Skip to content

Commit aad8c3d

Browse files
committed
Allowlist greenlight bot in reviewer action
- Add allowed_bots: pytorchgreenlight[bot] to the claude-code-action step - Import TARGET_REPO into dispatch.py - Name the reviewed repo (pytorch/pytorch#N) in dispatch log + error Notes: The scan dispatches greenlight-pr-review.yml as the pytorchgreenlight App bot; claude-code-action blocks bot-triggered runs unless the login is allowlisted, so the review agent was being silently skipped. Scope to our own bot rather than "*" so no other external App can trigger reviews on this public repo. The dispatch messages previously only showed the dispatch repo/ref; adding TARGET_REPO disambiguates where the workflow runs (pytorch/test-infra) from which PR it reviews (pytorch/pytorch). Signed-off-by: Jean Schmidt <contato@jschmidt.me>
1 parent 00e6ca2 commit aad8c3d

2 files changed

Lines changed: 7 additions & 3 deletions

File tree

.github/workflows/greenlight-pr-review.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,10 @@ jobs:
223223
github_token: ${{ secrets.GITHUB_TOKEN }}
224224
use_bedrock: "true"
225225
show_full_output: "true"
226+
# The scan dispatches this as the pytorchgreenlight App bot, which
227+
# claude-code-action blocks unless allowlisted. Scope to our bot only:
228+
# "*" would let any external App trigger reviews on this public repo.
229+
allowed_bots: "pytorchgreenlight[bot]"
226230
claude_args: >-
227231
--model global.anthropic.claude-opus-5
228232
--effort high

greenlight/src/greenlight/dispatch.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
from typing import TYPE_CHECKING, Protocol
1414

1515
from greenlight import constants
16-
from greenlight.constants import DEFAULT_DISPATCH_REF, DISPATCH_REPO, WORKFLOW_FILE
16+
from greenlight.constants import DEFAULT_DISPATCH_REF, DISPATCH_REPO, TARGET_REPO, WORKFLOW_FILE
1717

1818
if TYPE_CHECKING:
1919

@@ -59,6 +59,6 @@ def dispatch_review(
5959
dispatched = workflow.create_dispatch(ref, inputs=inputs, throw=True)
6060
if not dispatched:
6161
raise RuntimeError(
62-
f"workflow_dispatch for {WORKFLOW_FILE} on {DISPATCH_REPO}@{ref} (PR #{pr_number}) returned failure"
62+
f"dispatch of {WORKFLOW_FILE} ({DISPATCH_REPO}@{ref}) to review {TARGET_REPO}#{pr_number} returned failure"
6363
)
64-
logger.info("dispatched %s on %s@%s for PR #%d", WORKFLOW_FILE, DISPATCH_REPO, ref, pr_number)
64+
logger.info("dispatched %s (%s@%s) to review %s#%d", WORKFLOW_FILE, DISPATCH_REPO, ref, TARGET_REPO, pr_number)

0 commit comments

Comments
 (0)