ghreview 3.0.24 → 3.0.26

package/.github/workflows/depsound.yml

@@ -1,14 +1,33 @@
-# Computes dependency evidence with a read-only token; depsound-post handles
-# the write side without exposing it to PR code.
+# Copy into .github/workflows/ of the repo you want reviewed. One workflow,
+# two jobs: review computes with a read-only token, post holds the write
+# scopes. The README explains the security model.
+#
+# pull_request_target runs the base branch's workflow definition and action
+# pin (a PR cannot modify what executes here), and its token can post the
+# comment, including on Dependabot and fork PRs whose own token is read-only.
+# It is safe here because no PR code is ever checked out or executed: the
+# review job reads the PR's manifest bytes as git objects, and depsound's
+# parsers treat all of it as hostile data.
 name: depsound
 on:
-  pull_request:
+  pull_request_target:
 
-permissions:
-  contents: read # checkout + diff the PR's manifests; no write, never posts
+permissions: {} # scopes are granted per job below
 
 jobs:
   review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # diff the PR's manifests; this job never sees a write token
     steps:
-      - uses: rvagg/depsound-action@cae3f58d212f5761ae6ea256acb15441ec5dcd6a # v0.2.2
+      - uses: rvagg/depsound-action@ba0a7a165d7b4f72671e0453612fbcfbd328bd2e # v0.3.2
+  post:
+    needs: review
+    if: ${{ always() && needs.review.result != 'cancelled' }} # a failed review still posts its failure marker
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # upsert the sticky comment
+      checks: write        # set the neutral check
+      actions: read        # download the report artifact
+    steps:
+      - uses: rvagg/depsound-action/post@ba0a7a165d7b4f72671e0453612fbcfbd328bd2e # v0.3.2

package/.github/workflows/test-and-release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Use Node.js ${{ matrix.node }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -34,7 +34,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Setup Node.js

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [3.0.26](https://github.com/rvagg/ghreview/compare/v3.0.25...v3.0.26) (2026-07-27)
+
+## [3.0.25](https://github.com/rvagg/ghreview/compare/v3.0.24...v3.0.25) (2026-07-21)
+
 ## [3.0.24](https://github.com/rvagg/ghreview/compare/v3.0.23...v3.0.24) (2026-07-20)
 
 ## [3.0.23](https://github.com/rvagg/ghreview/compare/v3.0.22...v3.0.23) (2026-07-18)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghreview",
-  "version": "3.0.24",
+  "version": "3.0.26",
   "description": "GitHub PR-based code review workflow for AI-assisted development",
   "type": "module",
   "main": "lib/index.js",

package/.github/workflows/depsound-post.yml

@@ -1,19 +0,0 @@
-# Posts the report artifact without checking out or running PR code with its
-# write token.
-name: depsound-post
-on:
-  workflow_run:
-    workflows: [depsound]
-    types: [completed]
-
-permissions:
-  pull-requests: write # upsert the sticky comment
-  checks: write        # set the neutral check
-  actions: read        # download the report artifact from the compute run
-
-jobs:
-  post:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.event == 'pull_request' }}
-    steps:
-      - uses: rvagg/depsound-action/post@cae3f58d212f5761ae6ea256acb15441ec5dcd6a # v0.2.2