fix(workflows): maintainer gate re-evaluation, head-SHA approval, pinned org checkout#8
Merged
Merged
Conversation
…SHA approval - Trigger on pull_request_review (submitted, dismissed) so an approval clears the failing status without waiting for a push; base-branch filter moved to the job-level if since pull_request_review does not support a branches filter - Only count a maintainer approval whose commit_id matches the PR head SHA at evaluation time (prevents approve-then-swap) - Paginate listReviews instead of reading only the first 30 reviews Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…emplate The template runs on pull_request_target with a write-capable token but checked out agentrust-io/.github at the mutable ref main. Pin to the current main commit SHA so the executed code can only change via a deliberate bump. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jun 11, 2026
imran-siddique
added a commit
to agentrust-io/agent-manifest
that referenced
this pull request
Jun 11, 2026
…SHA approval (#159) Ports agentrust-io/.github#8. Refs agentrust-io/.github#9. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
imran-siddique
added a commit
to agentrust-io/trace-tests
that referenced
this pull request
Jun 11, 2026
…SHA approval (#10) Ports agentrust-io/.github#8. Refs agentrust-io/.github#9. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
imran-siddique
added a commit
to agentrust-io/trace-spec
that referenced
this pull request
Jun 11, 2026
…SHA approval (#22) Ports agentrust-io/.github#8. Refs agentrust-io/.github#9. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
imran-siddique
added a commit
to agentrust-io/examples
that referenced
this pull request
Jun 11, 2026
…SHA approval (#15) Ports agentrust-io/.github#8. Refs agentrust-io/.github#9. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
imran-siddique
added a commit
to agentrust-io/cmcp
that referenced
this pull request
Jun 11, 2026
…SHA approval (#288) Ports agentrust-io/.github#8. Refs agentrust-io/.github#9. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
imran-siddique
added a commit
to agentrust-io/awesome-ai-governance
that referenced
this pull request
Jun 11, 2026
…eck (#19) * ci: add link checking, maintainer gate, and contributor reputation check - links.yml: lychee over README.md on PRs touching it plus a weekly link-rot sweep; 403/429 accepted (bot-hostile sites), SPA anchors excluded. - require-maintainer-approval.yml: the fixed gate (re-evaluates on review events, head-SHA-matched approvals, paginated) ported from agentrust-io/.github#8. - contributor-check.yml: org reputation check with the .github checkout pinned by commit SHA. The repo previously had no CI: community PRs merged with no link validation or review gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: use TOML literal string for the exclude regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: drop exclude_mail (not a lychee v0.23 field; mail excluded by default) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: repair four dead links found by the new link checker - CSA MCP Security Resource Center moved to modelcontextprotocol-security.io - CyberSecEval directory renamed to CybersecurityBenchmarks in PurpleLlama - Anthropic zero-trust URL never resolved; replaced with the real Trustworthy Agents in Practice research page and an accurate description - Tuning Engines repo was deleted upstream; entry removed Also pass GITHUB_TOKEN to lychee: API resolution avoids rate-limit flakiness and covers org repos that are private until launch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: exclude pre-launch private org repos and a slow host from lychee The repo-scoped GITHUB_TOKEN cannot see other private repos in the org, so the three pre-launch links 404 in CI until the 2026-06-23 launch (dated removal note in the config). aisafety.camp regularly exceeds CI timeouts despite being alive. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes four issues from a security review of the org workflows.
require-maintainer-approval.yml
pull_request_target(opened/synchronize/reopened), so a maintainer approval did not re-run the failing status until someone pushed. Addedpull_request_review: [submitted, dismissed]as a trigger.pull_request_reviewdoes not support abranchesfilter, so the base-branch check moved to the job-levelif(github.event.pull_request.base.ref == 'main'). Both event payloads carry the PR atgithub.event.pull_request, so the script needed no event-type branching; it now reads the PR number once and re-fetches the PR for the head SHA at evaluation time.commit_idequals the current PR head SHA.listReviewswas unpaginated (first 30 reviews). Switched togithub.paginate.contributor-check-external-template.yml
agentrust-io/.githuband runs its composite action with a write-capable token onpull_request_target, but was pinned toref: main. Now pinned to commit8a2b77b(main at time of this PR) with a comment that the SHA must be bumped deliberately. Note: after this PR merges, the pin should be bumped to include these fixes.Testing
actionlintnot available locally; both files validated withyaml.safe_load.🤖 Generated with Claude Code