Repository navigation
Conversation
- CI gates also require the head repo to be this repository and the base to be main (a fork branch named trunk, or trunk into another branch, no longer runs CI). - Trunk guard runs via pull_request_target (loaded from the base branch, so a PR cannot edit it to pass), re-runs on base edits, and checks head repo. - Workflows that only react to a PR closing are no longer gated.
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5d6f874. Configure here.
| jobs: | ||
| verify: | ||
| if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' | ||
| if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') |
There was a problem hiding this comment.
CI misses retargeted trunk PRs
Medium Severity
The new base_ref == 'main' condition skips every CI job when a same-repo trunk pull request does not already target main. ci.yml still uses default pull_request types, so changing the base to main does not start a new run, and the earlier skipped jobs can remain the passing required checks.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5d6f874. Configure here.
1 participant
Hardens the trunk-only CI gating per review on AgentWorkforce/relay#1932: head repo + base branch checks in every gate; guard via
pull_request_targetwithedited; closed-only workflows ungated.🤖 Generated with Claude Code
Note
Medium Risk
Changes branch-protection and CI trigger logic; mistakes could block legitimate merges or skip checks, but no application runtime code is touched.
Overview
Tightens trunk-only CI so the heavy
ci.ymljobs no longer run on every PR whose head branch is namedtrunk. On pull requests they now run only when the head istrunk, the PR targetsmain, and the head ref lives in this repository (not a fork).Trunk guard is hardened for the same policy: it triggers on
pull_request_target(workflow definition always comes from the base branch, with no PR checkout), uses minimalpermissions, reacts to PR edited events, and fails merges that are not in-repotrunk→main, with an updated error message.Reviewed by Cursor Bugbot for commit 5d6f874. Bugbot is set up for automated code reviews on this repo. Configure here.