@@ -32,7 +32,7 @@ function parsePositiveInt(value) {
  * @returns {Set<number>}
  */
 function parseAllowedPullRequests(value) {
-  const parsed = (Array.isArray(value) ? value : [value]).map(parsePositiveInt).filter(value => value !== undefined);
+  const parsed = (Array.isArray(value) ? value : [value]).map(parsePositiveInt).filter(candidate => candidate !== undefined);
   return new Set(parsed);
 }
 
@@ -73,6 +73,9 @@ async function isForkPullRequest(githubClient, pullRequestNumber) {
     repo: context.repo.repo,
     pull_number: pullRequestNumber,
   });
+  if (pullRequest?.head?.repo === null) {
+    throw new Error(`Cannot approve pull request #${pullRequestNumber}: its fork repository is unavailable`);
+  }
   if (typeof pullRequest?.head?.repo?.fork !== "boolean") {
     throw new Error(`Unable to verify fork status for pull request #${pullRequestNumber}`);
   }
@@ -179,12 +182,16 @@ async function main(config = {}) {
       }
 
       processedCount++;
-
-      await githubClient.rest.actions.approveWorkflowRun({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        run_id: runId,
-      });
+      try {
+        await githubClient.rest.actions.approveWorkflowRun({
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          run_id: runId,
+        });
+      } catch (error) {
+        processedCount--;
+        throw error;
+      }
 
       core.info(`Approved workflow run ${runId}: ${run.html_url}`);
       return { success: true, run_id: runId, url: run.html_url };
 
@@ -144,6 +144,35 @@ describe("approve_workflow_run", () => {
     expect(mockApproveWorkflowRun).toHaveBeenCalledTimes(1);
   });
 
+  it("rejects a run when any associated pull request is from a fork by default", async () => {
+    mockGetWorkflowRun.mockResolvedValue({
+      data: { ...pendingPullRequestRun, pull_requests: [{ number: 42 }, { number: 43 }] },
+    });
+    mockGetPullRequest.mockImplementation(async ({ pull_number: pullRequestNumber }) => ({
+      data: { head: { repo: { fork: pullRequestNumber === 43 } } },
+    }));
+    const { main } = require("./approve_workflow_run.cjs");
+    const handler = await main(externalTokenConfig);
+
+    const result = await handler({ run_id: 123 }, {});
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("set fork: true");
+    expect(mockApproveWorkflowRun).not.toHaveBeenCalled();
+  });
+
+  it("rejects pull requests with an unavailable fork repository", async () => {
+    mockGetPullRequest.mockResolvedValue({ data: { head: { repo: null } } });
+    const { main } = require("./approve_workflow_run.cjs");
+    const handler = await main(externalTokenConfig);
+
+    const result = await handler({ run_id: 123 }, {});
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("fork repository is unavailable");
+    expect(mockApproveWorkflowRun).not.toHaveBeenCalled();
+  });
+
   it("rejects pull_request_target events before accessing GitHub", async () => {
     global.context.eventName = "pull_request_target";
     const { main } = require("./approve_workflow_run.cjs");
@@ -279,4 +308,14 @@ describe("approve_workflow_run", () => {
     expect((await handler({ run_id: 123 }, {})).success).toBe(true);
     expect(mockApproveWorkflowRun).toHaveBeenCalledTimes(1);
   });
+
+  it("does not consume the maximum when approval fails", async () => {
+    mockApproveWorkflowRun.mockRejectedValueOnce(new Error("temporary API failure")).mockResolvedValueOnce({ status: 201 });
+    const { main } = require("./approve_workflow_run.cjs");
+    const handler = await main({ ...externalTokenConfig, max: 1 });
+
+    expect((await handler({ run_id: 122 }, {})).success).toBe(false);
+    expect((await handler({ run_id: 123 }, {})).success).toBe(true);
+    expect(mockApproveWorkflowRun).toHaveBeenCalledTimes(2);
+  });
 });