ci: fix helm diff in case of forks (#15818)

.github/workflows/helm-diff-ci.yml

@@ -3,8 +3,9 @@ name: Helm Loki Diff CI
 on:
   pull_request:
     paths:
-      - 'production/helm/loki/**'
+      - "production/helm/loki/**"
 
+# These permissions are needed to assume roles from Github's OIDC.
 permissions:
   contents: read
   pull-requests: write
@@ -273,6 +274,7 @@ jobs:
   summary-diff-outputs:
     name: Summary Diffs
     runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.fork == false
     needs:
       - single-binary-diff
       - default-values-diff
@@ -283,6 +285,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/download-artifact@v4
         with:

production/helm/loki/scenarios/README.md

@@ -61,3 +61,9 @@ As the last step you need to run a diff between both files:
 ```shell
   diff current-manifest.yaml release-manifest.yaml
 ```
+
+### Known Issues
+
+* The Github Action won't be able to post the diff comment if the PR is coming from a fork, because of permissions the workflow run from a fork is not able to write in the PR content.
+
+  In this case, to review the output we recommend to download the artifacts in the workflow run and check the outputs.