summaryrefslogtreecommitdiff
path: root/.github/workflows
AgeCommit message (Collapse)Author
2026-06-04ci(sponsor-triage): select PullRequest id in search resultshathach
The search drops is:issue to include PRs, but the GraphQL selection only had '... on Issue { id }', so PR nodes returned no id and were skipped. Add '... on PullRequest { id }'. (Codex/Copilot review finding.) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-04ci(sponsor-triage): include open PRs, not just issueshathach
Drop the is:issue qualifier so sponsor pull requests are synced to the board too (search type ISSUE already returns both). A sponsor's open PR is exactly the kind of work to prioritize reviewing. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-04ci: add Sponsor Triage board sync workflowhathach
Cron (6h) + manual workflow that adds open issues opened by GitHub sponsors (public and private) and Adafruit org members across the adafruit org and the maintainer's repos to the private Sponsor Triage project board, setting Tier and Visibility. Logs counts only to avoid leaking private sponsor logins. Needs the SPONSOR_TOKEN PAT secret. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-04ci(labeler): add sponsor/Adafruit tiers, owner skip, and discussion supporthathach
- rename priority labels usage to Prio / Prio Top - label Adafruit members (Adafruit + Sponsor + Prio Top) and public GitHub sponsors by tier; contributors get Prio - skip sponsor/Adafruit perks for the maintainer's own issues/PRs - support discussions via the GraphQL addLabelsToLabelable mutation Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-03ci(claude): post sticky summary comment on code reviewhathach
The review workflow posted nothing when a review found no issues: with use_sticky_comment unset, the only output path was inline comments, so a clean review surfaced no comment at all on the PR. Enable use_sticky_comment so a single summary comment is posted/ updated every run, making "no issues found" results visible. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-03ci: allow claude[bot] pushes in code review workflowhathach
Add allowed_bots: 'claude' so that when claude[bot] pushes commits the workflow skips gracefully instead of erroring. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-02ci(claude): drop Bash allowlist entirely (Codex P1, round 2)hathach
Codex correctly noted that allowing python3/python (and really cmake/make too) is arbitrary code + network execution: a command allowlist cannot contain a prompt-injected or malicious fork PR when this job holds the OAuth secret + write token, and the review workflow directs fork PRs to @claude. The Bash allowlist was beyond the original scope (auto-commit/PR) anyway. Remove it: Claude edits files and the action commits/opens the PR, and the resulting commit is verified by the existing CircleCI matrix. Keep use_commit_signing and --max-turns 30. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-02ci(claude): scope Bash allowlist instead of wide-open (Codex P1)hathach
Codex flagged that @claude can be summoned on a fork PR (the review workflow even directs fork PRs here), so the checked-out PR content is potentially attacker-controlled. Unrestricted Bash in this write-token + OAuth-secret job let prompt injection steer Claude into arbitrary shell/network commands. Scope Bash to the repo's actual verification commands (cmake, ninja, make, ctest, python/python3, pre-commit, clang-format, codespell, git). This blocks the injection-to-arbitrary-command path while still letting Claude build/test before committing. Building fork code itself is already done by the existing CircleCI, so that surface is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-02ci(claude): enable @claude to fix bugs and commit from commentshathach
Configure the @claude summon workflow so it can actually produce a verified fix when asked in an issue/PR comment: - use_commit_signing: bot commits show as Verified - --allowedTools Bash: lets Claude build/test to verify the fix before committing (default allowlist blocks Bash). Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR. - --max-turns 30: enough turns to investigate -> fix -> verify Auto-commit/PR is already built into claude-code-action and the required write permissions were already present, so no permission changes are needed. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-02ci: address second codex/copilot review roundhathach
- claude.yml: drop the issues "assigned" trigger; its author_association gate keys on the issue author, not the assigner, so a maintainer assigning an outside contributor's issue would be wrongly skipped. - claude-code-review.yml: issues: read -> write so use_sticky_comment can create/update its PR comment via the issues API. - hil SKILL.md: make local/remote command blocks copy-pasteable (drop [-b BOARD_NAME] notation for concrete examples) and fix timeout (600000 ms is 10 min; use 1200000 ms for the stated 20 min). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-02ci: address codex/copilot review on claude workflowshathach
- claude.yml: gate @claude on author_association (OWNER/MEMBER/COLLABORATOR) so the write-scoped token and OAuth secret are never issued for an untrusted commenter on this public repo (defense-in-depth). - claude-code-review.yml: skip fork PRs in the job condition (head.repo.full_name == github.repository) since forks get no secrets and would only fail noisily; fix the misleading token comment; pass additional_permissions: actions: read so actions: read is effective. - hil SKILL.md: reword hostname guidance, use full test/hil/* paths, and show an explicit CONFIG= assignment so the local command is runnable. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-01ci: re-enable Claude PR review and harden auth/permissionshathach
- claude-code-review.yml: re-enable (drop `if: false`); switch from pull_request_target to pull_request so fork PRs never receive the OAuth token (avoids prompt-injection token leak). Auto-review on open/synchronize/reopen/ready_for_review, skip drafts, sticky comment. - claude.yml: grant contents/pull-requests/issues write so @claude can reply and push fixes; @claude is the on-demand path for fork PRs.
2026-05-12support map filesMichael Rogov Papernov
2026-05-05try to fix CI stuckZixun LI
Co-authored-by: Copilot <[email protected]> Signed-off-by: Zixun LI <[email protected]>
2026-04-29clean uphathach
2026-04-26change job nameHiFiPhile
Co-authored-by: Copilot <[email protected]> Signed-off-by: HiFiPhile <[email protected]>
2026-04-26run hil_hfp on gcc buildHiFiPhile
Co-authored-by: Copilot <[email protected]> Signed-off-by: HiFiPhile <[email protected]>
2026-03-31dont cancel build on merge to masterMichael Rogov Papernov
2026-03-18Update several actions to latest versionhathach
2026-03-14update rx65n_target: correct pin configuration and remove unused USB ↵hathach
interrupt definitions
2026-03-14migrate kinetis_k32l build system to new mcux-devices pathshathach
2026-03-13add ft9xx-gcc toolchain support to CIhathach
2026-03-13rename and migrate kinetis_k32l to new mcux-deviceshathach
2026-03-12download metrics in case hil failedhathach
2026-03-12chore(workflows): update GitHub Actions dependencies and improve membrowse ↵hathach
error handling update AGENTS.md with metrics compare
2026-03-12also update metrics.json for prhathach
2026-03-10fix secret issue in membrowse-commentMichael Rogov Papernov
2026-03-10set new membrowse comment github workflow with comment messageMichael Rogov Papernov
2026-03-07update hil test: remove unused ctypes, add fallback for skip boardshathach
2026-03-05ci: fix claude-code-review for fork PRshathach
Switch pull_request to pull_request_target so secrets and OIDC tokens are available when reviewing PRs from forks. Also add pull-requests: write permission so the action can post review comments. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
2026-03-04fix trailing newline in workflow files to pass pre-commithathach
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
2026-03-04"Claude Code Review workflow"Ha Thach
2026-03-04"Claude PR Assistant workflow"Ha Thach
2026-02-12change membrowse target to board/target and remove redundant ↵hathach
continue-on-error directive fix defsym can be followed by = or ,
2026-02-12refactor build scripts to support multiple build targets and improve ↵hathach
argument handling
2026-02-12clean uphathach
2026-02-12fix cihathach
2026-02-12membrowse upload continue on errorhathach
2026-02-11make membrowse command more visiblehathach
2026-02-11correct membrowse upload stephathach
2026-02-11add build target argument to improve flexibility of build scripts and workflowshathach
membrowse-upload upload with --identical if elf file does not exist
2026-02-11fetch depth 0 if membrowse-uploadhathach
2026-02-11remove `membrowse-targets.json` as it is no longer requiredhathach
2026-02-111 family per job in ci_set_matrix.pyhathach
2026-02-10add membrowse-upload target and use it in ci after buildhathach
2026-02-10Merge pull request #3437 from hathach/copilot/improve-build-steps-rp2040-esp32Ha Thach
doc update
2026-02-10update matrix buildhathach
2026-02-09Update membrowse job to run on all pushes for commit chain trackingcopilot-swe-agent[bot]
Co-authored-by: hathach <[email protected]>
2026-02-07Update .github/workflows/build.ymlHa Thach
Co-authored-by: Copilot <[email protected]>
2026-02-07add back check-path job to path filter, make sure workflow always run to ↵hathach
register commit chain with membrowse
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-29 21:39:42 +0000