Repository navigation
feat(claude-lanes): pass allowed-bot-sender-ids to the review lanes at ci-workflows v0.40.0 - #773
Conversation
…t ci-workflows v0.40.0
Register pr-review.yml and pr-review-security.yml at the v0.40.0 tag
(a92020292976c2e9b50f7adc922693a45a6c1226), each equal to its v0.39.8
contract plus the new allowed-bot-sender-ids input, and re-pin the four
review caller components (fleet and hosted) to that tag. Each caller passes
${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}, so a commit the automation-lanes
App pushes is reviewed where a repository sets the variable; where it is
unset the value is empty and the reusable still skips every bot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ape (#774) No related issue: repair standards main after ci-workflows#733 ## Summary `check-pr-convention-copies` has been red on main since melodic-software/ci-workflows#733 (merged 2026-10-11 17:13Z) changed the pr-contract composite's `run.sh`, for example run 38159506436. The gate's behavior with the default pattern is unchanged; the drift checker was reading the old source shape. ## Fix #733 changed four things the checker anchored on: | Checker expectation | run.sh after #733 | |---|---| | `match(chunk, /(close\|...)[ \t]*:?[ \t]*([a-z0-9_.-]+\/[a-z0-9_.-]+)?#[0-9]+/)) break` | `match(chunk, closing_regex)) break`, with `closing_regex = "(close\|...)" separator ref` and `ref` from `ENVIRON["ISSUE_REF_PATTERN"]` (default `DEFAULT_ISSUE_REF_PATTERN='([a-z0-9_.-]+/[a-z0-9_.-]+)?#[0-9]+'`) | | `rest ~ /^(refs\|relates[ \t]+to):...#[0-9]+[ \t]*$/)` | `rest ~ non_closing_regex)` with `non_closing_regex = "^(refs\|relates[ \t]+to):[ \t]*" ref "[ \t]*$"` | | `linkage_errors+=('Missing a native closing keyword` | `linkage_errors+=("Missing a ${keyword_kind} closing keyword` | | analyzer runs with no env | analyzer reads `ISSUE_REF_PATTERN`; unset, `ref` became `()` and 347 sample bodies (`xcloses #12`, `Closes #12x`, ...) read as closing | Changes, all in `components/pr-convention-policy/`: - The extractors accept both shapes. Consumers pinned before #733 still run the inline literal, so the pin audit must keep reading it. The new shape is rebuilt from the keyword alternation, the default separator and `DEFAULT_ISSUE_REF_PATTERN`. - The behavioral run passes run.sh's default as `ISSUE_REF_PATTERN`/`DEFAULT_ISSUE_REF_PATTERN`. A run.sh that reads the variable without declaring, falling back to and exporting the default is drift. - New check: action.yml's `issue-ref-pattern` default must equal run.sh's default (or be empty). Any other value flips the analyzer to its custom-pattern separator for every caller that leaves the input unset. - Fixtures: `check-contract-run.sh.txt` is now ci-workflows 8b3cc4bf28. It is verbatim apart from one `spellchecker:ignore-next-line` awk comment, needed because this repository's typos lane flags `ture` in an upstream comment. The previous fixture is kept as `check-contract-run-literal-ref.sh.txt` for the older-pin shape. ## Verification - `npm run test:pr-convention-lockstep`: 90 pass, 0 fail. Before the fix, the new fixture produced 37 failures. - `npm run lint:pr-convention-copies` against live ci-workflows main: `every copy matches policy.json`. - Real drift still fails, with new tests for: a missing or unexported default, a default without the `#N` grammar (both the enforcement-pattern probe and the behavior check catch it), a default separator losing the optional colon (the behavior check catches it), and a mismatched action.yml default. The existing mutation tests still pass against the new fixture. - Biome, typos, gitleaks and editorconfig pre-commit hooks pass. ## Related - melodic-software/ci-workflows#733 (the change being tracked) - #773 (blocked by the red main) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude finished @kyle-sexton's task in 1m 31s —— View job Code review complete
No high-signal correctness or maintainability issues found. Summary of what I checked:
One thing worth flagging, not a defect: the PR body says Verification: I could not execute |
|
Claude finished @kyle-sexton's task in 2m 35s —— View job Security review in progress
|
|
claude-review has reviewed this pull request through 2a3db40; a later push is reviewed from there. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 57b5e61c2c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
claude-security-review has reviewed this pull request through 2a3db40; a later push is reviewed from there. |
… bot skip The review-lane composition convention, the distribution README and the sync-manifest note said both lanes skip every bot. From ci-workflows v0.40.0 a bot whose sender id the caller lists in allowed-bot-sender-ids is reviewed; the synced callers pass AUTOMATION_LANES_APP_SENDER_ID, empty where unset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 1m 7s —— View job Security review complete
Scope: incremental lane, reviewing only what changed since Finding: none. All three hunks are prose-only reconciliation of documentation with the
None of the three hunks touch a workflow No GitHub Actions hardening concerns (no workflow trigger, permission, or pin changed in this slice) and no injection/credential-handling surface in plain prose/comment edits. |
|
Claude finished @kyle-sexton's task in 1m 26s —— View job Incremental code review — 57b5e61...2a3db40
Scope note: per the lane header, only the diff since What changedCommit
FindingsNone. The added text is accurate and internally consistent:
|
No related issue: Phase 17 of the pr-unblock lane plan; ci-workflows v0.40.0
Hold: a human merges this.
Summary
ci-workflows v0.40.0 (
a92020292976c2e9b50f7adc922693a45a6c1226) adds an optionalallowed-bot-sender-idsinput topr-review.ymlandpr-review-security.yml. A bot whose event sender id is listed passes the reusable's bot skip, and only that sender's login reaches the action'sallowed_bots. This registers that input in runner policy and has the four review caller components pass the automation-lanes App's id, so a commit the App pushes to a pull request is reviewed.Fix
components/runner-policy/policy.json:pr-review.ymlandpr-review-security.ymlat the v0.40.0 tag, each equal to its v0.39.8 entry plusallowed-bot-sender-idsinallowedInputs. Only these two reusables are registered at v0.40.0.components/claude-lanes/claude-{review,security-review}.ymlandcomponents/claude-lanes-hosted/claude-{review,security-review}.yml: re-pinned from v0.39.3 to v0.40.0, passingallowed-bot-sender-ids: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}; header comments updated.components/runner-policy/README.md: rollout note for v0.40.0.components/runner-policy/runner-policy.test.mjs:REPINE_LANE_SHA_V0_40_0and a test that each v0.40.0 entry is its v0.39.8 entry plus the input, and that exactly two v0.40.0 keys exist.Upstream diff v0.39.8 to v0.40.0 for both reusables: the new input, the job
if:(bot actor admitted only when the input is non-empty, well-formed, and contains the sender id), andallowed_bots. No secret, workflow or job permission,runs-on, or reached composite action changed. The claude-lanes lockstep declines both oninputs, so the entries are registered by hand. Moving from v0.39.3 also takes the v0.39.8 changes reviewed in #762.Consumers without the variable
The manifest syncs these components to 11 targets. Hosted callers: agent-plugins, ci-runner, claude-code-account-rotation, claude-code-plugins, codex-plugins, cursor-plugins. Fleet callers: claude-code-proxy, dotfiles, github-iac, medley, provisioning. Only
claude-code-pluginssets the repository variableAUTOMATION_LANES_APP_SENDER_ID, and no org-level variable exists (checked withgh api .../actions/variables/AUTOMATION_LANES_APP_SENDER_IDon each). GitHub returns an empty string for an unset configuration variable (contexts reference,vars), and the reusable'sif:requires a non-empty list, so in the other 10 targets the review lanes still skip every bot.Verification
npm run test:runner-policy: 299/299 pass. Withallowed-bot-sender-idsremoved from one v0.40.0 contract, 5 tests fail: the new test and the four target-audit tests for the lane callers.npm run lint:runner-policy: passed.claude-lanes.test.sh(materialize into every target plus actionlint),repin-callers.test.sh,repin-policy-lockstep.test.mjs(23/23), and the pin-comment scan: pass.Related
policy.jsonto the targets.🤖 Generated with Claude Code