dreampiler/kandev
1
0
Fork 0
Code Issues 46 Pull Requests Actions 54 Packages Projects Releases Wiki Activity

feat(workflow): queue workflow messages during active moves (#1036)

Browse Source
This commit is contained in:
José Almeida
2026-05-23 17:19:23 +01:00
committed by GitHub
parent c36c4752f3
commit 122ea73f55
24 changed files with 659 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/claude-code-review.yml
+7 -8
View File
@@ -22,7 +22,7 @@ on:
types: [opened, synchronize, ready_for_review, reopened, labeled]
concurrency:
group: claude-review-${{ github.event.pull_request.number || github.ref }}
group: claude-review-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
@@ -107,8 +107,7 @@ jobs:
claude-review-fork:
# Fork PRs only, via pull_request_target so secrets are available.
# Three approval paths:
# - OWNER/MEMBER/COLLABORATOR author_association (trusted user, all events)
# Two approval paths:
# - CLAUDE_REVIEW_ALLOWLIST repo variable (trusted login list, all events;
# JSON array, e.g. ["alice","bob"], in Settings -> Secrets and variables
# -> Actions -> Variables)
@@ -122,8 +121,7 @@ jobs:
if: >
github.event_name == 'pull_request_target' &&
github.event.pull_request.head.repo.full_name != github.repository &&
(contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association) ||
(github.event.action != 'synchronize' && contains(github.event.pull_request.labels.*.name, 'safe-to-review')) ||
((github.event.action != 'synchronize' && contains(github.event.pull_request.labels.*.name, 'safe-to-review')) ||
(vars.CLAUDE_REVIEW_ALLOWLIST != '' && contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login)))
runs-on: ubuntu-latest
permissions:
@@ -136,11 +134,12 @@ jobs:
uses: actions/checkout@v4
with:
# pull_request_target defaults to the base ref; explicitly check out
# the PR head so the review runs against the contributor's changes.
# the PR head through the base repository's pull ref. Keeping origin
# on the base repository lets claude-code-action fetch
# refs/pull/<number>/head during its own PR setup.
# Safe because the workflow never executes scripts from the PR;
# claude-code-action only reads files and posts comments.
repository: ${{ github.event.pull_request.head.repo.full_name }}
ref: ${{ github.event.pull_request.head.sha }}
ref: refs/pull/${{ github.event.pull_request.number }}/head
fetch-depth: 1
- name: Run Claude Code Review (GITHUB_TOKEN fallback)
.github/workflows/preview-env.yml
+4 -6
View File
@@ -15,7 +15,7 @@ on:
types: [opened, synchronize, reopened, closed, labeled]
concurrency:
group: preview-env-${{ github.event.pull_request.number || github.ref }}
group: preview-env-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
# Don't cancel cleanup on close — let it finish destroying the sprite.
cancel-in-progress: ${{ github.event.action != 'closed' }}
@@ -68,8 +68,7 @@ jobs:
# -----------------------------------------------------------------------
# Deploy / update preview (fork PRs, gated by allowlist)
# Uses pull_request_target so secrets are available.
# Three approval paths:
# - OWNER/MEMBER/COLLABORATOR author_association (trusted user, all events)
# Two approval paths:
# - PREVIEW_ENV_ALLOWLIST repo variable (trusted login list, all events;
# JSON array of logins)
# - `safe-to-test` label (maintainer opt-in, per-commit). Explicitly
@@ -87,8 +86,7 @@ jobs:
github.event.action != 'closed' &&
github.event_name == 'pull_request_target' &&
github.event.pull_request.head.repo.full_name != github.repository &&
(contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association) ||
(github.event.action != 'synchronize' && contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
((github.event.action != 'synchronize' && contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
(vars.PREVIEW_ENV_ALLOWLIST != '' && contains(fromJSON(vars.PREVIEW_ENV_ALLOWLIST), github.event.pull_request.user.login)))
runs-on: ubuntu-latest
permissions:
@@ -100,7 +98,7 @@ jobs:
with:
# pull_request_target checks out base by default; explicitly use PR head.
# Safe: the preview CLI only reads files to build artifacts and posts comments.
# NOTE: The allowlist gate (OWNER/MEMBER/COLLABORATOR, safe-to-test, PREVIEW_ENV_ALLOWLIST)
# NOTE: The allowlist gate (safe-to-test, PREVIEW_ENV_ALLOWLIST)
# authorizes running the fork's cmd/preview code with SPRITES_API_TOKEN and GH_TOKEN.
# The safe-to-test label must be re-applied after each new push (see strip-safe-to-test job).
repository: ${{ github.event.pull_request.head.repo.full_name }}