Add verifyPeerReview.yml feature workflow by roryabraham · Pull Request #80 · Expensify/GitHub-Actions

roryabraham · 2026-07-03T03:49:53Z

Details

Adds verifyPeerReview.yml with the pull_request_target-only architecture from Expensify#636197:

Uses pull_request_target for all repos (org rulesets + GitHub-Actions) — workflow YAML and scripts run from main only
Never checks out the PR's repo; uses the GitHub API for PR metadata and GitHub-Actions@main for scripts
Removes pull_request and pull_request_review (secrets unavailable on fork PRs; pull_request_review unsupported by rulesets)
checkoutRepoAndGitHubActions is not used — it would checkout the client repo, which is unsafe on pull_request_target
Re-runs after review: follow-up PHP webhook work will retry the existing ruleset check run on the PR (not workflow_dispatch, which would not clear the required check)

The verify script remains a no-op skeleton. README documents the security model, trigger matrix, and mermaid flow diagram.

Related Issues

https://github.com/Expensify/Expensify/issues/636197

Manual Tests

Post-merge (ruleset Evaluate mode):

Merge this PR to main.
Enable the ruleset (pull_request_target) in Evaluate mode on App-Test-Fork.
Open or sync a PR in App-Test-Fork; confirm the check passes, secrets work, and no client repo is checked out.
Open or sync a PR in App-Test-Fork from yet another fork. Confirm the check passes, secrets work, and no client repo is checked out.
Open a PR in GitHub-Actions (including a workflow-edit PR); confirm the check runs the main workflow version, not the PR head.

Wires up the org-level ruleset workflow (GitHub App token generation, cross-repo checkout, npm ci, npm run verify-peer-review) extracted verbatim from #64, so the App permissions/secrets/checkout plumbing can be validated end-to-end (e.g. via a ruleset's Evaluate mode) before real peer-review logic lands. The script it invokes is still the Phase 1 no-op skeleton, so this check always passes for now. Also adds the first verifyPeerReview.yml README section, since Phase 1 landed with no README changes. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Remove duplicated workflow YAML and verbose no-op explanation; the workflow file itself is the source of truth. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Use pull_request_target everywhere with GitHub-Actions@main checkout only, add workflow_dispatch for webhook re-runs, and document the security model. Co-authored-by: Cursor <cursoragent@cursor.com>

Re-runs after review will retry the existing ruleset check via PHP webhook follow-up, not a separate workflow_dispatch run. Co-authored-by: Cursor <cursoragent@cursor.com>

Drop mermaid diagram, trigger table, security notes, and rollout steps. Keep a short purpose and ruleset configuration summary. Co-authored-by: Cursor <cursoragent@cursor.com>

Pass PR metadata through env and quote shell args so branch names with metacharacters cannot inject commands in pull_request_target. Co-authored-by: Cursor <cursoragent@cursor.com>

chatgpt-codex-connector · 2026-07-06T21:50:54Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 7f79a76c0e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

rafecolton · 2026-07-07T01:52:42Z

+      - name: Checkout GitHub-Actions
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          repository: Expensify/GitHub-Actions
+          path: GitHub-Actions


Is this still safe if the PR is against the GH actions repo?

yes, I think so. Because it uses the pull_request_target trigger, the version of the workflow in the PR base will run. The default checkout will also use the ref from the PR base.

Co-authored-by: Rafe Colton <1058475+rafecolton@users.noreply.github.com>

grgia

question

grgia

LGTM

roryabraham · 2026-07-08T20:09:57Z

going to merge since @rafecolton previously approved and his comments were addressed

melvin-bot Bot assigned roryabraham Jul 3, 2026

Bump actions/setup-node to v6.4.0 to match rest of repo

31ffec5

Co-authored-by: Cursor <cursoragent@cursor.com>

roryabraham changed the title ~~Add verifyPeerReview.yml feature workflow (Phase 2e of #64 split, still no-op)~~ Add verifyPeerReview.yml feature workflow Jul 3, 2026

roryabraham and others added 4 commits July 3, 2026 00:59

Trim verifyPeerReview README to minimal description

8d01608

Remove duplicated workflow YAML and verbose no-op explanation; the workflow file itself is the source of truth. Co-authored-by: Cursor <cursoragent@cursor.com>

Remove verifyPeerReview-specific ruleset rollout note

b6798e1

Co-authored-by: Cursor <cursoragent@cursor.com>

Merge branch 'main' into rory-peer-review-02e-workflow

7b56944

Run oxfmt

f1bb7cb

roryabraham requested review from grgia and rafecolton July 3, 2026 08:08

roryabraham marked this pull request as ready for review July 3, 2026 08:08

This comment was marked as resolved.

Sign in to view

This comment was marked as outdated.

Sign in to view

roryabraham marked this pull request as draft July 4, 2026 06:38

Update verifyPeerReview workflow per #636197 design

428c110

Use pull_request_target everywhere with GitHub-Actions@main checkout only, add workflow_dispatch for webhook re-runs, and document the security model. Co-authored-by: Cursor <cursoragent@cursor.com>

roryabraham marked this pull request as ready for review July 5, 2026 01:59

This comment was marked as resolved.

Sign in to view

roryabraham marked this pull request as draft July 5, 2026 02:13

roryabraham and others added 3 commits July 4, 2026 19:15

Remove workflow_dispatch from verifyPeerReview

be5c834

Re-runs after review will retry the existing ruleset check via PHP webhook follow-up, not a separate workflow_dispatch run. Co-authored-by: Cursor <cursoragent@cursor.com>

Simplify comments

6e6026e

Simplify verifyPeerReview README entry

2621e11

Drop mermaid diagram, trigger table, security notes, and rollout steps. Keep a short purpose and ruleset configuration summary. Co-authored-by: Cursor <cursoragent@cursor.com>

roryabraham marked this pull request as ready for review July 6, 2026 19:59

This comment was marked as resolved.

Sign in to view

roryabraham mentioned this pull request Jul 6, 2026

Add independent peer review validation workflow #64

Draft

This comment was marked as resolved.

Sign in to view

Quote verify-peer-review CLI args via env vars

7f79a76

Pass PR metadata through env and quote shell args so branch names with metacharacters cannot inject commands in pull_request_target. Co-authored-by: Cursor <cursoragent@cursor.com>

This comment was marked as resolved.

Sign in to view

rafecolton previously approved these changes Jul 7, 2026

View reviewed changes

Update .github/workflows/verifyPeerReview.yml

a65c84c

Co-authored-by: Rafe Colton <1058475+rafecolton@users.noreply.github.com>

roryabraham dismissed rafecolton’s stale review via a65c84c July 8, 2026 18:27

roryabraham and others added 3 commits July 8, 2026 11:27

Update .github/workflows/verifyPeerReview.yml

fc7073f

Co-authored-by: Rafe Colton <1058475+rafecolton@users.noreply.github.com>

Get rid of overly-verbose env

07ea077

Drop redundant comment

f076089

This comment was marked as resolved.

Sign in to view

Use single quotes to prevent bash injection

06ba5d2

grgia reviewed Jul 8, 2026

View reviewed changes

Comment thread .github/workflows/verifyPeerReview.yml Outdated

grgia reviewed Jul 8, 2026

View reviewed changes

Fix broken quoting

bc612f2

grgia approved these changes Jul 8, 2026

View reviewed changes

roryabraham merged commit 1ddd838 into main Jul 8, 2026
5 checks passed

roryabraham deleted the rory-peer-review-02e-workflow branch July 8, 2026 20:10

Uh oh!

Conversation

roryabraham commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Related Issues

Manual Tests

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as outdated.

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

chatgpt-codex-connector Bot commented Jul 6, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rafecolton Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

roryabraham Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

grgia left a comment

Choose a reason for hiding this comment

Uh oh!

grgia left a comment

Choose a reason for hiding this comment

Uh oh!

roryabraham commented Jul 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

roryabraham commented Jul 3, 2026 •

edited

Loading