Skip to content

v2.0.9 — preflight + Harden-Runner

Choose a tag to compare

View all tags
@nsportsman nsportsman released this 19 Apr 20:28
v2.0.9
c4e898f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Two centralized additions to the reusable Claude PR reviewer:

  1. Preflight job skips Claude on docs-only PRs (saves ~$5-10k/yr in Opus tokens). Short-circuits to run when @claude mentioned (override preserved). Paginated file list (handles PRs >100 files per cli/cli#5368).
  2. Harden-Runner on both jobs — closes the asymmetry with go-ci.yml / go-security.yml. Parameterized (enable-harden-runner, harden-runner-policy, harden-runner-allowed-endpoints). Default audit mode = no caller breakage.

Caller pin

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@c4e898f83b9c4008cc3dbe295cc420e53ec6b16b  # v2.0.9

Bot-review credits

  • Codex + CodeRabbit (independently) caught the @claude override regression on docs-only PRs — fixed.
  • Codex caught the gh pr view --json files 100-file cap — fixed via paginated gh api.
Assets 2
Loading