Skip to content

Register push only for the signed-in account's Burrows #2740

Register push only for the signed-in account's Burrows

Register push only for the signed-in account's Burrows #2740

Workflow file for this run

# Generated by tend 0.3.14. Regenerate with: uvx tend@latest init

Check warning on line 1 in .github/workflows/tend-review.yaml

View workflow run for this annotation

GitHub Actions / tend-review

Workflow execution policy warning (evaluate mode)

On November 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target
#
# Do not edit this file directly — it will be overwritten on regeneration.
# To change this workflow, edit .config/tend.yaml. To change what the agent
# does, edit the relevant skill (for example, `running-tend`) in this repo's
# .claude/skills/ directory, or open an issue at
# https://github.com/max-sixty/tend/issues for changes that need to
# happen upstream in the tend-ci-runner plugin.
name: tend-review
on:
pull_request_target:
types: [opened, synchronize, ready_for_review, reopened]
jobs:
review:
if: vars.TEND_ENABLED != 'false'
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
# Preserve pending PR events within GitHub's queue limit: a push must not
# replace a ready-for-review run. Runs stay serial so outward actions
# cannot race. An override setting `cancel-in-progress: true` must set
# `queue: null` too — GitHub rejects the pair as an invalid workflow file.
queue: max
cancel-in-progress: false
runs-on: ubuntu-24.04
environment:
name: tend
deployment: false
permissions:
contents: write
pull-requests: write
actions: read
issues: write
steps:
- name: React with eyes
run: |
gh api "repos/$REPO/$TARGET/reactions" -f content=eyes --silent \
|| echo "::warning::could not add the eyes reaction"
env:
REPO: ${{ github.repository }}
TARGET: issues/${{ github.event.pull_request.number }}
GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }}
# The runner checkout stays on the PR base tree for `setup:` and
# local actions' POST chains; the harness moves the agent's view of it to
# the PR's topology.
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
token: ${{ secrets.TEND_BOT_TOKEN }}
- run: node scripts/setup-git.mjs
name: Define the markdown merge driver
- uses: max-sixty/tend/claude@0.3.14
with:
github_token: ${{ secrets.TEND_BOT_TOKEN }}
merge: restricted
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
bot_name: dormouse-bot
model: opus
checkout_mode: review
base_branch: ${{ github.event.pull_request.base.ref }}
prompt: |2
/tend-ci-runner:review ${{ github.event.pull_request.number }}
- name: Remove the eyes reaction
if: always()
run: |
REACTION_ID=$(gh api --paginate \
"repos/$REPO/$TARGET/reactions?content=eyes&per_page=100" \
--jq ".[] | select(.user.login == \"$BOT_NAME\") | .id" | head -n1)
if [ -n "$REACTION_ID" ]; then
gh api -X DELETE "repos/$REPO/$TARGET/reactions/$REACTION_ID" --silent \
|| echo "::warning::could not remove the eyes reaction"
fi
env:
REPO: ${{ github.repository }}
TARGET: issues/${{ github.event.pull_request.number }}
BOT_NAME: dormouse-bot
GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }}