Bobby NoelteandClaude Opus 5.5
14e439c265
GitHub blocks pull_request_target by default in public repositories from December 2, 2026. The ai-self-review workflow now runs on pull_request. It still checks out and runs the check script of the base branch and no other code of the pull request. The workflow file itself now comes from the pull request, so a pull request that changes it can weaken its own check. .github/CODEOWNERS therefore makes a maintainer the code owner of the workflows, CODEOWNERS and the check script; this is enforced once the branch protection of main requires a review from code owners. Additional changes - Record the switch in ADR 0002, which supersedes the pull_request_target consequence of ADR 0001. - Skip the comment step for pull requests from forks, whose token is read-only, and point their error message to the job summary only. - Describe the trigger, code owners and fork limits in docs/develop/ai.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assisted-by: Claude Code (claude-opus-5-5)
2.2 KiB
CI enforces a self-declared, SHA-bound self-review for agent-assisted pull requests
Pull requests that a coding agent wrote or co-wrote must carry a ## Self-review section in the
pull request body that names the full head commit SHA it reviewed. CI does not verify the review
itself: the project has no AI in CI, and a signing key in the sandbox would be reachable by a misled
agent. Instead CI detects agent assistance (an Assisted-by: or Anthropic Co-Authored-By: commit
trailer, an Assisted-by: line or a known agent footer in the pull request body, or the
"AI-assisted" box in the pull request template). It fails only when the declaration or its
Reviewed: SHA is missing or malformed, or names a SHA other than the current head; everything
else (an unticked box next to a trailer or marker, malformed optional lines) is only noted. Like a
DCO sign-off, this makes forgetting impossible and a false claim deliberate; the author review and
the maintainers' review remain the actual controls.
Considered Options
- AI review in CI: rejected, the project runs no AI in CI.
- Signed review attestation from the sandbox: rejected, the agent can reach the key and sign anything.
- Honour system (template checkbox only): rejected, a declaration that is not bound to a commit silently covers code pushed after the review.
Consequences
- Every push to an agent-assisted pull request needs a fresh self-review before the push and an updated pull request body right after it; rebases and squashes before merge do too.
- Open findings do not fail the check, so agents have no incentive to hide them.
- The check only blocks merging once maintainers make it a required status check.
- The workflow runs on
pull_request_targetwith the base branch's script and never runs pull request code, so a pull request cannot weaken its own check; changes to the check take effect only after they are merged. Superseded by 0002. - The workflow needs
pull-requests: writeto comment how to fix a failing check. That is safe only as long as it runs no pull request code. Superseded by 0002.