chore(ci): review every org-authored PR automatically - #9
Merged
Merged
Conversation
Adds a pull_request trigger to the Claude review workflow so every PR opened by an org member is reviewed without anyone remembering to ask. This is the compensating change-management control for SOC 2 CC8.1: a sole maintainer cannot approve their own pull request, so an automatic second reader stands in for independent review. Outside contributors cannot invoke it or drain Claude usage. The head-repo check rejects fork PRs outright and author_association rejects CONTRIBUTOR/NONE. This stays on pull_request rather than pull_request_target, so a fork PR carries no secrets regardless. A concurrency group cancels superseded runs so a draft/ready toggle cannot stack reviews. The review posts findings as a comment and does not approve. Org policy already sets can_approve_pull_request_reviews=false, and an unconditional bot approval on every PR would be a rubber stamp - worse audit evidence than the documented exception it would replace.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every pull request opened by an org member now gets an automatic Claude review. This is the compensating change-management control for SOC 2 CC8.1: a sole maintainer cannot approve their own pull request — GitHub forbids self-approval — so an automatic second reader stands in for independent review.
This is phase 2, completing the rollout across the organization. Phase 1 covered
robosystemsand the three client SDKs.Changes
.github/workflows/claude.ymlpull_requesttrigger on[opened, ready_for_review]. Deliberately notsynchronize— every push to an open PR would re-run the review.pull_requestarm to the job gate, guarded twice against outside contributors:head.repo.full_name == github.repositoryrejects fork PRs outright, andauthor_associationrestricts toOWNER/MEMBER/COLLABORATOR. Stays onpull_requestrather thanpull_request_target, so a fork PR carries no secrets regardless.concurrencygroup keyed on the PR number withcancel-in-progress, so a draft/ready toggle cannot stack runs.promptsupplying the review brief on the automatic trigger, left empty for comment-driven events so Claude still follows the comment that tagged it. The brief instructs it to post findings as a comment and not to approve.Breaking Changes
None. CI configuration only.
Testing
Workflow YAML validated by parsing with
yaml.safe_loadand asserting the trigger set, gate count, fork check, concurrency block, and prompt. Repo pre-commit hooks passed.This PR is itself the first live exercise of the new trigger.