@makerx/yoke 0.17.1 → 0.17.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +3 -1
- package/package.json +1 -1
package/dist/cli.js
CHANGED
|
@@ -7,7 +7,7 @@ import { Command } from "commander";
|
|
|
7
7
|
// package.json
|
|
8
8
|
var package_default = {
|
|
9
9
|
name: "@makerx/yoke",
|
|
10
|
-
version: "0.17.
|
|
10
|
+
version: "0.17.2",
|
|
11
11
|
description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
|
|
12
12
|
license: "MIT",
|
|
13
13
|
author: "MakerX",
|
|
@@ -1000,10 +1000,12 @@ This change adds or edits a workflow that calls \`MakerXStudio/yoke/.github/work
|
|
|
1000
1000
|
- The \`pull_request_target\` \`labeled\` trigger: a maintainer reads a fork PR's diff, then adds the \`review\` label to run its review with secrets. The reusable workflow runs the review on it only for that label on fork PRs, and refuses to review any commit pushed after the label. Its \`synchronize\` type removes the label when the fork pushes again.
|
|
1001
1001
|
- The \`actions: write\` and \`statuses: write\` permissions (or \`actions: read\` in older callers): the gate reads earlier runs to find the PR's latest review, records a fork's approved review as a commit status, and re-runs the PR head's gate.
|
|
1002
1002
|
- Draft PRs being reviewed twice: the reusable workflow already skips drafts.
|
|
1003
|
+
- Not passing \`REVIEW_CI_API_KEY\` from a caller that passes \`azure-client-id\` and \`provider: foundry\` (or a \`provider\` from a variable the diff can't show), even when an older workflow passed it: on Foundry the review signs in with the job's GitHub OIDC token and ignores \`REVIEW_CI_API_KEY\`.
|
|
1003
1004
|
|
|
1004
1005
|
Real defects in it are still findings, such as:
|
|
1005
1006
|
|
|
1006
1007
|
- Passing every secret with \`secrets: inherit\` instead of only \`REVIEW_CI_API_KEY\` (plus \`REVIEW_CI_BASE_URL\` from callers that still pass the URL as a secret).
|
|
1008
|
+
- Not passing \`REVIEW_CI_API_KEY\` from a LiteLLM caller (\`provider\` defaults to \`litellm\`), even one that passes \`azure-client-id\`, or from a Foundry caller without \`azure-client-id\`: both sign in with it.
|
|
1007
1009
|
- An input the reusable workflow does not declare.
|
|
1008
1010
|
- No \`permissions:\` block limiting the token to \`actions: write\`, \`contents: read\`, \`pull-requests: write\` and \`statuses: write\`, plus \`id-token: write\` with \`azure-client-id\`. The reusable workflow sets no permissions of its own, so the caller's block is the only limit on the token its agents run with.
|
|
1009
1011
|
`;
|