rasterstate/fj
rasterstate/fj
Watch
8
0
Fork
You've already forked fj
 0
Code Issues 23 Pull requests Releases 7 Activity Actions

ci: add Forseti advisory review workflow #220

Merged
stephen merged 1 commit from feat/forseti-review into main 2026-07-21 01:33:39 +00:00
Conversation 0 Commits 1 Files changed 1 +64
stephen commented 2026-07-21 00:55:36 +00:00
Owner
Copy link

fj was the only repo in the rasterstate org without the Forseti advisory review workflow, so its PRs (e.g. #219) received no automated review, which violates the every-repo-Forseti rule. This adds .forgejo/workflows/forseti-review.yml, copied verbatim from fjord-platform.

The workflow is language-agnostic. It runs the prebuilt forseti-review image over the PR diff fetched from the Forgejo API as data, with no source checkout and nothing built, so it works unchanged on a Rust repo. Kept identical to the source:

  • pull_request_target trigger with the same-repo-only if guard, so fork PRs never reach the provider keys.
  • The trusted rasterstate-ops/forseti-review:stable job container.
  • The Haiku FORSETI_ANTHROPIC_MODEL cost knob and the ANTHROPIC_API_KEY / OPENAI_API_KEY provider env.

Org secrets confirmed: REGISTRY_USER, REGISTRY_TOKEN, ANTHROPIC_API_KEY, and OPENAI_API_KEY all exist as rasterstate org action secrets and resolve for fj (verified fj is owned by rasterstate; fjord-platform, same org, already runs this workflow with these secrets). fj's own repo secret list is Apple/macOS-only, so the workflow relies on org inheritance, which is in place.

After this lands on main, #219 needs a fresh push to trigger its first Forseti review. Do not close/reopen it (a close would cancel the in-flight Apple validation as collateral).

Operator-merge, no self-merge.

fj was the only repo in the rasterstate org without the Forseti advisory review workflow, so its PRs (e.g. #219) received no automated review, which violates the every-repo-Forseti rule. This adds `.forgejo/workflows/forseti-review.yml`, copied verbatim from fjord-platform. The workflow is language-agnostic. It runs the prebuilt `forseti-review` image over the PR diff fetched from the Forgejo API as data, with no source checkout and nothing built, so it works unchanged on a Rust repo. Kept identical to the source: - `pull_request_target` trigger with the same-repo-only `if` guard, so fork PRs never reach the provider keys. - The trusted `rasterstate-ops/forseti-review:stable` job container. - The Haiku `FORSETI_ANTHROPIC_MODEL` cost knob and the `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` provider env. Org secrets confirmed: `REGISTRY_USER`, `REGISTRY_TOKEN`, `ANTHROPIC_API_KEY`, and `OPENAI_API_KEY` all exist as rasterstate org action secrets and resolve for fj (verified fj is owned by `rasterstate`; fjord-platform, same org, already runs this workflow with these secrets). fj's own repo secret list is Apple/macOS-only, so the workflow relies on org inheritance, which is in place. After this lands on `main`, #219 needs a fresh push to trigger its first Forseti review. Do not close/reopen it (a close would cancel the in-flight Apple validation as collateral). Operator-merge, no self-merge.
ci: add Forseti advisory review workflow
All checks were successful
ci / check (pull_request) Successful in 10m24s
Details
ci / coverage (pull_request) Successful in 1m53s
Details
ci / live-e2e (pull_request) Successful in 2m4s
Details
b07d329f66
 
fj was the only rasterstate repo without the Forseti review workflow, so
its PRs (e.g. #219) got no automated review, violating the every-repo
Forseti rule. Copies .forgejo/workflows/forseti-review.yml verbatim from
fjord-platform.

The workflow is language-agnostic: it runs the prebuilt forseti-review
image over the PR diff fetched from the Forgejo API as data, with no
checkout or build, so it works unchanged on a Rust repo. Same-repo-only
guard, pull_request_target trigger, trusted container image, and the
Haiku FORSETI_ANTHROPIC_MODEL cost knob are kept identical. Provider keys
and registry creds resolve from rasterstate org secrets.
stephen deleted branch feat/forseti-review 2026-07-21 01:33:39 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
forseti:changes-requested
Forseti review found unaddressed findings; cleared on a clean re-review at the current head.

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
forseti:changes-requested
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rasterstate/fj!220
No description provided.