fix(security): scope cross-org PAT git credential in tests-runner + coverage-floor #154
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Review | |
| on: | |
| pull_request: | |
| # `ready_for_review` is load-bearing: the reusable | |
| # (ci-workflows/claude-review.yml) gates its job on `draft == false`, so a | |
| # PR opened as a draft skips the review at `opened`. Without this trigger, | |
| # `gh pr ready` fires nothing this workflow listens for and the review NEVER | |
| # runs — `review / Claude Review` sits at `skipped`, which GitHub counts as | |
| # SATISFIED, so the PR merges green and unreviewed. An explicit `types:` list | |
| # is a denylist by omission. Fleet audit 2026-07-15; template root cause | |
| # fixed in dotclaude#156. See wxa-jake-ai#879, wxa_vpn#983. | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| # No paths-ignore by default. Claude self-skips docs/config-only diffs | |
| # via the reusable workflow's prompt and posts a "Skipped: ..." summary, | |
| # which keeps the review/Claude Review check green. Adding paths-ignore | |
| # here would prevent the workflow from running at all on docs-only PRs, | |
| # leaving any required-check ruleset deadlocked. Add per-project ignores | |
| # only when you know the ruleset doesn't require this check. | |
| # Reusable workflow's job-level permissions are CAPPED by the caller's | |
| # workflow-level permissions. These must match (or exceed) what the | |
| # reusable's claude-code-action step needs. | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| id-token: write | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number }}-${{ github.event.pull_request.draft && 'draft' || 'live' }} | |
| cancel-in-progress: true | |
| jobs: | |
| review: | |
| uses: topcoder1/ci-workflows/.github/workflows/claude-review.yml@main | |
| secrets: | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| with: | |
| # Optional: project-specific focus appended to the base prompt. | |
| review_focus: '' |