Mirrors/EOS
1
0
Fork 0
mirror of https://github.com/Akkudoktor-EOS/EOS.git synced 2026-11-13 09:13:30 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

ci: run the AI self-review check on pull_request

Browse Source 
GitHub blocks pull_request_target by default in public repositories from
December 2, 2026. The ai-self-review workflow now runs on pull_request.
It still checks out and runs the check script of the base branch and no
other code of the pull request. The workflow file itself now comes from
the pull request, so a pull request that changes it can weaken its own
check. .github/CODEOWNERS therefore makes a maintainer the code owner of
the workflows, CODEOWNERS and the check script; this is enforced once the
branch protection of main requires a review from code owners.

Additional changes
- Record the switch in ADR 0002, which supersedes the pull_request_target
  consequence of ADR 0001.
- Skip the comment step for pull requests from forks, whose token is
  read-only, and point their error message to the job summary only.
- Describe the trigger, code owners and fork limits in docs/develop/ai.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: Claude Code (claude-opus-5-5)
This commit is contained in:
Bobby Noelte
2026-11-12 22:00:42 +01:00
co-authored by Claude Opus 5.5
parent eb4b34f194
commit 14e439c265
5 changed files with 72 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/0001-self-declared-sha-bound-review-gate.md
+3 -2
View File
@@ -27,6 +27,7 @@ the maintainers' review remain the actual controls.
- The check only blocks merging once maintainers make it a required status check.
- The workflow runs on `pull_request_target` with the base branch's script and never runs pull
request code, so a pull request cannot weaken its own check; changes to the check take effect
only after they are merged.
only after they are merged. Superseded by [0002](0002-self-review-check-on-pull-request.md).
- The workflow needs `pull-requests: write` to comment how to fix a failing check. That is safe
only as long as it runs no pull request code.
only as long as it runs no pull request code. Superseded by
[0002](0002-self-review-check-on-pull-request.md).