code-mower 0.5.0b41__tar.gz → 0.5.0b42__tar.gz

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b41
+Version: 0.5.0b42
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b41
+pipx install --python python3.12 code-mower==0.5.0b42
 code-mower --version
 ```
 
-`0.5.0b41` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b42` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b41`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b42`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.41` from
+The current public beta is `v0.5.0-beta.42` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b41` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b42` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b41
+pipx install --python python3.12 code-mower==0.5.0b42
 code-mower --version
 ```
 
-`0.5.0b41` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b42` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -140,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b41`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b42`.
 
 ## Optional: Plan Before Coding
 
@@ -295,9 +295,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.41` from
+The current public beta is `v0.5.0-beta.42` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b41` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b42` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b41"
+version = "0.5.0b42"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b41"
+__version__ = "0.5.0b42"

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/audit_labeler_lib.py

@@ -17,12 +17,16 @@ import urllib.error
 import urllib.request
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any, Dict, Mapping, Optional, Pattern, Sequence
+from typing import Any, Callable, Dict, Mapping, Optional, Pattern, Sequence
 from urllib.parse import quote
 import re
 
 MIN_ABBREVIATED_SHA_LENGTH = 7
 AUTHOR_EXCLUSION_ENV = "CODE_MOWER_AUTHOR_EXCLUSION_JSON"
+ACTIONS_RUN_MARKER_RE = re.compile(
+    r"<!--\s*CODE_MOWER_AUDIT_RUN:\s*run_id=([0-9]+)\s*-->"
+)
+TRUSTED_ACTIONS_AUDIT_EVENTS = frozenset({"pull_request_target"})
 
 
 @dataclass(frozen=True)
@@ -291,6 +295,130 @@ def github_request_with_fallback(
     raise RuntimeError(f"no GitHub tokens available for {method} {path}")
 
 
+def parse_csv_set(raw: str) -> frozenset[str]:
+    return frozenset(item.strip() for item in raw.split(",") if item.strip())
+
+
+def parse_audit_run_id(body: str) -> str:
+    match = ACTIONS_RUN_MARKER_RE.search(body)
+    return match.group(1) if match else ""
+
+
+def workflow_path_matches(path: str, trusted_workflows: Sequence[str]) -> bool:
+    if not path:
+        return False
+    return any(path == item or path.endswith("/" + item) for item in trusted_workflows)
+
+
+def _pr_item_matches_head(
+    item: Mapping[str, Any],
+    *,
+    issue_number: int,
+    head_sha: str,
+    fallback_head_sha: str = "",
+) -> bool:
+    if str(item.get("number") or "") != str(issue_number):
+        return False
+    pr_head = str(((item.get("head") or {}).get("sha")) or "")
+    if pr_head:
+        return sha_matches(pr_head, head_sha)
+    return bool(fallback_head_sha) and sha_matches(fallback_head_sha, head_sha)
+
+
+def fetch_actions_run(
+    repo: str,
+    run_id: str,
+    *,
+    tokens: Sequence[GitHubToken],
+) -> dict[str, Any]:
+    response = github_request_with_fallback(
+        "GET",
+        f"/repos/{repo}/actions/runs/{run_id}",
+        tokens=tokens,
+    )
+    return response if isinstance(response, dict) else {}
+
+
+def fetch_pull_requests_for_commit(
+    repo: str,
+    head_sha: str,
+    *,
+    tokens: Sequence[GitHubToken],
+) -> list[dict[str, Any]]:
+    response = github_request_with_fallback(
+        "GET",
+        f"/repos/{repo}/commits/{head_sha}/pulls?per_page=100",
+        tokens=tokens,
+    )
+    return response if isinstance(response, list) else []
+
+
+def github_actions_comment_attested(
+    *,
+    repo: str,
+    body: str,
+    issue_number: int,
+    head_sha: str,
+    workflow_paths: Sequence[str],
+    tokens: Sequence[GitHubToken],
+    actions_run_lookup: Optional[Callable[[str], Mapping[str, Any]]] = None,
+    commit_pull_requests_lookup: Optional[Callable[[str], Sequence[Mapping[str, Any]]]] = None,
+) -> bool:
+    """Return whether a github-actions[bot] audit comment is tied to this PR head."""
+    trusted_workflows = tuple(parse_csv_set(",".join(workflow_paths)))
+    token_list = tuple(token for token in tokens if token.value)
+    run_id = parse_audit_run_id(body)
+    if not trusted_workflows or not token_list or not run_id or not head_sha:
+        return False
+    try:
+        if actions_run_lookup is None:
+            run = fetch_actions_run(repo, run_id, tokens=token_list)
+        else:
+            run = dict(actions_run_lookup(run_id))
+    except Exception:
+        return False
+
+    path = str(run.get("path") or "")
+    if not workflow_path_matches(path, trusted_workflows):
+        return False
+    if str(run.get("event") or "") not in TRUSTED_ACTIONS_AUDIT_EVENTS:
+        return False
+
+    run_head_sha = str(run.get("head_sha") or "")
+    pull_requests = run.get("pull_requests")
+    if isinstance(pull_requests, list) and pull_requests:
+        return any(
+            isinstance(item, Mapping)
+            and _pr_item_matches_head(
+                item,
+                issue_number=issue_number,
+                head_sha=head_sha,
+                fallback_head_sha=run_head_sha,
+            )
+            for item in pull_requests
+        )
+    if not run_head_sha or not sha_matches(run_head_sha, head_sha):
+        return False
+
+    try:
+        if commit_pull_requests_lookup is None:
+            associated_prs = fetch_pull_requests_for_commit(repo, run_head_sha, tokens=token_list)
+        else:
+            associated_prs = commit_pull_requests_lookup(run_head_sha)
+    except Exception:
+        return False
+    return any(
+        isinstance(item, Mapping)
+        and _pr_item_matches_head(
+            item,
+            issue_number=issue_number,
+            head_sha=head_sha,
+            fallback_head_sha=run_head_sha,
+        )
+        for item in associated_prs
+    )
+
+
 def fetch_pull_request(
     repo: str,
     issue_number: int,

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/claude_audit_pr.py

@@ -36,6 +36,7 @@ if __package__ in {None, "", "tools"}:
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
+            fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -61,6 +62,7 @@ if __package__ in {None, "", "tools"}:
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
+            fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -84,6 +86,7 @@ else:  # pragma: no cover - exercised after package extraction.
         fetch_base_ref_sha as _shared_fetch_base_ref_sha,
         fetch_pull_request,
         fetch_pr_head_sha as _shared_fetch_pr_head_sha,
+        fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
         limit_comment_body,
         one_line as _one_line,
         parse_repo_paths as _parse_repo_paths,
@@ -113,6 +116,7 @@ MAX_FINDING_DETAIL_CHARS = 4_000
 STALE_TRAILER = "<!-- CLAUDE_AUDIT_STATE: needs-claude-audit -->"
 DONE_TRAILER = "<!-- CLAUDE_AUDIT_STATE: claude-audit-done -->"
 BLOCKED_TRAILER = "<!-- CLAUDE_AUDIT_STATE: claude-audit-blocked -->"
+AUDIT_RUN_TRAILER_PREFIX = "<!-- CODE_MOWER_AUDIT_RUN:"
 
 
 CLAUDE_VERDICT_SCHEMA: Dict[str, Any] = {
@@ -387,7 +391,17 @@ def _fetch_base_sha_for_diff(local_repo: Path, base_ref: str) -> str:
     return _shared_fetch_base_ref_sha(local_repo, base_ref)
 
 
-def _fetch_pr_head_sha_for_diff(local_repo: Path, pr_number: int) -> str:
+def _fetch_pr_head_sha_for_diff(
+    local_repo: Path,
+    pr_number: int,
+    expected_head_sha: str | None = None,
+) -> str:
+    if expected_head_sha:
+        return _shared_fetch_pr_head_sha_unless_local_matches(
+            local_repo,
+            pr_number,
+            expected_head_sha=expected_head_sha,
+        )
     return _shared_fetch_pr_head_sha(local_repo, pr_number)
 
 
@@ -482,7 +496,11 @@ def _build_diff_context(
         )
 
     fetched_base_ref = _fetch_base_sha_for_diff(local_repo, base_ref)
-    fetched_head_ref = _fetch_pr_head_sha_for_diff(local_repo, pr_number)
+    fetched_head_ref = _fetch_pr_head_sha_for_diff(
+        local_repo,
+        pr_number,
+        expected_head_sha=expected_head_sha,
+    )
     if fetched_head_ref.lower() != expected_head_sha.lower():
         raise FetchedHeadMismatch(expected_head_sha, fetched_head_ref)
     diff_range = f"{fetched_base_ref}...{fetched_head_ref}"
@@ -705,10 +723,13 @@ def format_comment(
     stale_end_sha: Optional[str] = None,
     is_unknown: bool = False,
     merge_authority: bool = True,
+    actions_run_id: Optional[str] = None,
 ) -> str:
     posture = "merge-authority lane" if merge_authority else "informational only"
     header = f"## Claude audit ({posture})\n\n"
     header += f"Head SHA: `{head_sha}`\n"
+    if actions_run_id:
+        header += f"{AUDIT_RUN_TRAILER_PREFIX} run_id={actions_run_id} -->\n"
     if is_stale:
         body = (
             header
@@ -916,6 +937,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     pr_meta_after = fetch_pull_request(repo, pr_number, token=config.github_token)
     head_sha_end = pr_meta_after["head"]["sha"]
     is_stale = head_sha_start != head_sha_end
+    actions_run_id = os.environ.get("GITHUB_RUN_ID") or None
 
     if is_stale:
         comment_body = format_comment(
@@ -924,6 +946,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             is_stale=True,
             stale_end_sha=head_sha_end,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = "STALE"
         trailer = STALE_TRAILER
@@ -933,6 +956,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             head_sha_start,
             is_unknown=True,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = "UNKNOWN"
         trailer = STALE_TRAILER
@@ -941,6 +965,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             parsed,
             head_sha_start,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = parsed.verdict
         trailer = BLOCKED_TRAILER if parsed.verdict == "BLOCKED" else DONE_TRAILER

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b41`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b42`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/cloud.py

@@ -418,6 +418,12 @@ def main(argv: list[str] | None = None) -> int:
         default=MAX_EVENT_COUNT,
         help=f"number of verdict artifacts to include; max {MAX_EVENT_COUNT}",
     )
+    reviewer_runs.add_argument(
+        "--offset",
+        type=int,
+        default=0,
+        help="skip this many newest matching verdict artifacts before applying --limit",
+    )
     reviewer_runs.add_argument(
         "--include-git-ref",
         action="store_true",
@@ -674,6 +680,7 @@ def main(argv: list[str] | None = None) -> int:
                 team_id=args.team_id,
                 install_id=args.install_id,
                 limit=args.limit,
+                offset=args.offset,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
                 yes=args.yes,

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/cloud_client/operations.py

@@ -315,6 +315,7 @@ def reviewer_runs_upload(
     team_id: str,
     install_id: str,
     limit: int,
+    offset: int = 0,
     endpoint: str,
     token_env: str,
     yes: bool,
@@ -323,6 +324,8 @@ def reviewer_runs_upload(
 ) -> dict[str, Any]:
     if limit < 1 or limit > MAX_EVENT_COUNT:
         raise CloudBundleError(f"--limit must be between 1 and {MAX_EVENT_COUNT}")
+    if offset < 0:
+        raise CloudBundleError("--offset must be non-negative")
     repo_path = repo_path.expanduser().resolve()
     detected_repo_slug = repo_slug or detect_repo_slug(repo_path)
     if not detected_repo_slug:
@@ -336,6 +339,7 @@ def reviewer_runs_upload(
             verdicts,
             repo=detected_repo_slug,
             limit=limit,
+            offset=offset,
             include_git_ref=include_git_ref,
         )
     except ValueError as exc:
@@ -348,6 +352,7 @@ def reviewer_runs_upload(
             "event_count": 0,
             "verdicts": str(verdicts.expanduser()),
             "git_ref_included": include_git_ref,
+            "offset": offset,
         }
     export_result = build_cloud_bundle(
         reports=[],
@@ -370,6 +375,7 @@ def reviewer_runs_upload(
             "status": "doctor_failed",
             "repo_slug": detected_repo_slug,
             "event_count": len(events),
+            "offset": offset,
             "export": export_result,
             "doctor": doctor_result,
         }
@@ -380,6 +386,7 @@ def reviewer_runs_upload(
             "status": "dry_run",
             "repo_slug": detected_repo_slug,
             "event_count": len(events),
+            "offset": offset,
             "export": export_result,
             "doctor": doctor_result,
             "upload": build_dogfood_dry_run_preview(endpoint=endpoint, payload=payload),
@@ -394,6 +401,7 @@ def reviewer_runs_upload(
         "status": "uploaded",
         "repo_slug": detected_repo_slug,
         "event_count": len(events),
+        "offset": offset,
         "export": export_result,
         "doctor": doctor_result,
         "upload": post_upload_payload(

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/code_mower_telemetry.py

@@ -233,8 +233,11 @@ def export_reviewer_run_events_from_verdicts(
     *,
     repo: str = "",
     limit: int = 0,
+    offset: int = 0,
     include_git_ref: bool = False,
 ) -> list[dict[str, Any]]:
+    if offset < 0:
+        raise ValueError("offset must be non-negative")
     repo_filter = _normalize_repo_slug(repo) if repo else ""
     events: list[dict[str, Any]] = []
     for path in _iter_verdict_artifact_paths(root.expanduser()):
@@ -262,7 +265,8 @@ def export_reviewer_run_events_from_verdicts(
         key=lambda event: (str(event.get("created_at") or ""), str(event.get("event_id") or "")),
         reverse=True,
     )
-    return events[:limit] if limit else events
+    selected = events[offset:] if offset else events
+    return selected[:limit] if limit else selected
 
 
 def load_jsonl_events(path: Path) -> list[dict[str, Any]]:

{code_mower-0.5.0b41 → code_mower-0.5.0b42}/src/code_mower/codex_audit_pr.py

@@ -17,8 +17,10 @@ Pipeline per audit:
      `CODEX_AUDIT_REPO_PATHS` (the CLI requires a real git checkout for
      the built-in review).
   2. Fetch the PR head SHA via the GitHub API.
-  3. `git fetch origin pull/<N>/head` + create a temporary worktree at
-     the head SHA (detached, so we don't pollute branch namespace).
+  3. Ensure the PR head commit is locally available: skip the PR-head fetch
+     when the configured checkout already matches the GitHub API head SHA,
+     otherwise `git fetch origin pull/<N>/head`; then create a temporary
+     worktree at the head SHA (detached, so we don't pollute branch namespace).
   4. Run `codex exec --ignore-user-config --sandbox read-only review
      --base origin/main` from that worktree, capturing the final review
      prose via `--output-last-message`.
@@ -91,6 +93,7 @@ if __package__ in {None, "", "tools"}:
             fetch_pull_request,
             fetch_base_ref as _shared_fetch_base_ref,
             fetch_pr_head as _shared_fetch_pr_head,
+            fetch_pr_head_unless_local_matches as _shared_fetch_pr_head_unless_local_matches,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -113,6 +116,7 @@ if __package__ in {None, "", "tools"}:
             fetch_pull_request,
             fetch_base_ref as _shared_fetch_base_ref,
             fetch_pr_head as _shared_fetch_pr_head,
+            fetch_pr_head_unless_local_matches as _shared_fetch_pr_head_unless_local_matches,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -136,6 +140,7 @@ else:  # pragma: no cover - exercised after package extraction.
         fetch_base_ref as _shared_fetch_base_ref,
         fetch_pull_request,
         fetch_pr_head as _shared_fetch_pr_head,
+        fetch_pr_head_unless_local_matches as _shared_fetch_pr_head_unless_local_matches,
         limit_comment_body,
         one_line as _one_line,
         parse_repo_paths as _parse_repo_paths,
@@ -305,6 +310,7 @@ class ReviewContextDiagnostics:
 STALE_TRAILER = "<!-- CODEX_AUDIT_STATE: needs-codex-audit -->"
 DONE_TRAILER = "<!-- CODEX_AUDIT_STATE: codex-audit-done -->"
 BLOCKED_TRAILER = "<!-- CODEX_AUDIT_STATE: codex-audit-blocked -->"
+AUDIT_RUN_TRAILER_PREFIX = "<!-- CODE_MOWER_AUDIT_RUN:"
 
 
 # ----- Structured verdict validation -----
@@ -654,8 +660,19 @@ def _remove_worktree(local_repo: Path, worktree_path: Path) -> None:
     _shared_remove_worktree(local_repo, worktree_path)
 
 
-def _fetch_pr_head(local_repo: Path, pr_number: int) -> None:
+def _fetch_pr_head(
+    local_repo: Path,
+    pr_number: int,
+    expected_head_sha: str | None = None,
+) -> None:
     """Ensure the PR's head commit is locally available."""
+    if expected_head_sha:
+        _shared_fetch_pr_head_unless_local_matches(
+            local_repo,
+            pr_number,
+            expected_head_sha=expected_head_sha,
+        )
+        return
     _shared_fetch_pr_head(local_repo, pr_number)
 
 
@@ -1172,11 +1189,14 @@ def format_comment(
     stale_end_sha: Optional[str] = None,
     is_unknown: bool = False,
     merge_authority: bool = True,
+    actions_run_id: Optional[str] = None,
 ) -> str:
     """Build the GitHub comment body with header, prose, and trailer."""
     posture = "merge-authority lane" if merge_authority else "informational only"
     header = f"## Codex audit ({posture})\n\n"
     header += f"Head SHA: `{head_sha}`\n"
+    if actions_run_id:
+        header += f"{AUDIT_RUN_TRAILER_PREFIX} run_id={actions_run_id} -->\n"
     if is_stale:
         body = (
             header
@@ -1293,7 +1313,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
 
     # Ensure both the PR head AND the base ref are locally fetched
     # before running the review. Stale base = wrong diff = wrong review.
-    _fetch_pr_head(local_repo, pr_number)
+    _fetch_pr_head(local_repo, pr_number, head_sha_start)
     _fetch_base_ref(local_repo, config.base_ref)
     review_context_summary = "review context diagnostics unavailable"
     try:
@@ -1455,6 +1475,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
     pr_meta_after = fetch_pull_request(repo, pr_number, token=config.github_token)
     head_sha_end = pr_meta_after["head"]["sha"]
     is_stale = head_sha_start != head_sha_end
+    actions_run_id = os.environ.get("GITHUB_RUN_ID") or None
 
     if is_stale:
         comment_body = format_comment(
@@ -1463,6 +1484,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
             is_stale=True,
             stale_end_sha=head_sha_end,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = "STALE"
         trailer = STALE_TRAILER
@@ -1497,6 +1519,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
             head_sha_start,
             is_unknown=True,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = "UNKNOWN"
         trailer = STALE_TRAILER
@@ -1505,6 +1528,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
             parsed,
             head_sha_start,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = parsed.verdict
         trailer = BLOCKED_TRAILER if parsed.verdict == "BLOCKED" else DONE_TRAILER