chore(deps): regenerate dependency transparency snapshots #437
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Generated by tend 0.1.17. Regenerate with: uvx tend@latest init | |
| # | |
| # Do not edit this file directly — it will be overwritten on regeneration. | |
| # To customize behavior, edit the relevant skill (for example, | |
| # `running-tend`) in this repo's .claude/skills/ directory, or open an issue at | |
| # https://github.com/max-sixty/tend/issues for changes that need to | |
| # happen upstream in the tend-ci-runner plugin. | |
| name: tend-review | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, ready_for_review, reopened] | |
| jobs: | |
| review: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| # A push mid-review queues a replacement run rather than killing the | |
| # session: the running review folds the push in and stamps the commits | |
| # it examined, and the gate step below lets the queued run exit without | |
| # booting an agent when its HEAD is already covered. | |
| cancel-in-progress: false | |
| runs-on: ubuntu-24.04 | |
| environment: | |
| name: tend | |
| deployment: false | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| actions: read | |
| issues: write | |
| steps: | |
| - name: Skip when the live HEAD is already examined | |
| id: gate | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }} | |
| PR: ${{ github.event.pull_request.number }} | |
| EVENT_ACTION: ${{ github.event.action }} | |
| run: | | |
| # shellcheck shell=bash | |
| # Pre-check for tend-review: decide whether the agent needs to boot at all. | |
| # | |
| # The review job runs without cancel-in-progress, so a push mid-review queues | |
| # a replacement run while the live session keeps going, folds the push in, and | |
| # stamps each commit it examined with a `tend-review/<pr>` commit status (review | |
| # skill, "Stamp examined HEADs"). The concurrency group holds this run until | |
| # that session ends; by then the live HEAD is usually stamped and there is | |
| # nothing left to do. Judged against the live PR, not the event payload — a | |
| # queued run's payload is stale by construction. | |
| # | |
| # Inlined into the generated workflow (adopter repos have no copy of this | |
| # file), so it stays self-contained: env in, GITHUB_OUTPUT out. Any write-scoped | |
| # actor could forge the stamp to suppress a review; that actor can already | |
| # cancel the run itself, so the merge gate — not this check — remains the | |
| # security boundary. | |
| # | |
| # env: PR, EVENT_ACTION, GITHUB_REPOSITORY, GITHUB_OUTPUT, GITHUB_TOKEN | |
| # Only `synchronize` can be a stale duplicate of an examination that already | |
| # happened: `opened` has no prior run, and `reopened` / `ready_for_review` | |
| # ask for a fresh pass even on a stamped commit. | |
| if [ "$EVENT_ACTION" != "synchronize" ]; then | |
| echo "should_run=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| # Fail open on API errors: a redundant agent run beats a silently skipped | |
| # review. The parse belongs inside the guard — GitHub sometimes returns an | |
| # HTML error page with a 200 during a blip, so a zero `gh` exit doesn't mean | |
| # the body is JSON, and an unguarded `jq` under the run block's `bash -e` | |
| # would fail the step (fail-closed) instead. | |
| if ! PR_INFO=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR" 2>/dev/null) \ | |
| || ! STATE=$(echo "$PR_INFO" | jq -re '.state'); then | |
| echo "PR #$PR fetch failed — proceeding without the pre-check" | |
| echo "should_run=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if [ "$STATE" != "open" ]; then | |
| echo "PR #$PR is $STATE — skipping" | |
| echo "should_run=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| # The stamp context carries the PR number: one branch can be two open PRs | |
| # (same head, different base), and each base means a different diff, so an | |
| # examination of one must not gate the other. | |
| HEAD=$(echo "$PR_INFO" | jq -r '.head.sha') | |
| STAMPED=$(gh api "repos/$GITHUB_REPOSITORY/commits/$HEAD/status?per_page=100" 2>/dev/null \ | |
| | jq --arg ctx "tend-review/$PR" \ | |
| '[.statuses[]? | select(.context == $ctx and .state == "success")] | length' \ | |
| || echo 0) | |
| if [ "${STAMPED:-0}" -gt 0 ]; then | |
| echo "HEAD $HEAD already examined (tend-review/$PR) — skipping" | |
| echo "should_run=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "should_run=true" >> "$GITHUB_OUTPUT" | |
| - name: React with eyes | |
| if: steps.gate.outputs.should_run == 'true' | |
| run: | | |
| gh api "repos/$REPO/$TARGET/reactions" -f content=eyes --silent \ | |
| || echo "::warning::could not add the eyes reaction" | |
| env: | |
| REPO: ${{ github.repository }} | |
| TARGET: issues/${{ github.event.pull_request.number }} | |
| GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }} | |
| # GitHub only materializes refs/pull/N/merge for mergeable PRs — on | |
| # conflicting PRs it 404s and every downstream step cascades as skipped. | |
| # Probe first and fall back to /head so review always runs; on fallback | |
| # the review sees the PR branch in isolation rather than the post-merge | |
| # tree. | |
| - name: Resolve PR checkout ref | |
| id: pr_ref | |
| if: steps.gate.outputs.should_run == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| if gh api "repos/${{ github.repository }}/git/ref/pull/$PR/merge" --silent 2>/dev/null; then | |
| echo "ref=refs/pull/$PR/merge" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "ref=refs/pull/$PR/head" >> "$GITHUB_OUTPUT" | |
| echo "::notice::refs/pull/$PR/merge unavailable (likely merge conflict); falling back to /head" | |
| fi | |
| - uses: actions/checkout@v7 | |
| if: steps.gate.outputs.should_run == 'true' | |
| with: | |
| ref: ${{ steps.pr_ref.outputs.ref }} | |
| allow-unsafe-pr-checkout: true | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| token: ${{ secrets.TEND_BOT_TOKEN }} | |
| - uses: max-sixty/tend/claude@0.1.17 | |
| if: steps.gate.outputs.should_run == 'true' | |
| with: | |
| github_token: ${{ secrets.TEND_BOT_TOKEN }} | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| bot_name: dormouse-bot | |
| model: opus | |
| prompt: >- | |
| ${{ format('/tend-ci-runner:review {0}', github.event.pull_request.number) }} | |
| - name: Remove the eyes reaction | |
| if: always() && (steps.gate.outputs.should_run == 'true') | |
| run: | | |
| REACTION_ID=$(gh api "repos/$REPO/$TARGET/reactions?content=eyes" \ | |
| --jq ".[] | select(.user.login == \"$BOT_NAME\") | .id" | head -n1) | |
| if [ -n "$REACTION_ID" ]; then | |
| gh api -X DELETE "repos/$REPO/$TARGET/reactions/$REACTION_ID" --silent \ | |
| || echo "::warning::could not remove the eyes reaction" | |
| fi | |
| env: | |
| REPO: ${{ github.repository }} | |
| TARGET: issues/${{ github.event.pull_request.number }} | |
| BOT_NAME: dormouse-bot | |
| GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }} |