Repository navigation
feat(pr-pipeline): run the security review on pr-review-cli with key-first funding - #9307
Conversation
…first funding The security review lane calls ci-workflows pr-review-cli.yml (v0.63.0), lane security: the reviews role's API key first, its subscription token after a handoff. The check name, marker, notice and record format stay; a newer push waits for a running review instead of cancelling it. The review posts as github-actions[bot] with a claude-lane footer, so address-feedback, the feedback dispatcher and the babysit merge gate accept that author only on comments whose last non-blank line is the footer, and babysit's record pattern accepts account=fallback. One reviews role backs both review lanes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
claude-security-review reviewed Incremental security review of the changes since f282d47 (the changelog fragment, The change tightens the trust boundary. The No manifest files changed in this increment, so no critical-findings: 0 |
|
claude-review reviewed Incremental review of 822de2c, covering the changes since f282d47. I found nothing to flag.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Live proof on head
Held from merge: see the open items in the session report (the key is refused with 401, and the completion notice carries no annotation title). |
…contract (#849) Refs: melodic-software/claude-code-plugins#9307 ## Summary Registers `pr-review-cli.yml@83b739f625b501ad40c65dee7168d836883195e1` (ci-workflows [v0.63.1](https://github.com/melodic-software/ci-workflows/releases/tag/v0.63.1)) so claude-code-plugins#9307 can re-pin its security lane to it. ## Fix v0.63.1 changes only the publish step ([ci-workflows#865](melodic-software/ci-workflows#865): titled completion notice, demoted CRITICAL findings counted). The contract copies the v0.63.0 entry forward verbatim: same routing, inputs and secrets. ## Verification - `node --test runner-policy.test.mjs` in `components/runner-policy`: 337 pass, including the new copy-forward test. ## Related - Same shape as #848 (v0.63.0). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
removed
the
do-not-merge
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
review-venue.sh matched the security lane only by pr-review-security.yml, so after the caller moved to pr-review-cli.yml it read the lane as absent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
Refs: melodic-software/claude-code-account-rotation#259
Summary
Moves the live security review lane onto ci-workflows
pr-review-cli.ymlv0.63.0 (8778094), lanesecurity, funded by thereviewsrole:REVIEWS_CLAUDE_API_KEYfirst,REVIEWS_CLAUDE_CODE_OAUTH_TOKENonly after the key hands off (or when the repository variableREVIEWS_KEY_EXHAUSTEDistrue). No shadow and no parallel copy: the existing workflow path is re-pointed. The code review lane is unchanged and switches in a later PR.Fix
.github/workflows/pr-review-security-hosted.yml: callspr-review-cli.yml@8778094withlane: security,publish: comments, the samemodel-argsandallowed-bot-sender-ids, and the olddocs-only-pathsdefault passed explicitly (the new reusable's default never skips). Job id stayspr-review-security, so the check stayspr-review-security / security-review. Permissions arecontents: readandpull-requests: write(noid-token).cancel-in-progress: false, since a cancelled run reads as red to the guardrails merge guard. The bareCLAUDE_CODE_OAUTH_TOKENis no longer passed.github-actions[bot], each comment ending inclaude-lane: claude-security-review. In the same PR, the readers accept that author only on comments whose last non-blank line is a review lane's footer, and keep acceptingclaude[bot]:address-feedback.mjsthreadAuthors/keepThreads(also used byfeedback-dispatch.mjs): such a comment is the reviewer's, and its review must begithub-actions[bot]'s.babysit_review_evidence.py:_lane_threadand_summary_commentsaccept the footer-gated author; a reviewed-head marker is never re-read as a summary comment;RECORD_REaccepts a trailingaccount=fallback..github/lane-funding.json: the security lane isrun-claude-clireading both reviews secrets;reviewsis keyed; thereviews-securityrole is removed (one role backs both review lanes).docs/conventions/pr-pipeline/README.mdand changelog fragments forpr-pipelineandsource-control.Verification
scripts/check-affected.sh --tests: 13 passed, 1 skipped.callers.test.mjs, check-trusted-trigger, pr-merge, post-merge-demotion-alert): 1123 pass, 0 fail.unittest discover): 2493 tests OK, including new cases for both identities andaccount=fallback.runner-target-contract.REVIEWS_KEY_EXHAUSTED=true, then deleted); run links follow in a comment.Related
pr-review-cli.yml)🤖 Generated with Claude Code