fix(patch-release): derive the CM version slot from the target version #996
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude PR Review | |
| # Thin caller of the reusable in HarperFast/ai-review-prompts. The | |
| # single `uses:` ref pin below controls everything that moves | |
| # together — workflow logic, layer files, bash scripts, auth-gate | |
| # behavior. Bumping the pin is the entire upgrade motion. | |
| # | |
| # Pre-requisites (per-repo secrets): | |
| # - HARPERFAST_AI_CLIENT_ID (the App's Client ID, like Iv23li…) | |
| # - HARPERFAST_AI_APP_PRIVATE_KEY (.pem file contents) | |
| # - ANTHROPIC_API_KEY (required) | |
| # - AI_REVIEW_LOG_TOKEN (optional — if set, threads each run | |
| # into a per-PR issue in HarperFast/ai-review-log) | |
| on: | |
| pull_request: | |
| # `labeled` admits the `claude-review` opt-in gesture for bot / | |
| # untrusted-author PRs (the reusable's authorize gate admits the | |
| # labeler). See ai-review-prompts#38. | |
| types: [opened, synchronize, reopened, labeled] | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| review: | |
| # Always-on toggle — see ai-review-prompts USAGE.md "Reviewers & the | |
| # always-on toggle". CLAUDE_ALWAYS_ON=true (repo/org variable) → auto- | |
| # review trusted-author PRs; unset → opt-in via the claude-review | |
| # label. The reusable's authorize job still owns WHO is admitted. | |
| # Note: the `claude-review` label name is matched there too — | |
| # `_claude-review.yml`'s authorize `if:`, not in this caller. | |
| if: ${{ vars.CLAUDE_ALWAYS_ON == 'true' || github.event.action == 'labeled' }} | |
| uses: HarperFast/ai-review-prompts/.github/workflows/_claude-review.yml@82c9484f6f2560be4a37032858311e429bccd56c # main 2026-07-21 (#73 severity-deflation + fail-closed calibration, #74 caller hygiene; on 9cf49d2 = #70 + #71) | |
| # Caller-side permissions at the calling-job level (NOT workflow- | |
| # level — that placement caps the reusable's per-job grants below | |
| # what they need and breaks the workflow at startup; see | |
| # ai-review-prompts#39/#40). Union of what the reusable's authorize | |
| # (`contents: read`) and review (`contents: read` + `pull-requests: | |
| # write` + `id-token: write`) jobs declare. Without this block the | |
| # grants are inherited from the repo's default-workflow-permissions | |
| # setting instead (GitHub intersects the reusable's requests with | |
| # the caller's ceiling — un-grantable scopes are silently dropped, | |
| # and `pull-requests: write` survives only while the repo default | |
| # is "write"). Explicit grants keep the caller independent of that | |
| # setting, and match gemini-review.yml in this repo. | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| id-token: write | |
| with: | |
| # Same SHA as the `uses:` ref above. The reusable uses this to | |
| # check out HarperFast/ai-review-prompts (layer files + bash | |
| # scripts) at the same ref as the workflow logic itself. | |
| # | |
| # The duplication is unavoidable: reusable workflows can't | |
| # introspect their own ref (`github.workflow_ref` resolves to | |
| # the CALLER's ref in `workflow_call` context), and `uses: …@<ref>` | |
| # is parsed literally so we can't interpolate a variable. | |
| ai-review-prompts-ref: 82c9484f6f2560be4a37032858311e429bccd56c | |
| review-layers: | | |
| universal | |
| harper/common | |
| harper/v5 | |
| repo-specific-checks: | | |
| ## Repo-specific checks (Harper Pro) | |
| Harper Pro is the proprietary layer on top of Harper core | |
| (HarperFast/harper). Code here may add or modify Pro-only | |
| resources/APIs and pull from Harper core internals. | |
| - **Linter is oxlint, not eslint.** `npm run lint` runs | |
| oxlint with `--deny-warnings`. Advice in layers that | |
| references ESLint doesn't apply. | |
| - **Documentation scope.** Harper docs at | |
| https://docs.harperdb.io are authoritative for Harper | |
| mechanics. Pro-side docs should describe Pro-only | |
| surface, not re-explain core behavior. | |
| - **Storage.** Same substrate as Harper core — RocksDB | |
| primary, LMDB available via `HARPER_STORAGE_ENGINE=lmdb`. | |
| - **Tests.** No unit-test split — `npm run test:integration` | |
| is the test surface. Use it judiciously; integration | |
| tests are slow. | |
| secrets: | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| AI_REVIEW_LOG_TOKEN: ${{ secrets.AI_REVIEW_LOG_TOKEN }} | |
| HARPERFAST_AI_CLIENT_ID: ${{ secrets.HARPERFAST_AI_CLIENT_ID }} | |
| HARPERFAST_AI_APP_PRIVATE_KEY: ${{ secrets.HARPERFAST_AI_APP_PRIVATE_KEY }} |