* ci: strip safe-to-review label on new fork pushes
Mirrors the strip-safe-to-test job in preview-env.yml so a once-approved
fork PR cannot run the Claude review against new (potentially malicious)
code on subsequent pushes without fresh maintainer re-approval. Closes a
gap between the two pull_request_target workflows flagged by an external
scanner.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* ci: close strip-label race on fork PRs
Three reviewers (CodeRabbit, cubic, Greptile) flagged that strip-safe-to-review
ran in parallel with claude-review-fork on the same synchronize event, so the
label was still present in the webhook snapshot when the review job's if was
evaluated — the strip only blocked the next push, not the current one. Same
flaw existed for preview-env.yml's deploy-fork (worse there, since it runs
the fork's cmd/preview code with SPRITES_API_TOKEN).
Fix:
- Add `labeled` to pull_request_target types so a maintainer applying the
opt-in label triggers a review/deploy against the current head SHA.
- Guard the label clause in claude-review-fork / deploy-fork with
`github.event.action != 'synchronize'`. Trusted-author paths (OWNER /
MEMBER / COLLABORATOR and the *_ALLOWLIST repo variable) still authorize
on every event; only the label path is per-commit.
- Wrap removeLabel calls in try/catch that swallows 404 on races.
- Add workflow-level concurrency to dedupe rapid pushes (cancel-in-progress
is false on `closed` for preview-env so cleanup can finish).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* ci: reorder fork PR if-gate branches to be fromJSON-safe
cubic flagged that the previous reorder put the `fromJSON(vars.*_ALLOWLIST)`
branch before the label clause. A non-empty but malformed allowlist value
would throw and skip the whole job, masking a legitimate maintainer label
approval. Reorder to: author_association -> label (with synchronize guard)
-> allowlist, so the cheap/safe branches short-circuit before any
potentially throwing fromJSON call. Applied to both fork workflows.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
João Salavisa
9d2e572ffd