ci: roll out OIDC review workflow #10

Merged

jercik merged 3 commits from ci/oidc-review-runtime-6 into main 2026-08-01 13:23:08 +00:00

Conversation 0 Commits 3 Files changed 20 +4675 -600

jercik commented 2026-07-30 14:25:19 +00:00

Owner

Copy link

Regenerates the agent-skills Forgejo review closure from j4k-align 1.100.7.

• replaces the stale 1.100.5 generator-only publication path with the coordinator and dedicated pr-review-post.yml writer
• keeps public review-tool preparation credential-free; generator-private Axrecipe tooling is installed in an isolated, temporary boundary
• dispatches one main-pinned writer per finalized slot, serialized per pull request under the canonical forgejo-actions actor
• binds result retrieval and idempotent receipts to the source workflow run, generator attempt, PR, head, and slot
• adds fail-closed reviewer-isolation capability checks and limits pending-review cleanup to this writer’s actor
• retains the managed Node test workflow and its companion closure

Validation:

• regenerated with j4k-align 1.100.7, then reran the same reconciliation with no further changes
• j4k-align --repo j4k-oss/agent-skills --local-path <worktree> confirms 18/18 managed repository files and 4/4 workflows synchronized
• node --test skills/node/rules/assets/graceful-server.test.ts
• node --check for every managed writer TypeScript module
• git diff --check

This supersedes the stale 1.100.5 closure and its old-base review failures. There were no submitted review comments to carry forward.

Regenerates the agent-skills Forgejo review closure from `j4k-align` 1.100.7. - replaces the stale 1.100.5 generator-only publication path with the coordinator and dedicated `pr-review-post.yml` writer - keeps public review-tool preparation credential-free; generator-private Axrecipe tooling is installed in an isolated, temporary boundary - dispatches one `main`-pinned writer per finalized slot, serialized per pull request under the canonical `forgejo-actions` actor - binds result retrieval and idempotent receipts to the source workflow run, generator attempt, PR, head, and slot - adds fail-closed reviewer-isolation capability checks and limits pending-review cleanup to this writer’s actor - retains the managed Node test workflow and its companion closure Validation: - regenerated with `j4k-align` 1.100.7, then reran the same reconciliation with no further changes - `j4k-align --repo j4k-oss/agent-skills --local-path <worktree>` confirms 18/18 managed repository files and 4/4 workflows synchronized - `node --test skills/node/rules/assets/graceful-server.test.ts` - `node --check` for every managed writer TypeScript module - `git diff --check` This supersedes the stale 1.100.5 closure and its old-base review failures. There were no submitted review comments to carry forward.

jercik added 1 commit 2026-07-30 14:25:19 +00:00

ci: roll out OIDC review workflow 6a62118719

jercik added 1 commit 2026-07-30 17:24:22 +00:00

ci: complete review workflow dependencies 36e96ce62d

jercik added 1 commit 2026-08-01 11:47:43 +00:00

ci: refresh OIDC review workflow 33bcf36d0a

jercik merged commit 584428a1dd into main 2026-08-01 13:23:08 +00:00

jercik deleted branch ci/oidc-review-runtime-6 2026-08-01 13:23:08 +00:00

jercik referenced this pull request from a commit 2026-08-01 13:23:09 +00:00

ci: roll out OIDC review workflow (#10)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

j4k-oss/agent-skills!10

No description provided.