Require fork PRs to link an issue (#425)

Add a `linked issue` check that fails PRs from forks unless the
description links an issue in this repository. PRs from branches in the
repo are exempt. It runs on pull_request_target so a fork cannot edit its
own check, and never checks out PR code.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/pull_request_template.md

@@ -0,0 +1,9 @@
+<!-- PRs from forks must link an issue: add a line "Closes #<number>" outside this comment, or the "linked issue" check fails. -->
+
+## Summary
+
+-
+
+## Test plan
+
+- [ ]

.github/workflows/linked-issue.yml

@@ -0,0 +1,49 @@
+name: Linked issue
+
+on:
+  # Runs main's copy of this workflow, so a fork PR can't edit its own check. It never checks out PR code.
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  issues: read
+  pull-requests: read
+
+jobs:
+  linked-issue:
+    name: linked issue
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a linked issue on fork PRs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          OWNER: ${{ github.repository_owner }}
+          REPO: ${{ github.event.repository.name }}
+        run: |
+          # Only people with write access can push branches here; author_association hides private org members.
+          if [ "$HEAD_REPO" = "$OWNER/$REPO" ]; then
+            echo "PR is from a branch in $OWNER/$REPO; no linked issue required."
+            exit 0
+          fi
+
+          linked=$(gh api graphql \
+            -F owner="$OWNER" -F repo="$REPO" -F number="$PR_NUMBER" \
+            -f query='query($owner: String!, $repo: String!, $number: Int!) {
+              repository(owner: $owner, name: $repo) {
+                pullRequest(number: $number) {
+                  closingIssuesReferences(first: 10) { nodes { number repository { nameWithOwner } } }
+                }
+              }
+            }' \
+            --jq "[.data.repository.pullRequest.closingIssuesReferences.nodes[]
+                   | select(.repository.nameWithOwner == \"$OWNER/$REPO\") | .number] | join(\", #\")")
+
+          if [ -n "$linked" ]; then
+            echo "Linked issue: #$linked"
+            exit 0
+          fi
+
+          echo "::error::PRs from forks must link an issue in $OWNER/$REPO. Add \"Closes #<number>\" (or Fixes/Resolves) to the PR description and this check re-runs automatically. No issue yet? Open one first: https://github.com/$OWNER/$REPO/issues/new"
+          exit 1

AGENTS.md

@@ -18,6 +18,7 @@ When changing authentication, organization, sandbox, or managed-compute APIs, in
 
 ## CI and release gates
 
-- GitHub protection for `main` must require the `fmt, clippy, test` and `version sanity` checks from GitHub Actions, including for administrators. Do not require a merge queue or require branches to be up to date. These settings are managed in GitHub, not by this file.
+- GitHub protection for `main` must require the `fmt, clippy, test`, `version sanity`, and `linked issue` checks from GitHub Actions, including for administrators. Do not require a merge queue or require branches to be up to date. These settings are managed in GitHub, not by this file.
+- `linked issue` fails PRs from forks unless the description links an issue in this repository (e.g. `Closes #N`). PRs from branches in this repository are exempt, since only people with write access can push them. It runs on `pull_request_target`, so it must never check out or run PR code.
 - PR CI must test GitHub's simulated merge (`refs/pull/<number>/merge`), which `actions/checkout` selects by default for `pull_request` events, rather than checking out the PR head alone. Each run tests its merge candidate; subsequent changes to `main` do not automatically rerun open PRs.
 - CI also runs on `main`. Releases call the same CI workflow on the commit being packaged; publishing requires that run to succeed. Keep `./ci` in cargo-dist's `global-artifacts-jobs` when regenerating the release workflow.