From d26115b591770acc0f03ee33b72df99ffad3953e Mon Sep 17 00:00:00 2001 From: Stephen Benjamin Date: Tue, 12 May 2026 18:45:10 +0000 Subject: [PATCH 1/5] Fix 403 when posting lint review comments on fork PRs Switch from pull_request to pull_request_target so the GITHUB_TOKEN has write access for fork PRs. Explicitly checkout the PR head SHA since pull_request_target defaults to the base branch. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/lint-plugins.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lint-plugins.yml b/.github/workflows/lint-plugins.yml index 2d37a2c5c..33d55ca78 100644 --- a/.github/workflows/lint-plugins.yml +++ b/.github/workflows/lint-plugins.yml @@ -1,7 +1,7 @@ name: Lint Plugins on: - pull_request: + pull_request_target: push: branches: - main @@ -16,6 +16,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Run skillsaw uses: stbenjam/skillsaw@d475638873e09327262ae82f5657d390a91a3c8a # v0 From 1030a9c40d378b39d76f2f6de9f21a687ec09640 Mon Sep 17 00:00:00 2001 From: Stephen Benjamin Date: Tue, 12 May 2026 18:51:49 +0000 Subject: [PATCH 2/5] Use two-workflow pattern for lint review comments on fork PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Revert pull_request_target — it's unsafe because .skillsaw-custom.py runs subprocess on scripts from the checked-out code, which would execute with a write-capable token on fork PRs. Instead, keep pull_request (read-only token) for linting. The skillsaw action uploads the report as an artifact. A new lint-review.yml workflow triggers on workflow_run completion and uses the skillsaw review action to post PR comments with a privileged token, without ever checking out untrusted code. Also removes pull-requests: write from the lint job since it no longer posts comments directly. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/lint-plugins.yml | 5 +---- .github/workflows/lint-review.yml | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/lint-review.yml diff --git a/.github/workflows/lint-plugins.yml b/.github/workflows/lint-plugins.yml index 33d55ca78..bc2284a3d 100644 --- a/.github/workflows/lint-plugins.yml +++ b/.github/workflows/lint-plugins.yml @@ -1,7 +1,7 @@ name: Lint Plugins on: - pull_request_target: + pull_request: push: branches: - main @@ -11,13 +11,10 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - pull-requests: write steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Run skillsaw uses: stbenjam/skillsaw@d475638873e09327262ae82f5657d390a91a3c8a # v0 diff --git a/.github/workflows/lint-review.yml b/.github/workflows/lint-review.yml new file mode 100644 index 000000000..c819cdc1d --- /dev/null +++ b/.github/workflows/lint-review.yml @@ -0,0 +1,20 @@ +name: Lint Review + +on: + workflow_run: + workflows: ["Lint Plugins"] + types: [completed] + +jobs: + review: + if: github.event.workflow_run.event == 'pull_request' + runs-on: ubuntu-latest + permissions: + pull-requests: write + + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Post review comments + uses: stbenjam/skillsaw/review@d475638873e09327262ae82f5657d390a91a3c8a # v0 From f8e22f6dad049f20e22aff03af149c4ff0d42a08 Mon Sep 17 00:00:00 2001 From: Stephen Benjamin Date: Tue, 12 May 2026 19:06:28 +0000 Subject: [PATCH 3/5] Update skillsaw action SHA to include two-workflow support Co-Authored-By: Claude Opus 4.6 --- .github/workflows/lint-plugins.yml | 2 +- .github/workflows/lint-review.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint-plugins.yml b/.github/workflows/lint-plugins.yml index bc2284a3d..e3afbbda5 100644 --- a/.github/workflows/lint-plugins.yml +++ b/.github/workflows/lint-plugins.yml @@ -17,7 +17,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run skillsaw - uses: stbenjam/skillsaw@d475638873e09327262ae82f5657d390a91a3c8a # v0 + uses: stbenjam/skillsaw@eee9ebe1e1e26cdc66a2b26f1f5e0e1b62a9e0b6 # v0 with: strict: true verbose: true diff --git a/.github/workflows/lint-review.yml b/.github/workflows/lint-review.yml index c819cdc1d..e54a0af36 100644 --- a/.github/workflows/lint-review.yml +++ b/.github/workflows/lint-review.yml @@ -17,4 +17,4 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Post review comments - uses: stbenjam/skillsaw/review@d475638873e09327262ae82f5657d390a91a3c8a # v0 + uses: stbenjam/skillsaw/review@eee9ebe1e1e26cdc66a2b26f1f5e0e1b62a9e0b6 # v0 From 9d8dd009d952af456b3edf4c05187ef5d2ae9b4e Mon Sep 17 00:00:00 2001 From: Stephen Benjamin Date: Tue, 12 May 2026 19:06:43 +0000 Subject: [PATCH 4/5] Fix skillsaw action SHA Co-Authored-By: Claude Opus 4.6 --- .github/workflows/lint-plugins.yml | 2 +- .github/workflows/lint-review.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint-plugins.yml b/.github/workflows/lint-plugins.yml index e3afbbda5..8e3f3222c 100644 --- a/.github/workflows/lint-plugins.yml +++ b/.github/workflows/lint-plugins.yml @@ -17,7 +17,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run skillsaw - uses: stbenjam/skillsaw@eee9ebe1e1e26cdc66a2b26f1f5e0e1b62a9e0b6 # v0 + uses: stbenjam/skillsaw@eee9ebea0f33517bfb3c4d0413471c5165becc7e # v0 with: strict: true verbose: true diff --git a/.github/workflows/lint-review.yml b/.github/workflows/lint-review.yml index e54a0af36..48bf2f332 100644 --- a/.github/workflows/lint-review.yml +++ b/.github/workflows/lint-review.yml @@ -17,4 +17,4 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Post review comments - uses: stbenjam/skillsaw/review@eee9ebe1e1e26cdc66a2b26f1f5e0e1b62a9e0b6 # v0 + uses: stbenjam/skillsaw/review@eee9ebea0f33517bfb3c4d0413471c5165becc7e # v0 From 5f58193b64fa14c804012b7c4c0c494f048b5f88 Mon Sep 17 00:00:00 2001 From: Stephen Benjamin Date: Tue, 12 May 2026 19:09:24 +0000 Subject: [PATCH 5/5] Add comment explaining why lint review is a separate workflow Co-Authored-By: Claude Opus 4.6 --- .github/workflows/lint-review.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/lint-review.yml b/.github/workflows/lint-review.yml index 48bf2f332..05170add9 100644 --- a/.github/workflows/lint-review.yml +++ b/.github/workflows/lint-review.yml @@ -1,3 +1,8 @@ +# Separate workflow for posting lint review comments on PRs. +# The lint workflow runs with a read-only token (safe for fork PRs that +# execute custom linter rules via subprocess). This workflow triggers +# after it completes, downloads the report artifact, and posts comments +# with a write-capable token — without ever checking out untrusted code. name: Lint Review on: