Skip to content

fix: Support fork PRs in review gate - #13516

Merged
anthonyshew merged 1 commit into
mainfrom
shew/fix-review-gate-forks
Jul 29, 2026
Merged

anthonyshew merged 1 commit into
mainfrom
shew/fix-review-gate-forks

Conversation

@anthonyshew

Copy link
Copy Markdown
Contributor

Summary

  • Classify review-exempt paths through the paginated pull-request files API.
  • Allow fork PRs to defer non-release changes to native team review.
  • Keep immutable compare/content validation exclusively for actual automated release PRs.

Testing

  • node --test scripts/validate-review-gate.test.mjs scripts/validate-release-pr.test.mjs (19 passing tests).
  • Added regression coverage for fork PRs and non-release paths after the first 100 files.
  • Full pre-push formatting, TOML, and Rust formatting checks.

Rollout

The default-branch ruleset was restored to its original approval and required-check policy before this fix was prepared. The tokenless gate rules will not be re-enabled until this regression fix is merged and smoke-tested.

@anthonyshew
anthonyshew requested a review from a team as a code owner July 29, 2026 05:27
@anthonyshew
anthonyshew requested review from tknickman and removed request for a team July 29, 2026 05:27
@vercel

vercel Bot commented Jul 29, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-svelte-web Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
examples-vite-web Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
turbo-site Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am
turborepo-eve-agent Ready Ready Preview, Comment, Open in v0 Jul 29, 2026 5:28am

@anthonyshew
anthonyshew merged commit a3840e7 into main Jul 29, 2026
52 checks passed
@anthonyshew
anthonyshew deleted the shew/fix-review-gate-forks branch July 29, 2026 05:35
github-actions Bot added a commit that referenced this pull request Jul 29, 2026
## Release v2.10.8-canary.4

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/30483778257)

### Changes

- chore: Release Turborepo 2.10.8-canary.3 (#13512) (`56ccdde`)
- fix: Use tokenless release review gate (#13513) (`e5af40d`)
- refactor: Use resolution fingerprints for task hashes (#13514)
(`702f95a`)
- fix: Support fork PRs in review gate (#13516) (`a3840e7`)
- refactor: Migrate lockfile affectedness (#13519) (`bdbcd06`)
- refactor: Migrate external resolution summaries (#13520) (`81b24dc`)
- refactor: Migrate external package queries to resolution knowledge
(#13523) (`c9853f8`)
- fix: Serialize macOS Homebrew setup (#13549) (`33c1689`)
- refactor: Migrate prune lockfile keys to resolution identities
(#13524) (`fa0721b`)
- refactor: Migrate global hash inputs to resolution knowledge (#13525)
(`a81a683`)
- refactor: Delete legacy external-resolution PackageInfo state (#13526)
(`fbe88d3`)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew pushed a commit that referenced this pull request Jul 31, 2026
## Release v2.10.8

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/30636958913)

### Changes

- fix: Scroll TUI task list with mouse wheel (#13479) (`c6ded77`)
- fix: Make releases resumable (#13486) (`92da3c3`)
- refactor: Expose knowledge-backed package scope views (#13456)
(`2c675f4`)
- release(turborepo): 2.10.7 (#13489) (`ee50965`)
- refactor: Use package knowledge for configuration scopes (#13457)
(`75c63f4`)
- refactor: Use package knowledge for run scope enumeration (#13458)
(`f5c0eee`)
- release(turborepo): 2.10.8-canary.1 (#13490) (`5503cf7`)
- refactor: Use package knowledge in repository views (#13459)
(`ff21d9a`)
- refactor: Use package knowledge in package integrations (#13460)
(`6efcbec`)
- ci: Parallelize environment setup steps (#13491) (`db0dc90`)
- release(turborepo): 2.10.8-canary.2 (#13492) (`db71e14`)
- refactor: Use package knowledge for task hashing paths (#13461)
(`ad43f80`)
- refactor: Use package knowledge for run-cache paths (#13462)
(`95406bb`)
- refactor: Bind toolchain callbacks to package knowledge (#13463)
(`ac6c28f`)
- refactor: Use package knowledge for microfrontend commands (#13464)
(`d9b9c4b`)
- refactor: Use package knowledge for run summaries (#13465) (`e67b079`)
- refactor: Use package knowledge for watcher paths (#13466) (`947b3ad`)
- ci: Enable remote cache for types codegen (#13495) (`9b95197`)
- docs: Fix llms.txt links to page markdown routes (#13497) (`6ada90e`)
- refactor: Use package knowledge for prune paths (#13467) (`5a20113`)
- refactor: Use package knowledge in the LSP (#13468) (`b78ebff`)
- refactor: Use consistent repository construction (#13469) (`3d54f6e`)
- refactor: Delete legacy package and scope authority (#13470)
(`8318f99`)
- perf: Cache telemetry salt instead of re-reading config on every hash
(#13498) (`4df7c1d`)
- feat: Support Android (Termux) (#12735) (`1165d7c`)
- ci: Restore Cargo targets on all test platforms (#13505) (`dab0c04`)
- fix: Resolve gitdir for linked worktrees in repo index (#13503)
(`a13e724`)
- test: Characterize relationship projections (#13499) (`91c77b0`)
- refactor: Produce native relationship observations (#13500)
(`aad0c81`)
- feat: Resolve GitHub Actions remote base refs behind future flag
(#10732) (`dc17727`)
- refactor: Add core relationship projections (#13502) (`17558a8`)
- refactor: Define external resolution contracts (#13507) (`89a808d`)
- refactor: Move repository tasks into Turbo configuration (#13504)
(`72837d2`)
- refactor: Build JavaScript external resolution generations (#13508)
(`70421be`)
- refactor: Contribute Cargo external resolutions (#13509) (`396daa3`)
- refactor: Migrate external declaration consumers (#13511) (`59fd5d5`)
- ci: Auto-merge release PRs (#13510) (`6226a05`)
- chore: Release Turborepo 2.10.8-canary.3 (#13512) (`56ccdde`)
- fix: Use tokenless release review gate (#13513) (`e5af40d`)
- refactor: Use resolution fingerprints for task hashes (#13514)
(`702f95a`)
- fix: Support fork PRs in review gate (#13516) (`a3840e7`)
- refactor: Migrate lockfile affectedness (#13519) (`bdbcd06`)
- refactor: Migrate external resolution summaries (#13520) (`81b24dc`)
- refactor: Migrate external package queries to resolution knowledge
(#13523) (`c9853f8`)
- fix: Serialize macOS Homebrew setup (#13549) (`33c1689`)
- refactor: Migrate prune lockfile keys to resolution identities
(#13524) (`fa0721b`)
- refactor: Migrate global hash inputs to resolution knowledge (#13525)
(`a81a683`)
- refactor: Delete legacy external-resolution PackageInfo state (#13526)
(`fbe88d3`)
- chore: Release Turborepo 2.10.8-canary.4 (#13557) (`887d9b1`)
- refactor: Remove external declaration compatibility paths (#13527)
(`3c8448d`)
- refactor: Produce immutable native task and command knowledge (#13528)
(`18d0bc3`)
- refactor: Migrate native task registration and suggestions (#13529)
(`7b5ee63`)
- refactor: Migrate turbo-json native task synthesis (#13530)
(`2d004f0`)
- refactor: Migrate persistent and recursive task validation (#13531)
(`dd7519b`)
- refactor: Migrate native task definition precedence (#13532)
(`8792ce9`)
- refactor: Migrate engine native command planning (#13533) (`67e4e9e`)
- refactor: Migrate executor native command resolution (#13534)
(`1b8accc`)
- refactor: Migrate native task query, devtools, and LSP views (#13535)
(`2753b76`)
- refactor: Migrate command summaries and delete legacy task paths
(#13536) (`adbad50`)
- refactor: Produce immutable task-contract knowledge (#13537)
(`97bff31`)
- refactor: Migrate engine task-contract composition (#13538)
(`fab50c5`)
- refactor: Migrate hashing engines to task contracts (#13539)
(`76206f8`)
- refactor: Exclude JavaScript from toolchain task-I/O dispatch (#13540)
(`115e850`)
- refactor: Migrate change classification to immutable knowledge
(#13543) (`5a55e8d`)
- refactor: Separate prune rendering with golden coverage (#13546)
(`62a047a`)
- refactor: Delete JS format interpretation from prune orchestration
(#13554) (`f1b37f6`)
- refactor: Audit remaining JS knowledge consumer reads (#13556)
(`7f12c3f`)
- refactor: Migrate MFE dependency detection off PackageInfo (#13558)
(`4cb9d94`)
- refactor: Remove prune PackageInfo dependencies (#13562) (`1bb9233`)
- refactor: Remove residual runtime PackageInfo gates (#13564)
(`c8eaedc`)
- refactor: Migrate boundary diagnostics off PackageInfo (#13571)
(`f977db3`)
- docs: Audit Cargo package knowledge (#13572) (`53dd13e`)
- refactor: Complete Cargo relationship and resolution knowledge
(#13576) (`b29e30c`)
- refactor: Port Cargo task and contract knowledge (#13581) (`74446c5`)
- refactor: Port Cargo watch and prune knowledge (#13582) (`acd3be1`)
- refactor: Remove runtime toolchain dispatch (#13584) (`2c10201`)
- ci: Restore Cargo target for lockfile tests (#13588) (`e848ad1`)
- refactor: Replace toolchains with repository contributors (#13585)
(`5d06e95`)
- refactor: Remove Cargo contributor plumbing (#13586) (`6ea1daf`)
- refactor: Remove ToolchainId runtime dispatch (#13587) (`24fbd3e`)
- refactor: Route task behavior through contract domains (#13589)
(`da88240`)
- refactor: Route package consumers by manifest (#13591) (`bb12c72`)
- refactor: Route MFE eligibility by manifest (#13592) (`08c7a74`)
- refactor: Project manifest-derived repository facts (#13593)
(`64e2a7e`)
- refactor: Route residual task behavior by capability (#13595)
(`fe9b72d`)
- refactor: Route resolution through explicit domains (#13596)
(`be21801`)
- refactor: Route N-API package listing by manifest (#13597) (`8f44636`)
- docs: Vercel Remote Cache authentication with OIDC policies (#13140)
(`c84ed36`)
- refactor: Own resolution fingerprints in repository (#13598)
(`16708a9`)
- refactor: Fail closed on invalid relationships (#13599) (`1a237de`)
- perf: Reuse Cargo metadata discovery snapshot (#13600) (`2fa79c5`)
- refactor: Resolve MFE package ownership from graph (#13601)
(`0253836`)
- refactor: Remove retained package payloads (#13603) (`58d9660`)
- feat: Add native Cargo format task (#13606) (`ab15587`)
- refactor: Compose repository graphs for optional toolchains (#13608)
(`915e82b`)
- ci: Invalidate Cap'n Proto caches (#13616) (`5cf35ad`)
- feat: Discover uv workspaces (#13609) (`8715646`)
- feat: Run native uv tasks (#13610) (`4195e41`)
- feat: Hash uv lockfile closures (#13611) (`e14de24`)
- fix: Make Windows Cap'n Proto cache relocatable (#13621) (`00538d0`)
- feat: Watch uv workspace changes (#13612) (`b2e25d4`)
- feat: Prune uv workspaces (#13613) (`f8f288e`)
- fix: Fall back to polling on macOS (#13622) (`b3dc99b`)
- test: Add uv workspace integration coverage (#13602) (`dd87718`)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This branch was successfully deployed

1 active deployment
Preview – turborepo-eve-agent — b091d617 Deployed Jul 29, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant