diff --git a/.github/workflows/review-gate.yml b/.github/workflows/review-gate.yml deleted file mode 100644 index e38bc25..0000000 --- a/.github/workflows/review-gate.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Review Gate - -on: - pull_request_review: - types: [submitted] - -permissions: - checks: write - contents: read - -jobs: - publish-exact-head-review: - name: publish-exact-head-review - if: ${{ github.event.review.user.login == 'copilot-pull-request-reviewer[bot]' }} - runs-on: ubuntu-latest - timeout-minutes: 2 - steps: - - name: Publish exact-head review result - uses: actions/github-script@v7 - with: - script: | - const owner = context.repo.owner; - const repo = context.repo.repo; - const head = context.payload.pull_request?.head?.sha; - const reviewed = context.payload.review?.commit_id; - const exactHead = Boolean(head && reviewed && head === reviewed); - const output = { - title: exactHead - ? "Automated review matches the pull-request head" - : "Automated review is stale", - summary: exactHead - ? `Review commit ${reviewed} matches the current pull-request head.` - : `Review commit ${reviewed || "missing"} does not match pull-request head ${head || "missing"}.`, - }; - - if (!head) { - core.setFailed("The pull-request head SHA is missing from the review event."); - return; - } - - const existing = await github.rest.checks.listForRef({ - owner, - repo, - ref: head, - check_name: "exact-head-review", - filter: "latest", - per_page: 1, - }); - const check = existing.data.check_runs[0]; - if (check) { - await github.rest.checks.update({ - owner, - repo, - check_run_id: check.id, - status: "completed", - conclusion: exactHead ? "success" : "failure", - completed_at: new Date().toISOString(), - output, - }); - } else { - await github.rest.checks.create({ - owner, - repo, - name: "exact-head-review", - head_sha: head, - status: "completed", - conclusion: exactHead ? "success" : "failure", - completed_at: new Date().toISOString(), - output, - }); - } - - if (!exactHead) { - core.setFailed("The automated review does not match the current pull-request head."); - } diff --git a/docs/verification.md b/docs/verification.md index 325afbc..4cff257 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -24,6 +24,12 @@ cargo build --release --locked --manifest-path host-rs/Cargo.toml -p agenttab-ho The workspace checks TypeScript adapters, extension code, installer, OMP adapter, and package builds. The architecture gates cover manifest identity, required and optional permission behavior, RPC schemas, forbidden legacy surface, and Rust IPC framing. They do not operate a real signed-in browser. +## Pull request routing + +Pull requests that change only `README.md`, `CHANGELOG.md`, `LICENSE`, documentation files ending in `.md`, `.rst`, or `.txt` under `docs/`, or a top-level `.github/*.md` file use the lightweight CI lane. The classifier still scans added public text for credentials, private paths, session identifiers, and private hosts. Source, manifest, workflow, nested GitHub, executable documentation, mixed, empty, or ambiguous changes use the full cross-platform lane. + +Branch protection requires the stable `verify` check. The automatic review ruleset requests a fresh review after every push. Before merging, confirm that the latest automated review commit matches the current pull-request head; if the commits differ, request another review. Unresolved review threads remain merge blockers. + ## Live browser evidence Use a disposable Chrome profile and a disposable test account. Reload the unpacked extension through Chrome's extension UI, then observe the actual surface after every UI action. Exercise: