[hassiebp]

What does this PR do?

Fork PRs turn CI red even when the change is fine. GitHub does not expose repository secrets to pull requests from forks, so every test that calls OpenAI fails with an authentication error. On #2030, for example, "E2E shard 2" failed 2 tests and "E2E live-provider" failed 35, all because the OpenAI key was missing.

This PR keeps provider secrets away from fork code and makes those PRs green on everything that can actually run:

• CI: the live_provider matrix entry skips the Langfuse server startup and the test run when the PR comes from a fork, and posts a notice explaining why. Same-repo PRs, pushes to main, tags and manual dispatches are unchanged. They still run the full suite, so a missing key there still fails loudly.
• Tests: test_decorators_langchain and test_async_nested_openai_chat_stream move from tests/e2e/test_decorators.py into tests/live_provider/test_decorators.py. They make real OpenAI calls, so they belong in the live suite, not in the e2e shards that fork PRs still run. The code moves unchanged, along with the helpers it uses.
• Docs: AGENTS.md and CONTRIBUTING.md now describe the fork skip and the rule that provider-calling tests live in tests/live_provider.

The trade-off: if a fork PR breaks provider-facing behavior, the live suite catches it on main after merge rather than on the PR. The longer-term fix is replaying recorded provider responses, so contributors get that coverage without keys.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation update
• Tooling, CI, or repo maintenance

Verification

uv run --frozen ruff check .                       # All checks passed!
uv run --frozen ruff format --check tests          # 57 files already formatted
uv run --frozen pytest --collect-only -q tests/e2e/test_decorators.py         # 30 tests (was 32)
uv run --frozen pytest --collect-only -q -m live_provider tests/live_provider # 87 tests (was 85)
uvx zizmor --offline .github/workflows/ci.yml      # No findings to report
uvx --from actionlint-py actionlint .github/workflows/ci.yml  # only the existing blacksmith runner-label warnings

This PR is same-repo, so its own CI run should still run the live-provider suite in full. The fork-skip branch only runs on a fork PR, so it is checked by expression review rather than an actual run.

Checklist

• I self-reviewed the diff using code_review.md.
• I added or updated tests for behavior changes.
• I updated docs, examples, or .env.template if needed.
• I did not hand-edit generated files; if generated files changed, I used the upstream regeneration path.
• I did not commit secrets or credentials.

  

Confidence Score: 4/5

The fork skip and test move appear sound, but the import must be moved to satisfy the repository rule before merging.

Summary

This PR skips live-provider setup and tests on fork pull requests while keeping the e2e shards enabled.

• Fork pull requests skip the live-provider job without skipping other tests.
• Provider-calling decorator tests now run in the live-provider suite.

Acknowledged trade-off: hassiebp states that provider-facing regressions from forks will be caught on main after merge; recorded responses are deferred.

_{Reviews (1) · Last reviewed commit: "ci: skip live-provider tests on fork pul..." · Reviewed by Greptile}

[github-actions]

@claude review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T15:45:53.320794Z	8b70105	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Import is inside the test

The new module imports AsyncOpenAI inside test_async_nested_openai_chat_stream. The repository rule requires imports at the top of the module. Move this import beside the other langfuse imports before merging to satisfy that requirement.

Rule Used: Move imports to the top of the module instead of placing them within functions or methods. (source)

Learned From
langfuse/langfuse-python#1387

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/live_provider/test_decorators.py
Line: 126

Comment:
**Import is inside the test**

The new module imports `AsyncOpenAI` inside `test_async_nested_openai_chat_stream`. The repository rule requires imports at the top of the module. Move this import beside the other `langfuse` imports before merging to satisfy that requirement.

**Rule Used:** Move imports to the top of the module instead of placing them within functions or methods. ([source](https://app.greptile.com/personal-org-4986/-/custom-context?memory=c960fc07-9928-409f-a18b-a780cbdded12))

**Learned From**
[langfuse/langfuse-python#1387](https://github.com/langfuse/langfuse-python/pull/1387)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!