dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

ci: unify trusted contributor PR automation (#2996)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-08-24 19:11:29 +00:00
committed by GitHub
parent c325169d8d
commit 727d59ce71
20 changed files with 863 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/claude-code-review-workflow-contract_test.py
+4 -2
View File
@@ -41,6 +41,7 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
activity_types(workflow, "pull_request_target"),
)
self.assertNotIn(" strip-safe-to-review:", workflow)
self.assertEqual(workflow.count("persist-credentials: false"), 2)
def test_fork_review_uses_only_open_or_safe_to_review_label(self) -> None:
workflow = WORKFLOW.read_text(encoding="utf-8")
@@ -137,7 +138,7 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
"to Claude's allowed_non_write_users input",
)
def test_allowlisted_fork_label_job_adds_both_approval_labels(self) -> None:
def test_allowlisted_fork_label_job_adds_one_approval_label(self) -> None:
workflow = WORKFLOW.read_text(encoding="utf-8")
_, separator, label_job = workflow.partition(" label-allowlisted-fork:")
label_job = label_job.partition("\n claude-review-fork:")[0]
@@ -158,9 +159,10 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
self.assertIn("pull-requests: write", label_job)
self.assertIn("github.rest.issues.addLabels", label_job)
self.assertIn(
"const labels = ['safe-to-review', 'safe-to-test'];",
"const labels = ['safe-to-review'];",
label_job,
)
self.assertNotIn("safe-to-test", label_job)
self.assertNotIn("actions/checkout", label_job)
def test_lint_workflow_runs_preview_contract_test(self) -> None:
.github/scripts/opencode-code-review-workflow-contract_test.py
+1
View File
@@ -35,6 +35,7 @@ class OpenCodeCodeReviewWorkflowContractTest(unittest.TestCase):
workflow = WORKFLOW.read_text(encoding="utf-8")
self.assertNotIn(" strip-safe-to-review:", workflow)
self.assertNotIn("safe-to-test", workflow)
self.assertNotIn("github.rest.issues.removeLabel", workflow)
def test_lint_workflow_runs_opencode_contract_test(self) -> None:
.github/scripts/pr-walkthrough-workflow-contract_test.py
+14 -3
View File
@@ -51,7 +51,7 @@ class PRWalkthroughWorkflowContractTest(unittest.TestCase):
self.assertIn("vars.PR_WALKTHROUGH_ENABLED == 'true'", self.publication)
self.assertNotIn("OPENCODE_REVIEW_ENABLED", self.workflow)
def test_generation_is_limited_to_authorized_same_repository_events(self) -> None:
def test_generation_is_limited_to_authorized_repository_events(self) -> None:
self.assertIn("pull_request_target:", self.workflow)
self.assertIn(
"types: [opened, ready_for_review, reopened, synchronize, labeled]",
@@ -61,13 +61,20 @@ class PRWalkthroughWorkflowContractTest(unittest.TestCase):
"github.event_name == 'pull_request_target'",
"github.event.pull_request.draft == false",
"github.event.pull_request.head.repo.full_name == github.repository",
"github.event.pull_request.head.repo.full_name != github.repository",
"github.event.action == 'opened'",
"github.event.action == 'reopened'",
"github.event.action == 'ready_for_review'",
"github.event.action == 'synchronize'",
"github.event.action == 'labeled' && github.event.label.name == 'generate-pr-walkthrough'",
"github.event.label.name == 'safe-to-review'",
"github.event.action != 'labeled'",
"contains(github.event.pull_request.labels.*.name, 'safe-to-review')",
"vars.CLAUDE_REVIEW_ALLOWLIST != ''",
"contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login)",
):
self.assertIn(condition, self.generation)
self.assertNotIn("safe-to-test", self.generation)
def test_skill_explains_trusted_context_without_provider_names(self) -> None:
self.assertNotIn("Kandev", self.skill)
@@ -94,7 +101,11 @@ class PRWalkthroughWorkflowContractTest(unittest.TestCase):
self.assertIn('test "$(git rev-parse HEAD)" = "$TRUSTED_SHA"', self.generation)
self.assertIn(
'git fetch --no-tags --filter=blob:none '
'--negotiation-tip="$TRUSTED_SHA" origin "$HEAD_SHA"',
'--negotiation-tip="$TRUSTED_SHA" origin "refs/pull/${PR_NUMBER}/head"',
self.generation,
)
self.assertIn(
'PR_NUMBER: ${{ github.event.pull_request.number }}',
self.generation,
)
self.assertNotIn("--depth=1", self.generation)
@@ -109,7 +120,7 @@ class PRWalkthroughWorkflowContractTest(unittest.TestCase):
self.assertNotIn("github.event.pull_request.base.sha", job)
for value in (
'git fetch --no-tags --filter=blob:none --negotiation-tip="$TRUSTED_SHA" origin "$HEAD_SHA"',
'git fetch --no-tags --filter=blob:none --negotiation-tip="$TRUSTED_SHA" origin "refs/pull/${PR_NUMBER}/head"',
'git merge-base "$TRUSTED_SHA" "$HEAD_SHA"',
'git archive "$TRUSTED_SHA" .agents/skills/pr-walkthrough | tar -x',
'--base-sha "$TRUSTED_SHA"',
.github/scripts/preview-env-workflow-contract_test.py
+6 -4
View File
@@ -10,7 +10,7 @@ WORKFLOW = REPO_ROOT / ".github" / "workflows" / "preview-env.yml"
class PreviewEnvironmentWorkflowContractTest(unittest.TestCase):
def test_claude_allowlist_authorizes_fork_preview_deployment(self) -> None:
def test_safe_to_review_and_allowlists_authorize_fork_preview_deployment(self) -> None:
workflow = WORKFLOW.read_text(encoding="utf-8")
_, separator, deploy_job = workflow.partition(" deploy-fork:")
@@ -21,7 +21,7 @@ class PreviewEnvironmentWorkflowContractTest(unittest.TestCase):
deploy_job,
)
self.assertIn(
"contains(github.event.pull_request.labels.*.name, 'safe-to-test')",
"contains(github.event.pull_request.labels.*.name, 'safe-to-review')",
deploy_job,
)
self.assertIn("vars.PREVIEW_ENV_ALLOWLIST != ''", deploy_job)
@@ -30,16 +30,18 @@ class PreviewEnvironmentWorkflowContractTest(unittest.TestCase):
"contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login)",
deploy_job,
)
self.assertEqual(workflow.count("persist-credentials: false"), 3)
def test_safe_to_test_approval_survives_follow_up_pushes(self) -> None:
def test_safe_to_review_approval_survives_follow_up_pushes(self) -> None:
workflow = WORKFLOW.read_text(encoding="utf-8")
_, separator, deploy_job = workflow.partition(" deploy-fork:")
self.assertTrue(separator, "Fork preview deploy job is missing")
self.assertIn(
"((contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||",
"((contains(github.event.pull_request.labels.*.name, 'safe-to-review')) ||",
deploy_job,
)
self.assertNotIn("safe-to-test", deploy_job)
self.assertNotIn(" strip-safe-to-test:", workflow)
self.assertNotIn("github.rest.issues.removeLabel", workflow)