromCheckSuitePullRequests(pullRequests, repository) {
+  if (!Array.isArray(pullRequests)) {
+    return undefined;
+  }
+  for (const pullRequest of pullRequests) {
+    if (
+      pullRequest &&
+      Number.isInteger(pullRequest.number) &&
+      checkSuitePullRequestBelongsToRepository(pullRequest, repository)
+    ) {
+      return pullRequest.number;
     }
   }
   return undefined;
 }
 
+function checkSuitePullRequestBelongsToRepository(pullRequest, repository) {
+  const repositoryUrl = repository && repository.url;
+  if (!repositoryUrl) {
+    return false;
+  }
+  // check_suite.pull_requests are commit/ref associations and can point at a
+  // fork PR whose head is this repository. Only dispatch for PRs owned by the
+  // repository that emitted this webhook event.
+  const pullRequestRepositoryUrl = repositoryUrlFromPullRequestApiUrl(pullRequest.url);
+  const baseRepositoryUrl = pullRequest.base && pullRequest.base.repo && pullRequest.base.repo.url;
+  return pullRequestRepositoryUrl === repositoryUrl || baseRepositoryUrl === repositoryUrl;
+}
+
+function repositoryUrlFromPullRequestApiUrl(url) {
+  if (typeof url !== "string") {
+    return "";
+  }
+  const match = url.match(/^(https:\/\/api\.github\.com\/repos\/[^/]+\/[^/]+)\/pulls\/\d+$/);
+  return match ? match[1] : "";
+}
+
 function extractPullRequestNumberFromUrls(urls) {
   for (const url of urls) {
     if (typeof url !== "string") {

From 9d52bfcfe9054fc69a9018bf7a00d9a5af43e97c Mon Sep 17 00:00:00 2001
From: Trask Stalnaker <trask.stalnaker@gmail.com>
Date: Thu, 9 Jul 2026 11:30:37 -0700
Subject: [PATCH 2/2] update comment

---
 .../netlify/functions/github-webhook.js                     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js b/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js
index 273423f9e..fcde8af05 100644
--- a/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js
+++ b/.github/scripts/pull-request-dashboard/netlify/functions/github-webhook.js
@@ -210,8 +210,10 @@ function checkSuitePullRequestBelongsToRepository(pullRequest, repository) {
     return false;
   }
   // check_suite.pull_requests are commit/ref associations and can point at a
-  // fork PR whose head is this repository. Only dispatch for PRs owned by the
-  // repository that emitted this webhook event.
+  // fork PR whose head is this repository. Only dispatch when the associated PR
+  // itself belongs to the repository that emitted this webhook event; the
+  // workflow dispatch passes repository + pr_number, and PR numbers are
+  // repository-scoped.
   const pullRequestRepositoryUrl = repositoryUrlFromPullRequestApiUrl(pullRequest.url);
   const baseRepositoryUrl = pullRequest.base && pullRequest.base.repo && pullRequest.base.repo.url;
   return pullRequestRepositoryUrl === repositoryUrl || baseRepositoryUrl === repositoryUrl;