Mock change

Author: weiminyu

.github/workflows/update-dependency-reminder.yml

@@ -1,17 +1,18 @@
-name: "Remind to run update_dependency.sh"
+name: Request Lockfile Review
 
 on:
   pull_request:
     branches: ["master"]
     types: [opened, synchronize, reopened]
 
 jobs:
-  review-lockfiles:
+  # 1. This job runs safely with NO write permissions.
+  # It is perfectly safe to check out the untrusted fork code here.
+  scan-lockfiles:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      contents: read
-
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+      pr_number: ${{ github.event.pull_request.number }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -23,15 +24,46 @@ jobs:
           files: |
             **/*.lockfile
 
+      # Save the results so the privileged job can read them
+      - name: Save scan results
+        run: |
+          mkdir -p ./results
+          echo "${{ steps.changed-files.outputs.any_changed }}" > ./results/any_changed.txt
+          echo "${{ github.event.pull_request.number }}" > ./results/pr_number.txt
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: lockfile-scan-results
+          path: ./results/
+
+  # 2. This job runs sequentially, but ONLY handles the write operation.
+  # It never checks out the untrusted PR code, making it completely secure.
+  comment-lockfiles:
+    needs: scan-lockfiles
+    # Only run if the previous scan detected a lockfile change
+    if: needs.scan-lockfiles.outputs.any_changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: lockfile-scan-results
+          path: ./results
+
       - name: Post unresolved review comment
-        if: steps.changed-files.outputs.any_changed == 'true'
         uses: actions/github-script@v7
         with:
           script: |
+            const fs = require('fs');
+            const prNumber = fs.readFileSync('./results/pr_number.txt', 'utf8').trim();
+            
             github.rest.pulls.createReview({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number,
+              pull_number: parseInt(prNumber, 10),
               event: 'COMMENT',
               body: `### ⚠️ Attention Required: Lockfile Detected\nThis pull request contains modifications to one or more \`*.lockfile\` files. Please confirm that you have run update_dependency.sh to push new dependencies to the private repo.\n\n_The PR author must manually mark this conversation as resolved before merging._`
             })

.github/workflows/update-dependency-reminder.ymlname:

@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+#
 com.google.code.findbugs:jsr305:3.0.2=checkstyle
 com.google.errorprone:error_prone_annotations:2.36.0=checkstyle
 com.google.guava:failureaccess:1.0.3=checkstyle