fix(validator_store): avoid non-leader blinded publish #4945
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Mentions | |
| # @claude mentions on issues and PR comments | |
| # See: https://github.com/anthropics/claude-code-action/pull/614 | |
| on: | |
| issue_comment: | |
| types: [created, edited] | |
| pull_request_review_comment: | |
| types: [created, edited] | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| jobs: | |
| claude-mentions: | |
| if: contains(github.event.comment.body, '@claude') | |
| name: claude-mentions | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| actions: read | |
| steps: | |
| - name: Check if user is org member | |
| id: check | |
| run: | | |
| COMMENT_AUTHOR="${{ github.event.comment.author_association || github.event.review.author_association }}" | |
| # Check if user is org member or owner | |
| if [[ "$COMMENT_AUTHOR" == "MEMBER" || "$COMMENT_AUTHOR" == "OWNER" ]]; then | |
| echo "is_member=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "is_member=false" >> $GITHUB_OUTPUT | |
| echo "⚠️ User is not a member of sigp organization. Skipping." | |
| exit 1 | |
| fi | |
| # Generate the app token before checkout so it can be used for | |
| # git operations. `claude-code-action` calls `setupBranch()` (which | |
| # fetches PR refs via `git fetch origin pull/N/head:...`) before | |
| # `configureGitAuth()`, so the token embedded in `origin` by | |
| # `actions/checkout` must already have permission to fetch fork | |
| # PR refs. | |
| - name: Generate GitHub App token | |
| if: steps.check.outputs.is_member == 'true' | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ vars.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - name: Checkout repository | |
| if: steps.check.outputs.is_member == 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Configure AWS Credentials (OIDC) | |
| if: steps.check.outputs.is_member == 'true' | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} | |
| aws-region: us-west-2 | |
| - name: Read review prompt | |
| if: steps.check.outputs.is_member == 'true' | |
| id: review-prompt | |
| # Always load the prompt from the default branch (trusted source), | |
| # independent of whichever PR/fork ref was checked out above. | |
| # Keep this block in sync with .github/workflows/claude-pr-review.yml. | |
| run: | | |
| { | |
| echo "content<<PROMPT_EOF" | |
| git fetch https://github.com/${{ github.repository }}.git ${{ github.event.repository.default_branch }} --depth=1 | |
| git show FETCH_HEAD:.github/prompts/review.md | |
| echo "PROMPT_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Run Claude Code Action | |
| if: steps.check.outputs.is_member == 'true' | |
| timeout-minutes: 25 | |
| uses: anthropics/claude-code-action@v1.0.127 | |
| with: | |
| github_token: ${{ steps.app-token.outputs.token }} | |
| use_bedrock: "true" | |
| claude_args: | | |
| --max-turns 80 | |
| --model us.anthropic.claude-opus-4-8 | |
| --allowedTools "Glob,Grep,LS,Read,mcp__github_comment__update_claude_comment,mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__get_workflow_run_details,mcp__github_ci__download_job_log,Bash(git status:*),Bash(git diff:*),Bash(git show:*),Bash(git log:*),Bash(git rev-parse:*),Bash(git merge-base:*),Bash(git grep:*)" | |
| --disallowedTools "Edit,MultiEdit,Write,NotebookEdit,Bash(git add:*),Bash(git commit:*),Bash(git rm:*)" | |
| --append-system-prompt "${{ steps.review-prompt.outputs.content }}" |