fix(rep60): adopt protected current-revision controller - #130
Open
litroc wants to merge 1 commit into
Open
Conversation
Shared-Assets-Source-SHA: edec7c2d3c4ef73373408fdbb44c3dd5e9112676 Shared-Assets-Source-Run: 32177576480 Shared-Assets-Sync-App-ID: 4351516
There was a problem hiding this comment.
Pull request overview
This PR rolls out a human-authored REP-60 / MLX-90 “current-revision” protected review controller, replacing the prior automation sync (PR #128) while preserving the referenced automation head behavior and removing local AI egress from the push-ready flow.
Changes:
- Introduces a protected exact-revision materializer/verifier script to bind review inputs deterministically (
scripts/materialize-exact-revision-review.py). - Updates the local
lit-push-readyevidence pipeline to prohibit local AI agents while still running deterministic snapshot/secret/topology guards. - Reworks the GitHub Actions Copilot gate toward a protected
pull_request_targetcontroller with supporting rerun/refresh helpers and updated job IDs referenced by.lit/push-ready.json.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/materialize-exact-revision-review.py | New protected helper to materialize and verify bounded exact-revision review inputs and bind protected assets. |
| scripts/lit-push-ready.py | Disables local agent execution; keeps deterministic workspace materialization/guardrails and updates evidence payload fields. |
| .lit/push-ready.json | Updates remote-only check job name and disables local agent configuration flags. |
| .github/workflows/release-bot-exact-head-review.yml | Renames/adjusts the protected exact-revision job and tightens check-run app filtering. |
| .github/workflows/current-revision-rerun.yml | New protected workflow-dispatch helper to rerun the single verifier attempt under strict live-binding checks. |
| .github/workflows/copilot-review.yml | Migrates to protected current-revision controller logic (pull_request_target) and publishes bound neutral results. |
| .github/workflows/copilot-review-refresh.yml | Updates refresh workflow to locate/rerun the canonical gate under pull_request_target. |
Suppressed comments (2)
.github/workflows/copilot-review.yml:38
request-current-revision-reviewis gated to onlyopened/ready_for_review. If the workflow is updated to run onsynchronize(needed to keep required checks current), this job will still be skipped on pushes and won’t request a Copilot review for the new head SHA.
if: >-
github.event_name == 'pull_request_target' &&
(github.event.action == 'opened' ||
github.event.action == 'ready_for_review') &&
github.event.pull_request.draft == false &&
.github/workflows/copilot-review.yml:205
verify-current-revision-policyis also gated to onlyopened/ready_for_review. On new commits (synchronize) the workflow would not publish/refresh the bound neutral check for the updated head SHA, which can leave required status missing or stale.
(((github.event.action == 'opened' ||
github.event.action == 'ready_for_review') &&
github.event.pull_request.user.login != 'lightning-it-release-automation[bot]') ||
((github.event.action == 'opened' ||
github.event.action == 'ready_for_review') &&
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
6
to
+8
| on: | ||
| pull_request: | ||
| types: | ||
| [ | ||
| opened, | ||
| synchronize, | ||
| reopened, | ||
| ready_for_review, | ||
| labeled, | ||
| unlabeled, | ||
| edited, | ||
| ] | ||
| pull_request_target: | ||
| types: [opened, ready_for_review] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Human-authored protected rollout replacing automation PR #128. Preserves exact automation head 685dd4f; pipeline review only, with no local AI review.