 Michael Recachinas
|
925dc83735
|
Migrate pull request automation away from pull_request_target (#2625)
* Migrate pull_request_target workflows
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR duplicate check writer review
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix duplicate-check writer artifact handling
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Make PR duplicate check gh-aw compilable
Configure the agentic workflow source to allow fork PR triggers with staged safe outputs, upload a PR context artifact through supported post-steps, and have the workflow_run writer consume that context before publishing validated comments. This lets gh-aw regenerate the lockfile without restoring pull_request_target or privileged PR-code execution.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
* Harden workflow-run PR writers
Bind privileged artifact processing to trusted workflow-run PR identity, serialize same-PR writers, and cap aggregate quality comments.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
|
2026-08-14 11:22:06 +10:00 |
|