fix: allow agents to clear orphaned execution locks #10079
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: commitperclip PR Review | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| # Always runs from base branch context — never executes PR code. | |
| # pull_request_target gives access to secrets for untrusted fork PRs. | |
| permissions: | |
| pull-requests: write | |
| security-events: write | |
| checks: write | |
| contents: read | |
| jobs: | |
| review: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout base branch (never PR code) | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: master | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| base-ref: ${{ github.event.pull_request.base.sha }} | |
| head-ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Set up Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '20' | |
| - name: Generate commitperclip token | |
| id: token | |
| run: | | |
| TOKEN=$(node .github/scripts/get-bot-token.mjs) | |
| echo "::add-mask::$TOKEN" | |
| echo "value=$TOKEN" >> $GITHUB_OUTPUT | |
| env: | |
| COMMITPERCLIP_KEY: ${{ secrets.COMMITPERCLIP_KEY }} | |
| - name: Run quality gates | |
| id: quality | |
| if: github.event.pull_request.user.login != 'dependabot[bot]' | |
| run: node .github/scripts/run-quality-gates.mjs | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ steps.token.outputs.value }} | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| PR_BRANCH: ${{ github.event.pull_request.head.ref }} | |
| - name: Run security gates | |
| run: node .github/scripts/check-pr-security.mjs | |
| continue-on-error: true | |
| timeout-minutes: 3 | |
| env: | |
| GH_TOKEN: ${{ steps.token.outputs.value }} | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| - name: Fail if quality gates failed | |
| if: >- | |
| github.event.pull_request.user.login != 'dependabot[bot]' && | |
| steps.quality.outcome == 'failure' | |
| run: | | |
| echo "One or more quality gates failed. See commitperclip comment on the PR for details." | |
| exit 1 |