chore(ci): review every org-authored PR automatically - #190
Merged
Conversation
Adds a pull_request trigger to the Claude review workflow so every PR opened by an org member is reviewed without anyone remembering to ask. This is the compensating change-management control for SOC 2 CC8.1: a sole maintainer cannot approve their own pull request, so an automatic second reader stands in for independent review. Also adds the author_association gate that this repo was missing entirely. The workflow is public and previously ran for any commenter. Outside contributors are now excluded on two independent checks - the head-repo test rejects fork PRs outright, and author_association rejects CONTRIBUTOR/NONE - so no one outside the org can invoke Claude or drain Claude usage. The review posts findings as a comment and does not approve. An unconditional bot approval on every PR would be a rubber stamp and worse audit evidence than the documented exception it would replace.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every pull request opened by an org member now gets an automatic Claude review, and this repository's workflow gains the author gate it was missing entirely.
The review is the compensating change-management control for SOC 2 CC8.1: a sole maintainer cannot approve their own pull request — GitHub forbids self-approval — so an automatic second reader stands in for independent review. This repo is one of three that previously had a pull-request requirement with nothing verifying the change before merge: no required status checks, and a
copilot_code_reviewruleset rule that is configured but produces no reviews (verified: zero reviews on the last three merged PRs here).Changes
.github/workflows/claude.ymlpull_requesttrigger on[opened, ready_for_review]. Notsynchronize— every push to an open PR would re-run the review.author_associationgate, which this workflow did not have. It previously ran for any commenter mentioning@claude, on a public repository. All four comment-driven arms are now restricted toOWNER/MEMBER/COLLABORATOR.pull_requestarm is guarded twice:head.repo.full_name == github.repositoryrejects fork PRs outright, andauthor_associationrejectsCONTRIBUTOR/NONE. Stays onpull_requestrather thanpull_request_target, so a fork PR carries no secrets regardless.concurrencygroup keyed on the PR number withcancel-in-progress.promptwith a review brief tuned to this repo — it calls out the post-1.0 two-tier SDK contract, so the reviewer flags anything touching the stable tier that would require a coordinated client major. Left empty for comment-driven events. The brief instructs it to post findings as a comment and not to approve.Breaking Changes
None. CI configuration only — no change to any published symbol, and neither tier of the SDK contract is touched.
Testing
Workflow YAML validated by parsing with
yaml.safe_loadand asserting the trigger set, gate count, fork check, and concurrency block. Repo pre-commit hooks passed (lint, format, typecheck, full unit suite).This PR is itself the first live exercise of the new trigger.