l0ng-aiandl0ng-ai 8652c7928a ci: review fork pull requests behind a label (#391) ...

A fork PR gets no secrets on `pull_request`, so claude-code-review.yml
skips it. `pull_request_target` is the only event that reaches the
diff with our token, and it puts that token in a job beside code we did
not write, so the fork path is a separate file under four constraints:
a label applied by someone with write access is the only trigger,
nothing from the PR is executed, the tool allowlist is read-only, and
the job holds no write permission to carry anything back out.

The same label also re-runs the ordinary review, which a PR opened
before that workflow existed otherwise has no way to start.

Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>

2026-08-07 22:37:45 +08:00

..

ISSUE_TEMPLATE

tty7: a GPU-rendered, daemon-backed terminal in pure Rust

2026-07-06 21:54:27 +08:00

scripts

fix(bundle): declare macOS TCC privacy keys for child processes (#323)

2026-08-07 11:15:22 +08:00

workflows

ci: review fork pull requests behind a label (#391)

2026-08-07 22:37:45 +08:00

dependabot.yml

tty7: a GPU-rendered, daemon-backed terminal in pure Rust

2026-07-06 21:54:27 +08:00