From 72f0ea5b8c2030b967cb0be86c56588f9fb7078e Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 09:38:21 +0000 Subject: [PATCH] ci: [DO NOT MERGE] middle branch to test format-suggest Makes format-suggest testable via a PR. The real workflow uses pull_request_target, which runs the DEFAULT branch's (main) workflow file, so a modified format-suggest cannot be exercised from a PR without touching main. This middle branch switches format-suggest to a `pull_request` trigger (which uses the PR's own workflow file) scoped to PRs whose base is this middle branch. Effect: - The outermost PR (base = this branch) triggers format-suggest -> runs its style + reviewdog logic end-to-end. - This middle PR (base = the feature branch) does NOT match the branches filter, so it triggers no checks. The fork-only `if` gate is dropped so the same-repo test PR runs. DO NOT MERGE. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_018Tw1nB3SzehmtvTjkwmc2v --- .github/workflows/format-suggest.yaml | 30 ++++++++++++--------------- 1 file changed, 13 insertions(+), 17 deletions(-) diff --git a/.github/workflows/format-suggest.yaml b/.github/workflows/format-suggest.yaml index 6db40f1..53bc196 100644 --- a/.github/workflows/format-suggest.yaml +++ b/.github/workflows/format-suggest.yaml @@ -1,20 +1,17 @@ # Workflow derived from https://github.com/posit-dev/setup-air/tree/main/examples on: - # Using `pull_request_target` over `pull_request` for elevated `GITHUB_TOKEN` - # privileges, otherwise we can't set `pull-requests: write` when the pull - # request comes from a fork, which is our main use case (external contributors). - # - # `pull_request_target` runs in the context of the target branch (`main`, usually), - # rather than in the context of the pull request like `pull_request` does. Due - # to this, we must explicitly checkout `ref: ${{ github.event.pull_request.head.sha }}`. - # This is typically frowned upon by GitHub, as it exposes you to potentially running - # untrusted code in a context where you have elevated privileges, but they explicitly - # call out the use case of reformatting and committing back / commenting on the PR - # as a situation that should be safe (because we aren't actually running the untrusted - # code, we are just treating it as passive data). - # https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/ - pull_request_target: + # CI-VERIFY / DRY-RUN ONLY -- DO NOT MERGE. The real workflow uses + # `pull_request_target` (elevated token for fork PRs). But pull_request_target + # runs the workflow file from the repo's DEFAULT branch (main), so a modified + # format-suggest cannot be tested via a PR without touching main. To exercise + # the style + reviewdog logic end-to-end, this middle branch switches the + # trigger to `pull_request` (which uses the PR's own workflow file) and scopes + # it to PRs whose base is this middle branch -- i.e. only the outermost test PR + # triggers it, so this middle PR itself runs no checks. + pull_request: + branches: + - claude/ubuntu-26-arm64-gha-ezzy7y-fmt-base name: format-suggest.yaml @@ -22,9 +19,8 @@ jobs: format-suggest: name: format-suggest runs-on: ubuntu-26.04 - # Only run this job if changes come from a fork. - # We commit changes directly on the main repository. - if: github.event.pull_request.head.repo.full_name != github.repository + # DRY-RUN: fork-only gate removed so this runs for the same-repo test PR. + # (The trigger's branches filter already scopes this to the outermost PR.) permissions: # Required to push suggestion comments to the PR