From be43bcd7702e7bbc8be00c7739808c87a243ad80 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 6 Oct 2026 03:22:43 +0000 Subject: [PATCH] ci: grant fallback reviewer checks/statuses read on GITHUB_TOKEN Unlisted workflow scopes are none, so loadPrEvidence could not see CodeRabbit check-runs or commit statuses. Keep GITHUB_TOKEN read-only and omit CODEX_GITHUB_TOKEN from pull_request runs. Co-authored-by: Jonathan Borgwing --- .github/workflows/coderabbit-fallback-review.yml | 13 ++++++++++--- docs/ops/pr-review-policy.md | 2 +- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/coderabbit-fallback-review.yml b/.github/workflows/coderabbit-fallback-review.yml index 0b979f0..5e4b199 100644 --- a/.github/workflows/coderabbit-fallback-review.yml +++ b/.github/workflows/coderabbit-fallback-review.yml @@ -35,8 +35,15 @@ concurrency: permissions: contents: read - pull-requests: write - issues: write + # Writes (comments, labels) go through CODEX_GITHUB_TOKEN, not GITHUB_TOKEN. + # Same-repo pull_request jobs check out PR code and omit the PAT, + # so GITHUB_TOKEN stays read-only. + pull-requests: read + issues: read + # loadPrEvidence reads CodeRabbit check-runs and commit statuses. Unlisted + # scopes are none, so without these the in-progress safeguard is silently empty. + checks: read + statuses: read env: FALLBACK_WINDOW_MINUTES: "45" @@ -62,7 +69,7 @@ jobs: - name: Evaluate ready pull requests env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - CODEX_GITHUB_TOKEN: ${{ secrets.CODEX_GITHUB_TOKEN }} + CODEX_GITHUB_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CODEX_GITHUB_TOKEN || '' }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_API_URL: ${{ github.api_url }} GITHUB_EVENT_NAME: ${{ github.event_name }} diff --git a/docs/ops/pr-review-policy.md b/docs/ops/pr-review-policy.md index 27db2ef..7c1dda0 100644 --- a/docs/ops/pr-review-policy.md +++ b/docs/ops/pr-review-policy.md @@ -21,7 +21,7 @@ Record the fallback honestly as an independent review, never as `CodeRabbit: 0`. ### Automatic Codex fallback -Jonathan approved this automation on October 5, 2026: request a Codex review automatically only when CodeRabbit cannot review a ready pull request. The workflow is `.github/workflows/coderabbit-fallback-review.yml` and the decision script is `.github/pr-review-fallback/pr-review-fallback.mjs`. Unit tests live at `scripts/pr-review-fallback.test.mjs` so `node --test` (which skips hidden `.github/` directories) actually runs them; CI invokes that file explicitly because this repository does not run a repo-root `node --test`. It is fallback-only and must not run on every pull request. +Jonathan approved this automation on October 5, 2026: request a Codex review automatically only when CodeRabbit cannot review a ready pull request. The workflow is `.github/workflows/coderabbit-fallback-review.yml` and the decision script is `.github/pr-review-fallback/pr-review-fallback.mjs`. Unit tests live at `scripts/pr-review-fallback.test.mjs` so `node --test` (which skips hidden `.github/` directories) actually runs them; CI invokes that file explicitly because this repository does not run a repo-root `node --test`. It is fallback-only and must not run on every pull request. The workflow token is read-only plus checks/statuses read, and all writes use `CODEX_GITHUB_TOKEN`. Triggers: