Skip to content

Security-Review gibt frei oder verlangt Änderungen #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Musiker15 merged 1 commit into from
Oct 10, 2026
Merged

Security-Review gibt frei oder verlangt Änderungen #32

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions .github/workflows/security-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,10 @@ name: Security-Review
# for the same reason: workflow and prompt are always of the same commit.
#
# Claude Code reviews the head of the pull request and gives its report as its
# last answer. A second job, which the agent never sees, posts the report and
# sets the commit status PR-Security-Review on that head; pull_request_target
# last answer. A second job, which the agent never sees, posts the report as a
# review (changes requested with findings, approved without, and for a pull
# request from outside never more than a comment) and sets the commit status
# PR-Security-Review on that head; pull_request_target
# attaches the checks of its jobs to the base branch, so a status on the head
# is the one result both triggers can give.
#
Expand Down Expand Up @@ -562,12 +564,25 @@ jobs:
printf '\n\n(Gekürzt; der volle Bericht liegt am Lauf.)\n\nREVIEW_COMPLETE\n' >> body.short.md
mv body.short.md body.md
fi
jq -n --arg sha "$SHA" --rawfile body body.md '{commit_id: $sha, event: "COMMENT", body: $body}' > review.json
# Like the reviewer before it: changes requested where the report
# found something or is unclear, approved where it found nothing.
# A pull request from outside is never approved by this review: a
# model judged text that can be written to steer it, and an approval
# is what such text would aim for. It gets a comment instead.
if [ "$result" != "clean" ]; then
event=REQUEST_CHANGES
elif [ "$TRUSTED" = "true" ]; then
event=APPROVE
else
event=COMMENT
fi
jq -n --arg sha "$SHA" --arg event "$event" --rawfile body body.md \
'{commit_id: $sha, event: $event, body: $body}' > review.json
review_url="$(gh api --method POST "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews" --input review.json --jq .html_url)"

case "$result" in
clean) set_status success "Keine Befunde." "$review_url" ;;
findings) set_status failure "Befunde, siehe Review am PR." "$review_url" ;;
*) set_status failure "Ergebnis nicht eindeutig, Review am PR lesen." "$review_url" ;;
esac
echo "Review gepostet: $review_url ($result)"
echo "Review gepostet: $review_url ($result, $event)"
Loading