Skip to content

ci(v1.x): sync the #91 cancellation migration #220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
heskew wants to merge 3 commits into
base: v1.x
Choose a base branch
from
Open

ci(v1.x): sync the #91 cancellation migration #220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4bb05c2
ci(v1.x): sync the #91 cancellation migration from main
heskew Aug 28, 2026
99065cb
ci: explicit contents:read ceiling on the validate caller
heskew Aug 28, 2026
0ee17e5
ci: comment hygiene from the pre-push lane
heskew Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions .github/workflows/claude-issue-to-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,21 @@ concurrency:

jobs:
work:
uses: HarperFast/ai-review-prompts/.github/workflows/_claude-issue-to-pr.yml@be549ad08aa6d34b909ea8b542a7ffebdaae1e81 # main 2026-08-25 (#90 cost gates: draft skip, mechanical-diff skip, effort-by-size, debounce; #89 defaults; #88 lenses)
# Calling-job permissions ceiling — union of the reusable's
# authorize (contents: read) and work (contents/pull-requests/
# issues/id-token: write) jobs, so grants don't depend on the
# repo's default-workflow-permissions setting (same rationale as
# the review callers' blocks).
permissions:
contents: write
pull-requests: write
issues: write
id-token: write
uses: HarperFast/ai-review-prompts/.github/workflows/_claude-issue-to-pr.yml@765a51b545f1b2b6c1ffe3b3731baa1512e44dac # main 2026-08-28 (#91 job-level post-authorization cancellation; #90 cost gates; #89 defaults; #88 lenses)
with:
# Same SHA as the `uses:` ref above. See the comment in
# claude-mention.yml for why the duplication is unavoidable.
ai-review-prompts-ref: be549ad08aa6d34b909ea8b542a7ffebdaae1e81
ai-review-prompts-ref: 765a51b545f1b2b6c1ffe3b3731baa1512e44dac
# Plugin repo — bun is part of the test path.
setup-bun: true
repo-specific-conventions: |
Expand Down
14 changes: 12 additions & 2 deletions .github/workflows/claude-mention.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,17 @@ concurrency:

jobs:
mention:
uses: HarperFast/ai-review-prompts/.github/workflows/_claude-mention.yml@be549ad08aa6d34b909ea8b542a7ffebdaae1e81 # main 2026-08-25 (#90 cost gates: draft skip, mechanical-diff skip, effort-by-size, debounce; #89 defaults; #88 lenses)
# Calling-job permissions ceiling — union of the reusable's
# authorize (contents: read) and work (contents/pull-requests/
# issues/id-token: write) jobs, so grants don't depend on the
# repo's default-workflow-permissions setting (same rationale as
# the review callers' blocks).
permissions:
contents: write
pull-requests: write
issues: write
id-token: write
uses: HarperFast/ai-review-prompts/.github/workflows/_claude-mention.yml@765a51b545f1b2b6c1ffe3b3731baa1512e44dac # main 2026-08-28 (#91 job-level post-authorization cancellation; #90 cost gates; #89 defaults; #88 lenses)
with:
# Same SHA as the `uses:` ref above. The reusable uses this to
# check out HarperFast/ai-review-prompts (parse + auth scripts)
Expand All @@ -34,7 +44,7 @@ jobs:
# introspect their own ref (`github.workflow_ref` resolves to
# the CALLER's ref in `workflow_call` context), and `uses: …@<ref>`
# is parsed literally so we can't interpolate a variable.
ai-review-prompts-ref: be549ad08aa6d34b909ea8b542a7ffebdaae1e81
ai-review-prompts-ref: 765a51b545f1b2b6c1ffe3b3731baa1512e44dac
# Plugin repo — opt into bun setup so the agent can run
# `bun test` and `bun run …` for repo-specific scripts.
setup-bun: true
Expand Down
17 changes: 9 additions & 8 deletions .github/workflows/claude-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,20 +20,21 @@ on:
# bot-authored PRs (renovate, dependabot). See ai-review-prompts#38.
types: [opened, synchronize, reopened, ready_for_review, labeled]

concurrency:
group: claude-review-${{ github.event.pull_request.number }}
cancel-in-progress: true
# No concurrency block: cancellation is owned by the reusable's review
# job (job-level group, engaged only after authorization), so an
# unauthorized or skipped event can never cancel a legitimate review.

jobs:
review:
# Always-on toggle — see ai-review-prompts USAGE.md "Reviewers & the
# always-on toggle". CLAUDE_ALWAYS_ON=true (repo/org variable) → auto-
# review trusted-author PRs; unset → opt-in via the claude-review
# label. The reusable's authorize job still owns WHO is admitted.
# Note: the `claude-review` label name is matched there too —
# `_claude-review.yml`'s authorize `if:`, not in this caller.
if: ${{ vars.CLAUDE_ALWAYS_ON == 'true' || github.event.action == 'labeled' }}
uses: HarperFast/ai-review-prompts/.github/workflows/_claude-review.yml@be549ad08aa6d34b909ea8b542a7ffebdaae1e81 # main 2026-08-25 (#90 cost gates: draft skip, mechanical-diff skip, effort-by-size, debounce; #89 defaults; #88 lenses)
# Note: the `claude-review` label name is deliberately duplicated —
# the caller gate names it (below) AND the reusable's authorize
# matches it; renaming the label means changing both.
if: ${{ (github.event.action == 'labeled' && github.event.label.name == 'claude-review') || (github.event.action != 'labeled' && vars.CLAUDE_ALWAYS_ON == 'true') || (github.event.action == 'ready_for_review' && contains(github.event.pull_request.labels.*.name, 'claude-review')) }}

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Blocker — Missing events in opt-in gate (Claude)

The if-gate still misses synchronize, opened, and reopened for labeled PRs when ALWAYS_ON is false. Use (github.event.action != 'labeled' && (vars.CLAUDE_ALWAYS_ON == 'true' || contains(github.event.pull_request.labels.*.name, 'claude-review'))) to cover all actions.

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Suggestion (non-blocking) — Simplify if-gate logic

Use the proposed simplified logic to improve readability and ensure all relevant PR events are covered for both always-on and opt-in modes.

uses: HarperFast/ai-review-prompts/.github/workflows/_claude-review.yml@765a51b545f1b2b6c1ffe3b3731baa1512e44dac # main 2026-08-28 (#91 job-level post-authorization cancellation; #90 cost gates; #89 defaults; #88 lenses)
# Caller-side permissions, scoped at the calling-job level (NOT
# workflow-level — that placement caps the reusable's per-job
# grants below what they need and breaks the workflow at startup;
Expand All @@ -58,7 +59,7 @@ jobs:
# introspect their own ref (`github.workflow_ref` resolves to the
# CALLER's ref in `workflow_call` context), and `uses: …@<ref>`
# is parsed literally so we can't interpolate a variable.
ai-review-prompts-ref: be549ad08aa6d34b909ea8b542a7ffebdaae1e81
ai-review-prompts-ref: 765a51b545f1b2b6c1ffe3b3731baa1512e44dac
review-layers: |
universal
harper/common
Expand Down
21 changes: 9 additions & 12 deletions .github/workflows/gemini-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,13 +27,9 @@ on:
# lists the union and the `review` job gates on GEMINI_ALWAYS_ON.
types: [opened, synchronize, reopened, ready_for_review, labeled]

concurrency:
# Different group key from claude-review so the two providers can
# run in parallel on the same PR. cancel-in-progress is per-group,
# so a synchronize push cancels the in-flight Gemini run without
# touching the Claude run (and vice versa).
group: gemini-review-${{ github.event.pull_request.number }}
cancel-in-progress: true
# No concurrency block: cancellation is owned by the reusable's review
# job (job-level group, engaged only after authorization), so an
# unauthorized or skipped event can never cancel a legitimate review.

jobs:
review:
Expand All @@ -42,10 +38,11 @@ jobs:
# Gemini calibration baseline running on every PR; unset → opt-in via
# the gemini-review label. The reusable's authorize job still owns
# WHO is admitted (CODEOWNERS trust set; the labeler on `labeled`).
# Note: the `gemini-review` label name is matched there too —
# `_gemini-review.yml`'s authorize `if:`, not in this caller.
if: ${{ vars.GEMINI_ALWAYS_ON == 'true' || github.event.action == 'labeled' }}
uses: HarperFast/ai-review-prompts/.github/workflows/_gemini-review.yml@be549ad08aa6d34b909ea8b542a7ffebdaae1e81 # main 2026-08-25 (#90 cost gates: draft skip, mechanical-diff skip, effort-by-size, debounce; #89 defaults; #88 lenses)
# Note: the `gemini-review` label name is deliberately duplicated —
# the caller gate names it (below) AND the reusable's authorize
# matches it; renaming the label means changing both.
if: ${{ (github.event.action == 'labeled' && github.event.label.name == 'gemini-review') || (github.event.action != 'labeled' && vars.GEMINI_ALWAYS_ON == 'true') || (github.event.action == 'ready_for_review' && contains(github.event.pull_request.labels.*.name, 'gemini-review')) }}

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Blocker — Missing events in opt-in gate (Gemini)

The if-gate still misses synchronize, opened, and reopened for labeled PRs when ALWAYS_ON is false. Use (github.event.action != 'labeled' && (vars.GEMINI_ALWAYS_ON == 'true' || contains(github.event.pull_request.labels.*.name, 'gemini-review'))) to cover all actions.

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Suggestion (non-blocking) — Simplify if-gate logic

Use the proposed simplified logic to improve readability and ensure all relevant PR events are covered for both always-on and opt-in modes.

uses: HarperFast/ai-review-prompts/.github/workflows/_gemini-review.yml@765a51b545f1b2b6c1ffe3b3731baa1512e44dac # main 2026-08-28 (#91 job-level post-authorization cancellation; #90 cost gates; #89 defaults; #88 lenses)
# Caller-side permissions, scoped at the calling-job level (NOT
# workflow-level — that placement caps the reusable's per-job
# grants below what they need and breaks the workflow at startup;
Expand All @@ -67,7 +64,7 @@ jobs:
# in this repo for why the duplication is unavoidable
# (reusable workflows can't introspect their own ref in
# workflow_call context).
ai-review-prompts-ref: be549ad08aa6d34b909ea8b542a7ffebdaae1e81
ai-review-prompts-ref: 765a51b545f1b2b6c1ffe3b3731baa1512e44dac
review-layers: |
universal
harper/common
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/validate-caller-workflows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,11 @@ on:

jobs:
validate:
uses: HarperFast/ai-review-prompts/.github/workflows/_validate-caller-workflows.yml@be549ad08aa6d34b909ea8b542a7ffebdaae1e81 # main 2026-08-25 (#90 cost gates: draft skip, mechanical-diff skip, effort-by-size, debounce; #89 defaults; #88 lenses)
permissions:
contents: read
uses: HarperFast/ai-review-prompts/.github/workflows/_validate-caller-workflows.yml@765a51b545f1b2b6c1ffe3b3731baa1512e44dac # main 2026-08-28 (#91 job-level post-authorization cancellation; #90 cost gates; #89 defaults; #88 lenses)
with:
# Same SHA as the `uses:` ref above — the reusable uses this to
# check out the validator script at the matching version. Same
# SHA-twice pattern as the other caller workflows in this repo.
ai-review-prompts-ref: be549ad08aa6d34b909ea8b542a7ffebdaae1e81
ai-review-prompts-ref: 765a51b545f1b2b6c1ffe3b3731baa1512e44dac
Loading