Skip to content

docs: soften OIDC caveat, document workflow-perms autoflip #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
topcoder1 merged 2 commits into from
Apr 30, 2026
Merged

docs: soften OIDC caveat, document workflow-perms autoflip #1

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1684618
docs: soften OIDC caveat, document workflow-perms autoflip
topcoder1 Apr 30, 2026
d7dbb6f
ci: trigger Claude Review (post-install)
topcoder1 Apr 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ The script reads `ANTHROPIC_API_KEY` from env, falling back to 1Password (`op://

## Caveats

- **Target repo must allow workflow writes:** Settings → Actions → General → Workflow permissions → "Read and write permissions"
- **`gh pr merge --auto` only waits if there are required status checks.** Without a ruleset, it merges immediately. Add a ruleset on each target repo before relying on auto-merge.
- **Target repo workflow permissions:** must be "Read and write" (Settings → Actions → General). `install-pr-review.sh` auto-flips this; if you wire callers manually, flip it yourself.
- **`gh pr merge --auto` only waits if there are required status checks.** Without a ruleset, it merges immediately. `install-pr-review.sh` creates a ruleset by default (`--no-ruleset` to skip).
- **Install PR's `Claude Review` check may fail** with an OIDC "workflow validation" error on PRs that modify the workflow file itself. In practice it often passes; if it fails, merge with admin bypass. Subsequent PRs work normally.
- **This repo is public** — required for cross-account reusable-workflow calls (e.g. `topcoder1/ci-workflows` → `whois-api-llc/*`). The workflows contain no secrets.