chore(ai): sync to ai-workflows@v0.2.9 - #23
Conversation
Manual sync (propagate.yml could not open a cross-repo PR — AI_WORKFLOWS_PAT is not set on lenaxia/ai-workflows). Ships PR #30: skip automation-bots in reusable pr-review.yml. Bot-authored PRs (release-please, dependabot, renovate, mergify, github-merge-queue) now skip the review workflow cleanly instead of failing with 'permission: none' before the AI can run. Also picks up the v0.2.8 TOKEN env workaround reverted (dead code — the opencode CLI handler at v1.18.16 has its own assertPermissions with no skip path; the legacy github/index.ts wrapper is not invoked when run via 'opencode github run').
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
Commit reviewed: 0238edc8c00541b997d1b1b7397865bbd3b3fd15
Summary
Trivial CI-only pin bump: advances the three caller workflow files (ai-comment.yml, issue-opened.yml, pr-review.yml) from lenaxia/ai-workflows@v0.1.2 to @v0.2.9 in both the uses: ref and the version: input. No source/prompt/semantics changes — exactly what the PR body describes.
Correctness
✓ No issues. The diff is 3 identical-shape bumps (uses: + version: in each file), all three consistent. Verified by inspecting gh pr diff 23 — every hunk is the mechanical v0.1.2 → v0.2.9 pair. No conditional logic or offset arithmetic touched.
Architecture
✓ Compliant.
- Goroutines (Rule 3): no
pkg/file touched; the diff is entirely under.github/workflows/. - Allocations (Rule 4): no decode/encode/session code touched.
- External deps (Rule 5):
go.modnot modified. - rAthena source of truth (Rules 6, 9, 12): N/A — no packet-structure claims in this PR.
- MCP / semantic DB (Rules 7, 9): N/A — no DB access.
- Type safety (Rule 8): N/A — no Go code.
- Packet-ID-agnostic API: N/A — no API surface touched.
- Synchronous contract: N/A — no library code touched.
Tests
✓ Adequate coverage — none required for a CI pin bump. There is no Go behavior to test; the workflows themselves are validated by GitHub Actions on the next triggering event. The full-repo gate (go build ./..., go test ./..., grep -r "^\s*go " pkg/) is unaffected because no Go file changed.
Missing test cases
None identified.
Robustness
✓ No concerns. The reusable workflow at v0.2.9 is referenced by immutable git tag; a malformed or missing tag would surface as a workflow-init failure on the next run, not a silent regression.
Type Safety
✓ No issues — no Go code in the diff.
Security
✓ No concerns. secrets: inherit is unchanged from prior pin. No new credentials introduced; no logging surface added. The version: v0.2.9 input flows into a second checkout of the same pinned, immutable, maintainer-owned tag.
Project Alignment
Largely aligned. Two minor observations (non-blocking nits, not request-changes-worthy):
- Header comment drift in
pr-review.yml:8— still reads# Pinned to ai-workflows v0.1.2 — bump by editing the tag below (or via propagate.yml).after the bump to v0.2.9. Worth a follow-up edit so the comment matches reality. - Redundant caller-side bot filter in
pr-review.yml:19—if: github.event.pull_request.user.login != 'renovate[bot]'is now a strict subset of the reusable workflow's v0.2.9 bot-skip list (renovate, github-actions, release-please, dependabot, mergify, github-merge-queue). Not wrong — just narrower than the upstream filter and a candidate for cleanup in a follow-up. The PR body explicitly scopes this sync to "no source/prompt changes," so leaving it for a separate chore is consistent with that scope. - Work log (Rule 0): no
docs/WORKLOG/entry added. Established repo convention (prior CI-only PRs #19, #20 also shipped without worklogs) treats workflow-only bumps as exempt; flagging for transparency rather than as a blocker. If you want strict Rule 0 enforcement, a one-lineNNNN_2026-08-11_ai-workflows-v0.2.9-sync.mdwould close the gap. - Commit format:
chore(ai): sync to ai-workflows@v0.2.9— matches conventional-commit style used elsewhere in the repo.
Style
✓ No issues. Diff is minimal and mechanical.
Verdict
APPROVE — CI-only pin bump, no library surface touched, no architectural invariants at risk. The header-comment drift and redundant renovate[bot] check are non-blocking cleanup candidates for a follow-up chore.
|
Review submitted — APPROVED on PR #23. The PR is a minimal, mechanical CI pin bump ( |
AI Assistant CommandsThe following commands are available on this issue/PR thread. Reply with one to trigger the assistant — any text after a command tunes the request (e.g.
All commands are available to repository owners, members, and collaborators. Code-change commands ( |
1 participant
Manual sync from lenaxia/ai-workflows@v0.2.9.
propagate.yml computed this bump but could not open a cross-repo PR (AI_WORKFLOWS_PAT not set). PR opened manually.
What's in v0.2.9
permission: none.Diff
Bumps the three caller workflow files (
issue-opened.yml,pr-review.yml,ai-comment.yml) from their current pin to@v0.2.9. No source/prompt changes (those are forked/consumer-owned).