From 37a39c2962e5aee0323dafed6db2da2f316ca4e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gerg=C5=91=20Magyar?= Date: Sun, 19 Jul 2026 16:36:22 +0100 Subject: [PATCH] fix(ci): unblock the review agent dispatch and publisher lanes (#2567) * fix(ci): unblock the review agent dispatch and publisher lanes The first workflow_dispatch validation run surfaced two defects: - setup-node rejects `cache: false` (the YAML boolean arrives as the string 'false' and v6 fails with "Caching for 'false' is not supported"), killing the analyze job before the isolation preflight. Omitting the input is the supported way to disable caching. - The publisher held only `issues: write`, but GITHUB_TOKEN needs `pull-requests: write` to create issue comments on a pull request, so even the safe-failure comment died with "Resource not accessible by integration". Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Va5uu9Ar3e45QZ5xFsG4AZ * test(ci): align the publisher permission contract with PR commenting The workflow contract test pinned the publisher to pull-requests: read, which is exactly the permission set that made comment publication fail. Encode the corrected scope and assert the publisher still cannot write repository contents. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Va5uu9Ar3e45QZ5xFsG4AZ --------- Co-authored-by: Claude Fable 5 --- .github/workflows/gitnexus-review-agent.yml | 5 ++--- gitnexus/test/unit/review-agent-workflow.test.ts | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/gitnexus-review-agent.yml b/.github/workflows/gitnexus-review-agent.yml index 7102e7e5e5..b2a5c3d0f9 100644 --- a/.github/workflows/gitnexus-review-agent.yml +++ b/.github/workflows/gitnexus-review-agent.yml @@ -232,7 +232,6 @@ jobs: uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '22.16.0' - cache: false - name: Install and preflight Claude subprocess isolation id: isolation @@ -1878,8 +1877,8 @@ jobs: timeout-minutes: 10 permissions: actions: read # Download the immutable review artifact from the analyze job. - pull-requests: read # Reject publication when the PR tuple moved. - issues: write # Upsert the bounded bot review comment. + pull-requests: write # Reject publication when the PR tuple moved; upsert the bounded bot review comment on the PR. + issues: write # Issue-comment scope for non-PR fallbacks. steps: - name: Download review artifact id: download diff --git a/gitnexus/test/unit/review-agent-workflow.test.ts b/gitnexus/test/unit/review-agent-workflow.test.ts index 46f1232795..03ee5bb61b 100644 --- a/gitnexus/test/unit/review-agent-workflow.test.ts +++ b/gitnexus/test/unit/review-agent-workflow.test.ts @@ -1045,7 +1045,8 @@ describe('gitnexus review-agent workflow security contract', () => { expect(analyze).toContain('pull-requests: read'); expect(analyze).not.toContain('issues: write'); expect(publish).toContain('issues: write'); - expect(publish).toContain('pull-requests: read'); + expect(publish).toContain('pull-requests: write'); + expect(publish).not.toContain('contents: write'); expect(publish).not.toContain('actions/checkout@'); expect(publish).not.toContain('ANTHROPIC_API_KEY'); expect(publish).not.toContain('CLAUDE_CODE_OAUTH_TOKEN');