demo: test check_db_entities workflow (do not merge)#2715
Conversation
The check_db_entities workflow used `on: pull_request`, which gives GITHUB_TOKEN read-only perms on fork PRs and made peter-evans/create-or-update-comment fail with HTTP 403. Switch to pull_request_target with least-privilege permissions (contents: read, pull-requests: write). Avoid the usual pull_request_target footgun by never checking out the PR head into a working tree: fetch the PR head SHA as a ref and diff between SHAs, so attacker-controlled file contents never reach checkout/smudge filters/hooks while the write token is in scope. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Trivial comment change in channels.dart to exercise the new pull_request_target-based workflow. Do not merge. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
73a780b to
4aea8bc
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## fix/ci-check-db-entities-fork-perms #2715 +/- ##
====================================================================
Coverage 65.64% 65.64%
====================================================================
Files 423 423
Lines 26708 26708
====================================================================
Hits 17533 17533
Misses 9175 9175 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Purpose
Same-repo demo PR to smoke-test the updated
check_db_entitiesworkflow from #2714. Targets the fix branch directly so the workflow file with the new logic is what runs.Do not merge. Close after verification.
What this validates
pull_request_targetgit diff base...pr_head) correctly identifies the modified entity fileWhat this does NOT validate
pull_request, so this can't reproduce the original 403. Only a real fork PR can validate that side of the change.Expected behaviour
The bot should post a "Database Entity Files Modified" comment listing
packages/stream_chat_persistence/lib/src/entity/channels.dart.🤖 Generated with Claude Code