docs: self-run setup guide — attested reports from a personal repo, no org needed (#56) - #85
Merged
Conversation
…paths
Files:
docs/setup/self-run.md (new) -- complete guide with 5-minute local trial,
attested self-run workflow, coverage guidance, and honesty section.
README.md -- link to self-run guide in CI attestation section.
docs/index.html -- link in quickstart note and footer nav.
Key decisions:
- Composite action pattern used for attested workflow (not reusable
workflow) because the self-run case requires passing a PAT via the
`token` input, which the reusable workflow does not expose.
- Fine-grained PAT only; classic PAT never mentioned, following the
issue QA red flag requirement.
- Only "Pull requests: Read-only" set; Metadata: Read-only noted as
auto-granted.
- Honesty section draws explicit self-run vs org-run distinction,
includes runner_environment note.
- All workflow refs pinned to v0.1.0.
Co-Authored-By: Claude <noreply@anthropic.com>
Step 4 previously called the composite action directly
(gkanitz/CodeRepute@v0.1.0 with token input), but Step 6 verified with
--signer-workflow targeting the canonical reusable workflow. The composite
action produces an attestation whose signer-workflow identity is the
caller's own workflow file, not gkanitz/CodeRepute/.github/workflows/
coderepute-report.yml -- so the --signer-workflow check would always fail
for a reader who followed the guide.
Changed Step 4 to call the canonical reusable workflow at the job level:
jobs:
report:
permissions:
contents: read
pull-requests: read
id-token: write
attestations: write
uses: gkanitz/CodeRepute/.github/workflows/coderepute-report.yml@v0.1.0
with:
repos: ${{ inputs.repos }}
subject: ${{ inputs.subject }}
Removed runs-on, steps, and token input -- the reusable workflow
authenticates via the caller's GITHUB_TOKEN and does not accept a
token input. Added an explanatory note about why the reusable workflow
form is necessary for --signer-workflow to work.
Cross-checked against coderepute-report.yml: inputs (repos, subject),
permissions (contents: read, pull-requests: read, id-token: write,
attestations: write), and pinned version tag (v0.1.0) all match.
Files changed: docs/setup/self-run.md
Co-Authored-By: Claude <noreply@anthropic.com>
Owner
Author
|
🤖 Rework pushed. The triaged review comments were addressed on this branch, the deterministic gate is green, and the QAA (anthropic/claude-haiku-4.5) re-approved. See the new commits above. |
Address rework feedback: the canonical reusable workflow has no token input, so a PAT created per earlier guidance was never used by the workflow path. Fix this gap by: - Scoping PAT creation to the local CLI trial (where -token is accepted) and removing it from the attested workflow section entirely. - Adding a coverage-boundary section after the workflow snippet that states clearly what the GITHUB_TOKEN can and cannot reach, with a table of examples. - Splitting Coverage guidance into local-trial (CLI with PAT) and attested-workflow (CI with GITHUB_TOKEN) subsections with separate tables reflecting the real access limits. - Updating the Honesty section's self-selected coverage paragraph and the how-to-communicate FAQ to account for the workflow path's narrower scope. - Removing 'with a fine-grained PAT' from README and docs/index.html links pointing to the self-run guide. No code changes. No PAT-as-repository-secret step. No overclaim of what the reusable workflow delivers. Files changed: docs/setup/self-run.md (full rework) README.md (remove misleading PAT reference) docs/index.html (remove misleading PAT reference) Co-Authored-By: Claude <noreply@anthropic.com>
Owner
Author
|
🤖 Rework pushed. The triaged review comments were addressed on this branch, the deterministic gate is green, and the QAA (anthropic/claude-haiku-4.5) re-approved. See the new commits above. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #56
Implemented by the autonomous loop: DA (deepseek/deepseek-v4-flash) → deterministic gate (test, vet, fmt) → QAA (anthropic/claude-haiku-4.5) approved.