IntelPython / dpnp / 26039730094 / 1

78%

master: 78%

push

github

Fix fork PR docs workflow (#2910)

## Problem
Fork PRs to this repository fail the `Build Sphinx` workflow with a 403
permission error:
```
remote: Permission to IntelPython/dpnp.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/IntelPython/dpnp.git/': The requested URL returned error: 403
Error: Action failed with "The process '/usr/bin/git' failed with exit code 128"
```

## GitHub Security Context

Fork PRs run with read-only `GITHUB_TOKEN` and cannot:
- ❌ Push to branches (including `gh-pages`)
- ❌ Post PR comments
- ❌ Access repository secrets

**Reference:** [GitHub Actions documentation on fork PR
security](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflows-in-forked-repositories)

> "The `GITHUB_TOKEN` has read-only permissions in pull requests from
forked repositories."

This is a security feature that cannot be overridden by workflow
permissions.

## Solution

This PR implements a **conditional publishing strategy** that respects
GitHub's fork PR security model:

### For Upstream PRs (same-repo branches):
✅ Builds documentation  
✅ Publishes to GitHub Pages (`gh-pages` branch)  
✅ Comments with direct URL:
https://intelpython.github.io/dpnp/pull/{number}/index.html
✅ Workflow passes

### For Fork PRs:
✅ Builds documentation  
✅ Uploads as workflow artifact (30-day retention)  
✅ Workflow passes (no 403 error)  
ℹ️ No comment (cannot post due to read-only token)  
ℹ️ Artifact visible in workflow run's "Artifacts" section

1539 of 2874 branches covered (53.55%)

Branch coverage included in aggregate %.

26293 of 32702 relevant lines covered (80.4%)

7930.5 hits per line