Repository navigation
ci(gate): adopt the unified risk gate and sync the label rule - #35
Conversation
Pigbibi
added
the
owner-approved
|
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 08ef34010e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Replace risk-gate.yml with the consolidated version from 12345HotlineBots: Dependabot exemptions require the authenticated account, deleting any run/uses step line is high risk, and base drift is checked through git ancestry. Sync the AGENTS.md label rule: owner-approved means the owner confirmed the change, agent-approved means an agent cleared it, and when both are present owner-approved wins.
08ef340 to
9668ce5
Compare
Pigbibi
changed the title
Every non-prose workflow edit now needs a clearing label; a multiline run rewrite and an added `if: false` no longer pass as ordinary. Dependabot exemptions require every commit to be authored by the bot, committed by web-flow and signed, and a repin must keep the same action. A periodic sweep covers merges made with GITHUB_TOKEN and dispatches to the default branch.
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
The approver login is read from the RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job names, workflows moved out of the directory and runtime config files are now protected. Dependabot exemptions require every commit to be authored by the bot, committed by web-flow and signed, and a repin must keep the same action and be listed in the base-branch policy action_files. A periodic sweep covers merges made with GITHUB_TOKEN and dispatches to the default branch.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e5d3828dc2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The approver login is read from the RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job names, any workflow rename, runtime config files and the dependency policy script are now protected. Dependabot exemptions require every commit to be authored by the bot, committed by web-flow and signed, and a repin must keep the same action and be listed in the base-branch policy action_files. An open PR sharing the same head fails closed. A periodic sweep covers merges made with GITHUB_TOKEN and dispatches to the default branch.
The approver login is read from the RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job names, any workflow rename, runtime config files and the dependency policy script are now protected. Dependabot exemptions require every commit to be authored by the bot, committed by web-flow and signed, and a repin must keep the same action and be listed in the base-branch policy action_files. An open PR sharing the same head fails closed. A periodic sweep covers merges made with GITHUB_TOKEN and dispatches to the default branch.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dc4b51345
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
No workflow line is inert: outside a verified Dependabot same-action repin,
every edit needs a clearing label, and a `#` line in a run block is shell text
whose `${{ }}` expands before Bash sees it. The approver login is read from the
RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job
names, any workflow rename, runtime config files and the dependency policy
script are protected, and a shared head fails closed. A periodic sweep covers
merges made with GITHUB_TOKEN.
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
No workflow line is inert: outside a verified Dependabot same-action repin,
every edit needs a clearing label, and a `#` line in a run block is shell text
whose `${{ }}` expands before Bash sees it. The approver login is read from the
RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job
names, any workflow rename, runtime config files and the dependency policy
script are protected, and a shared head fails closed with the leftover error
refreshed when the head changes or the duplicate closes. A periodic sweep
covers merges made with GITHUB_TOKEN.
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
No workflow line is inert: outside a verified Dependabot same-action repin,
every edit needs a clearing label, and a `#` line in a run block is shell text
whose `${{ }}` expands before Bash sees it. The approver login is read from the
RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job
names, any workflow rename, runtime config files and the dependency policy
script are protected, and a shared head fails closed with the leftover error
refreshed when the head changes or the duplicate closes. A periodic sweep
covers merges made with GITHUB_TOKEN.
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
No workflow line is inert: outside a verified Dependabot same-action repin,
every edit needs a clearing label, and a `#` line in a run block is shell text
whose `${{ }}` expands before Bash sees it. The approver login is read from the
RISK_GATE_OWNER repository variable; an unset variable accepts no label. Job
names, any workflow rename, runtime config files and the dependency policy
script are protected, and a shared head fails closed with the leftover error
refreshed when the head changes or the duplicate closes. A periodic sweep
covers merges made with GITHUB_TOKEN.
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
AI assistance
Produced by an AI coding agent. The owner gave one-time authorization to use
owner-approvedon this batch of governance PRs; an agent applied that label, so it does not mean the owner reviewed this change line by line.What changed
.github/workflows/risk-gate.ymlwith the consolidated version fromPigbibi/12345HotlineBotsmain (8c0c703): Dependabot exemptions require the authenticated account, deleting anyrun/usesstep line is high risk, and base drift is checked through git ancestry.AGENTS.md:owner-approvedmeans the owner confirmed the change,agent-approvedmeans an agent cleared it, agents must not add the former, andowner-approvedwins when both are present.The previous gate accepted only
owner-approvedand treated every workflow change as high risk; read-only, credential-free workflow logic now keeps ordinary classification.Validation
Pigbibi/12345HotlineBotsmain.node --check.