ci: run pr-review under the CI app identity - #95
Merged
Conversation
The shared pr-review action gates review-thread resolution on github_identity_token being non-empty; without it the job token publishes the review but addressed automated threads are left unresolved. Mint the CI app token and pass it through, matching stateless-validator.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pr-reviewjob and pass it to the action asgithub_identity_token.The
claude-pr-reviewaction gates review-thread resolution ongithub_identity_tokenbeing non-empty. With only the job token, the action publishes reviews and updates the sticky status, but every addressed automated thread stays open — the author fixes the code and the thread never closes.Also checks out under the app identity with
persist-credentials: false, matching the pattern already in use instateless-validator.Test plan
pr-reviewon any PR that touches.github/workflows/claude.yml, so this PR does not exercise the change. Verification happens on the next unrelated PR: theapp-tokenstep must succeed, and an addressed automated thread must end up resolved.app-tokenstep means the CI app is not installed on this repo or the org secret is not scoped to it.