diff --git a/.github/workflows/claude-doc-sync.yml b/.github/workflows/claude-doc-sync.yml index 2d33bd875..bb6c88908 100644 --- a/.github/workflows/claude-doc-sync.yml +++ b/.github/workflows/claude-doc-sync.yml @@ -1,33 +1,6 @@ name: Sync docs on merged PRs -# Runs after a PR merges into master and asks Claude to check whether any -# documentation (root README, package READMEs, /docs) needs updating to -# reflect the change, opening a follow-up PR only if it finds something to -# update. -# -# Gated to keep run volume (and cost) down: only master-targeted merges -# (branches: [master] below) that also carry an approving review -# (reviewDecision == APPROVED, checked in the gate step) trigger a Claude run. -# master requires 1 approval by branch protection, but enforce_admins is off, -# so an admin can still merge without one - this gate closes that gap rather -# than assuming protection alone guarantees a review happened. -# -# Uses pull_request_target (not pull_request) so the workflow runs with this -# repo's own permissions even when the merged PR came from a fork - this repo -# takes plenty of external contributions and a plain `pull_request` trigger -# gets a read-only token for fork-authored PRs, which would make `gh pr -# create` fail below. This is safe here because we only ever check out -# base.ref (the already-reviewed, already-merged default branch), never the -# PR's own head ref - we never build or execute the contributor's code. -# -# Installs the Claude Code CLI directly via npm rather than using -# `uses: anthropics/claude-code-action` - this repo's Actions policy is -# allowed_actions: selected with an empty patterns_allowed list (only -# GitHub-owned actions are permitted), so a third-party `uses:` reference -# fails at startup before any job runs. Installing and invoking the CLI -# ourselves only needs actions/checkout and actions/setup-node, both -# GitHub-owned and already allowed, so it sidesteps that policy without -# requiring an org/repo policy change. +# pull_request_target (not pull_request) for write access on fork-authored PRs too; safe since we only check out the already-merged base branch, never the PR's own head. on: pull_request_target: types: [closed] @@ -42,6 +15,7 @@ jobs: if: github.event.pull_request.merged == true runs-on: ubuntu-latest-large steps: + # Gates on approval since master's review requirement can be bypassed by admins. - name: Require an approved review id: gate env: @@ -69,6 +43,7 @@ jobs: with: node-version: 22 + # Installed directly rather than via a third-party action, since this repo's Actions policy only allows GitHub-owned actions. - name: Install Claude Code CLI if: steps.gate.outputs.approved == 'true' run: npm install -g @anthropic-ai/claude-code @@ -89,11 +64,13 @@ jobs: cat > "$RUNNER_TEMP/claude-prompt.txt" <