ci: use pull_request_target to fix token permissions#1407
Merged
TinyKitten merged 4 commits intodevfrom Mar 5, 2026
Merged
Conversation
…ation" The pull_request trigger gives GITHUB_TOKEN read-only permissions in certain contexts (fork PRs, restrictive repo/org settings), causing peter-evans/create-or-update-comment and gh api DELETE calls to fail. Switch both verify_data_Integrity.yml and visualize_stopping_patterns.yml to pull_request_target, which runs with the base repo's token permissions. Explicitly checkout the PR head SHA so the correct code is validated. https://claude.ai/code/session_01Lr3k5y8UYcH26a8hndo8ek
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthrough2つの既存ワークフローからPRコメントの直接操作を除き、検証結果／可視化出力を一時アーティファクトに保存してアップロードするよう変更。コメントの作成・更新・削除は新規の workflow_run トリガーのワークフローへ分離された（アーティファクトをダウンロードしてコメント操作を行う）。 Changes
Sequence Diagram(s)sequenceDiagram
participant VerifyWF as Verify Data Integrity WF
participant ArtifactStore as GitHub Artifacts
participant CommentWF as verify_data_integrity_comment.yml
participant GitHubPR as GitHub PR
Note over VerifyWF,ArtifactStore: (1) 実行中に検証結果を /tmp/validation-artifacts に保存
VerifyWF->>ArtifactStore: Upload validation-artifacts (pr_number,result,report)
Note over ArtifactStore,CommentWF: (2) Verify WF 完了で workflow_run がトリガー
CommentWF->>ArtifactStore: Download validation-artifacts
CommentWF->>GitHubPR: Find existing bot comment
alt result == failure
CommentWF->>GitHubPR: Create or update comment with validation_report.md
else result == success
CommentWF->>GitHubPR: Delete existing bot comment (if present)
end
sequenceDiagram
participant VisualizeWF as Visualize Stopping Patterns WF
participant ArtifactStore2 as GitHub Artifacts
participant CommentWF2 as visualize_stopping_patterns_comment.yml
participant GitHubPR2 as GitHub PR
Note over VisualizeWF,ArtifactStore2: (1) 実行中に has_changes と visualization_comment.md を保存
VisualizeWF->>ArtifactStore2: Upload visualization-result (pr_number,has_changes,comment)
Note over ArtifactStore2,CommentWF2: (2) Visualize WF 完了で workflow_run がトリガー
CommentWF2->>ArtifactStore2: Download visualization-result
CommentWF2->>GitHubPR2: Find existing bot comment
alt has_changes == true
CommentWF2->>GitHubPR2: Create or update comment with visualization_comment.md
else has_changes == false
CommentWF2->>GitHubPR2: Delete existing bot comment (if present)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 分 Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/verify_data_Integrity.yml:
- Line 3: The workflow uses the pull_request_target trigger while checking out
the PR head SHA and running cargo run, which lets untrusted PR code execute with
the workflow's write permissions; fix this by separating the validation job from
any job that needs repository write permissions or by changing the checkout to
use the base branch (not PR head) for the execution step: replace the checkout
of PR head SHA with actions/checkout@v3 configured to fetch and use
github.event.pull_request.base.sha (or switch the workflow trigger to
pull_request so head runs in the PR context), and ensure any job that writes
comments or needs pull-requests: write permission runs in a separate job with
limited permissions rather than allowing the validation job to run with write
access.
In @.github/workflows/visualize_stopping_patterns.yml:
- Line 4: The workflow uses pull_request_target while checking out the PR
author’s code (ref: ${{ github.event.pull_request.head.sha }}) and grants
high-scope permissions (pull-requests: write, issues: write), creating a
code-execution escalation path; fix by ensuring the workflow running under
pull_request_target only checks out the base repo (use ref: ${{
github.event.pull_request.base.sha }} or default checkout with
repository_dispatch) or switch the trigger to pull_request if you must run PR
code, and remove or narrow permissions (revoke pull-requests: write and issues:
write or scope them to least privilege); alternatively split into two
workflows—one pull_request_target for trusted ops that only uses base code and
one pull_request with reduced permissions for running untrusted PR code after
explicit review.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5a8a9db8-0f89-4e8c-993d-d68bafc847ef
📒 Files selected for processing (2)
.github/workflows/verify_data_Integrity.yml.github/workflows/visualize_stopping_patterns.yml
Both verify_data_Integrity.yml and visualize_stopping_patterns.yml used pull_request_target while checking out and executing untrusted PR code (cargo run, python3) with write permissions — a known code-execution escalation path. Fix by splitting each into two workflows: - Runner workflow: triggered by pull_request (read-only token), executes untrusted PR code, uploads results as artifacts - Comment workflow: triggered by workflow_run (write permissions), only downloads trusted artifact data and manages PR comments This ensures untrusted code never runs with elevated permissions. https://claude.ai/code/session_01Lr3k5y8UYcH26a8hndo8ek
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/verify_data_integrity_comment.yml:
- Around line 8-10: ワークフローのパーミッション設定に `actions: read`
が欠けているため、`actions/download-artifact@v4` が `run-id: ${{
github.event.workflow_run.id }}`
を使って別実行からアーティファクトを取得する際に失敗します。.github/workflows/verify_data_integrity_comment.yml
の permissions セクション（現在の `pull-requests` と `issues` 行を含むブロック）に `actions: read`
を追加して、GitHub トークンがアーティファクト読み取り権限を持つようにしてください（参照箇所: the permissions block and the
usage of actions/download-artifact with run-id）。
In @.github/workflows/visualize_stopping_patterns_comment.yml:
- Around line 8-10: permissions セクションで actions: read 権限が欠けているため、run-id
を使って別実行のアーティファクトを取得する「Download artifacts」ステップが失敗する可能性があります。修正方法は permissions
ブロックに actions: read を追加して読み取り権限を付与すること（既存の pull-requests: write / issues: write
はそのまま維持）、これにより run-id を使ったアーティファクト取得（Download artifacts ステップ）で必要な権限が確保されます。
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ef63b33b-52a9-424d-a238-0984397ee731
📒 Files selected for processing (4)
.github/workflows/verify_data_Integrity.yml.github/workflows/verify_data_integrity_comment.yml.github/workflows/visualize_stopping_patterns.yml.github/workflows/visualize_stopping_patterns_comment.yml
actions/download-artifact@v4 with run-id requires actions: read to access artifacts from the triggering workflow run. https://claude.ai/code/session_01Lr3k5y8UYcH26a8hndo8ek
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/visualize_stopping_patterns_comment.yml (1)
27-31: メタデータファイルが存在しない場合のエラーハンドリングを検討してください。アーティファクトのダウンロードは成功しても、ファイルの内容が空や予期しない形式の場合、後続ステップで不明瞭なエラーが発生する可能性があります。
ファイル存在確認を追加する例
- name: Read metadata id: meta run: | + if [[ ! -f /tmp/visualize-artifacts/pr_number ]] || [[ ! -f /tmp/visualize-artifacts/has_changes ]]; then + echo "Required artifact files not found" + exit 1 + fi echo "pr_number=$(cat /tmp/visualize-artifacts/pr_number)" >> "$GITHUB_OUTPUT" echo "has_changes=$(cat /tmp/visualize-artifacts/has_changes)" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/visualize_stopping_patterns_comment.yml around lines 27 - 31, In the "Read metadata" step (id: meta) add explicit checks for the metadata files (/tmp/visualize-artifacts/pr_number and /tmp/visualize-artifacts/has_changes): verify each file exists and is non-empty and that its contents match the expected format before echoing to GITHUB_OUTPUT; if a file is missing/empty/invalid, either set a sensible default (e.g., pr_number="" or has_changes="false") and log a clear warning, or exit the step with an explicit error message so downstream steps fail fast and provide actionable diagnostics.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/verify_data_integrity_comment.yml:
- Around line 30-31: 現在の実装はアーティファクトを読み取ってPR番号を出力しているため信頼できるイベントコンテキストを使っていません;
/tmp/validation-artifacts/pr_number を参照する echo 行を削除して、代わりにイベントペイロードの公式コンテキスト
github.event.workflow_run.pull_requests[0].number を使って GITHUB_OUTPUT に pr_number
を設定するよう修正してください（例: echo "pr_number=${{
github.event.workflow_run.pull_requests[0].number }}" >> "$GITHUB_OUTPUT"
と同様に出力）。同様の修正をもう一つのワークフローでも（visualize_stopping_patterns_comment の該当する echo
行を）適用してください。
In @.github/workflows/visualize_stopping_patterns_comment.yml:
- Line 17: The current workflow conditional only checks
github.event.workflow_run.event == 'pull_request' so it triggers on failed runs
too; update the if condition to also require the triggering workflow's
conclusion be 'success' (e.g., change the conditional that contains
"github.event.workflow_run.event == 'pull_request'" to include
"github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'pull_request'") so the job only runs when
the source workflow completed successfully.
---
Nitpick comments:
In @.github/workflows/visualize_stopping_patterns_comment.yml:
- Around line 27-31: In the "Read metadata" step (id: meta) add explicit checks
for the metadata files (/tmp/visualize-artifacts/pr_number and
/tmp/visualize-artifacts/has_changes): verify each file exists and is non-empty
and that its contents match the expected format before echoing to GITHUB_OUTPUT;
if a file is missing/empty/invalid, either set a sensible default (e.g.,
pr_number="" or has_changes="false") and log a clear warning, or exit the step
with an explicit error message so downstream steps fail fast and provide
actionable diagnostics.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f00d4e44-bced-4703-80b2-81aae234a7ab
📒 Files selected for processing (2)
.github/workflows/verify_data_integrity_comment.yml.github/workflows/visualize_stopping_patterns_comment.yml
- Use github.event.workflow_run.pull_requests[0].number instead of reading PR number from artifact files (avoids trusting artifact data) - Add conclusion == 'success' gate to visualization comment workflow so it only posts when the source workflow succeeded - Add existence/non-empty checks for metadata files with clear error messages or safe defaults https://claude.ai/code/session_01Lr3k5y8UYcH26a8hndo8ek
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
verify_data_Integrity.ymlとvisualize_stopping_patterns.ymlのトリガーをpull_request→pull_request_targetに変更refパラメータを追加if条件のevent_nameチェックをpull_request_targetに更新背景
pull_requestトリガーではGITHUB_TOKENが読み取り専用になるケースがあり、peter-evans/create-or-update-commentやgh api DELETEでRequestError [HttpError]: Resource not accessible by integrationエラーが発生していました。pull_request_targetはベースリポジトリの権限で実行されるため、PRコメントへの書き込みが可能になります。Test plan
Verify station data integrityワークフローがPRコメントを投稿できることを確認Visualize Stopping Patternsワークフローが正常にコメントを投稿/削除できることを確認Resource not accessible by integrationエラーが発生しないことを確認https://claude.ai/code/session_01Lr3k5y8UYcH26a8hndo8ek
Summary by CodeRabbit