Is it possible to clone/download a forked private repository of a Pull Request in by Github API installed in Original Repository?

Question

I created a GitHub App and installed it to a private repository.
It detects Pull Requests and add comment on it automatically and run some test for the incoming PR.

It works fine when the PR come from the same repository,
but it does not work when the PR is come from another private fork repository. (due to permission problem I think)

The sample code below is how I clone code (a zipped file) GitHub:

String template = "https://api.github.com/repos/%s/%s/zipball/refs/heads/%s";
String path = String.format(template, "USER", "REPOSITORY", "BRANCH");

HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create(path))
        .header("Authorization", "Bearer " + TOKEN)
        .header("Accept", "application/vnd.github.v3+json")
        .build();

// returns a redirect link to download the zipped code
HttpResponse<String> response = HttpClient.newHttpClient()
        .send(request, BodyHandlers.ofString());

• Point
  • Original Repository / Forked Repository are both private
  • My GitHub App is installed on Original Repository only
  • My GitHub App detects Pull Request opened on Original Repository
  • My GitHub App try to download the source files of the Pull Request
    • Fails when the source of Pull Request is come from Fork

Answer 1

You don't get any perms on the head (forked) repo unfortunately.

Since the PR itself belongs to the base repo though you do have perms to the pulls API, so you can get either a diff or patch for the PR using this endpoint with a media type header