Repository navigation
ci: Add exact-head acceptance publisher - #2
Conversation
Publish an independently reviewed PR head through a trusted manual dispatch. Keep ruleset activation separate until the publisher is merged and proven. Co-Authored-By: Codex <noreply@openai.com>
|
@codex review Ready for Cowork independent review at |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The security-sensitive merge-gate workflow warrants independent human review and the documented live validation before repository enforcement.
Review effort: Balanced
Findings: None
What changed in this PR
Adds a trusted manual workflow that publishes an acceptance check for a validated PR head.
Changes:
- Validates PR state, target, provenance, SHA, and trusted actors.
- Publishes and verifies an exact-SHA check run.
- Documents dispatch and activation safeguards.
| File | Description |
|---|---|
.github/workflows/exact-head-acceptance.yml |
Implements the acceptance publisher. |
docs/exact-head-acceptance.md |
Documents secure operation and rollout. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Cowork acceptance at exact head |
Add a manually dispatched publisher for the
Exact-head acceptancecheck, bound to the live PR head. This ports the trusted publisher from justin-bin main ata11fb9c7e98be788d152567b70815b6c4cc3f2cewithout changing its behavior, and documents independent review before dispatch.The workflow rejects stale heads, draft/closed/fork PRs, non-main dispatches and untrusted dispatch/rerun actors. It does not execute PR code. Repository rules must only require this check after this PR is merged and live negative/positive/new-head proof succeeds. A GitHub Actions app binding does not alone distinguish this workflow from other workflows that can write checks.
Validation: YAML parsed; extracted Bash passed
bash -n; 12 cases executed against the actual Bash with only GitHub transport mocked, covering success, invalid input/state/identity and malformed API response. Runtime publication and repository enforcement are not claimed by this PR.