Repository navigation
ci: start the fixer agent from PR mentions - #2430
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d080c97fa0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| start-session: | ||
| if: >- | ||
| github.event.issue.pull_request && | ||
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) && |
There was a problem hiding this comment.
If an organization member or invited collaborator has only read/triage access to this repository, this condition still lets them launch the fixer with the repository-write credential and consume the Anthropic budget. GitHub's author_association definitions describe organization membership or collaboration, not repository write permission, so this does not enforce the stated maintainer-only boundary. Check the comment author's current repository permission and require write, maintain, or admin access before creating the session.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in ae54dfb: the step now reads the author's current repository role (collaborators/{login}/permission → role_name) and ignores the mention unless it is admin, maintain, or write. The author_association filter stays as a cheap prefilter.
d080c97 to
2c3f185
Compare
A maintainer comment containing @celox-agent on a pull request that targets develop starts a Claude Managed Agents session for that PR only. The workflow reacts with eyes, creates the session through the Anthropic API, and replies with the session ID and Console link, or with the HTTP status and error message on failure. The job authenticates to Anthropic through Workload Identity Federation with the GitHub Actions OIDC token, so no Anthropic API key is stored. The federation rule accepts only this workflow file on master, run by issue_comment. The AGENT_GITHUB_TOKEN secret holds the PAT mounted as the session's repository credential. Change-Id: I9e01e16c8f0e947da0687fca6b56b63ccbd8bd4a
2c3f185 to
ae54dfb
Compare
|
Queued — the merge queue status continues in this comment ↓. |
tignear
added
the
merge-ready
✅ Merged into
|
| Condition | Required by | |
|---|---|---|
| ✅ | check-success = Conventional Commit title |
— |
| ✅ | check-success = Queue validation |
— |
| ✅ | any of: check-success = @github-actions/Lint & Format, check-neutral = @github-actions/Lint & Format, check-skipped = @github-actions/Lint & Format |
GitHub repository ruleset rule master |
| ✅ | any of: check-success = @github-actions/Rust Test & NAPI Build, check-neutral = @github-actions/Rust Test & NAPI Build, check-skipped = @github-actions/Rust Test & NAPI Build |
GitHub repository ruleset rule master |
| ✅ | any of: check-success = @github-actions/JS Test (Ubuntu), check-neutral = @github-actions/JS Test (Ubuntu), check-skipped = @github-actions/JS Test (Ubuntu) |
GitHub repository ruleset rule master |
| ✅ | any of: check-success = @github-actions/Conventional Commit title, check-neutral = @github-actions/Conventional Commit title, check-skipped = @github-actions/Conventional Commit title |
GitHub repository ruleset rule master |
| ✅ | any of: check-success = @github-actions/Queue validation, check-neutral = @github-actions/Queue validation, check-skipped = @github-actions/Queue validation |
GitHub repository ruleset rule master |
Times in UTC · dashboard · how the merge queue works
A maintainer comment containing @celox-agent on a pull request that targets
develop starts a Claude Managed Agents session for that PR only. The workflow
reacts with eyes, creates the session through the Anthropic API, and replies
with the session ID and Console link, or with the HTTP status and error message
on failure.
The job authenticates to Anthropic through Workload Identity Federation with
the GitHub Actions OIDC token, so no Anthropic API key is stored. The
federation rule accepts only this workflow file on master, run by
issue_comment. The AGENT_GITHUB_TOKEN secret holds the PAT mounted as the
session's repository credential.
Change-Id: I9e01e16c8f0e947da0687fca6b56b63ccbd8bd4a