scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-10-29 06:32:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(ci): unblock the review agent dispatch and publisher lanes (#2567)

Browse source 
* fix(ci): unblock the review agent dispatch and publisher lanes

The first workflow_dispatch validation run surfaced two defects:

- setup-node rejects `cache: false` (the YAML boolean arrives as the
  string 'false' and v6 fails with "Caching for 'false' is not
  supported"), killing the analyze job before the isolation preflight.
  Omitting the input is the supported way to disable caching.
- The publisher held only `issues: write`, but GITHUB_TOKEN needs
  `pull-requests: write` to create issue comments on a pull request,
  so even the safe-failure comment died with "Resource not accessible
  by integration".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Va5uu9Ar3e45QZ5xFsG4AZ

* test(ci): align the publisher permission contract with PR commenting

The workflow contract test pinned the publisher to pull-requests: read,
which is exactly the permission set that made comment publication fail.
Encode the corrected scope and assert the publisher still cannot write
repository contents.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Va5uu9Ar3e45QZ5xFsG4AZ

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Gergő Magyar 2026-07-19 16:36:22 +01:00 • committed by GitHub
parent 9f68e1ad87
commit 37a39c2962
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.github/workflows/gitnexus-review-agent.yml vendored
View file

@ -232,7 +232,6 @@ jobs:
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '22.16.0'
cache: false
- name: Install and preflight Claude subprocess isolation
id: isolation
@ -1878,8 +1877,8 @@ jobs:
timeout-minutes: 10
permissions:
actions: read # Download the immutable review artifact from the analyze job.
pull-requests: read # Reject publication when the PR tuple moved.
issues: write # Upsert the bounded bot review comment.
pull-requests: write # Reject publication when the PR tuple moved; upsert the bounded bot review comment on the PR.
issues: write # Issue-comment scope for non-PR fallbacks.
steps:
- name: Download review artifact
id: download

3
gitnexus/test/unit/review-agent-workflow.test.ts
View file

@ -1045,7 +1045,8 @@ describe('gitnexus review-agent workflow security contract', () => {
expect(analyze).toContain('pull-requests: read');
expect(analyze).not.toContain('issues: write');
expect(publish).toContain('issues: write');
expect(publish).toContain('pull-requests: read');
expect(publish).toContain('pull-requests: write');
expect(publish).not.toContain('contents: write');
expect(publish).not.toContain('actions/checkout@');
expect(publish).not.toContain('ANTHROPIC_API_KEY');
expect(publish).not.toContain('CLAUDE_CODE_OAUTH_TOKEN');