A pull request is reviewed

# Every pull request from a branch of this repository, opened by someone with write access or by the
# repository's own app, is reviewed for bugs and for security each time it's opened or pushed to,
# and each review is posted as a check on its head commit, beside CI. Two fresh Claude sessions read
# the patch against main, with main's REVIEW.md and prompts, never the branch's. A review that finds
# nothing passes, and one with an Important finding fails, so the change takes a fix, or the
# maintainer's deliberate bypass, to merge. One with only Nits or Pre-existing faults is neutral. A
# pull request from a fork gets no review, and neither does one opened by anyone else, since the
# sessions hold the maintainer's login token and read the pull request's description.
awml: "0.8"
title: A pull request is reviewed
description: |
  Replaced by [chrismdp/ci-a-commit](https://awml.io/chrismdp/ci-a-commit), where the bug and
  security reviews now run as jobs of CI, on the commit as pushed. This is the factory's earlier
  design, kept for its history.
scopes:
  - { id: public, label: "public: anyone who reads the repository", processing: any }
parts:
  - { id: pushed, kind: trigger, label: "A pull request from a branch of this repository, opened by someone with write access or by the app, is opened or pushed to", wait: PT1H }
  - { id: token, kind: connector, label: "The repository, through its own Actions token", in: public, ref: chrismdp/issue-to-pull-request#token }
  - { id: bring, kind: code, op: bring-in, label: "Bring in the pull request's patch against main, and main's REVIEW.md and review prompts", in: public }
  - { id: patch, kind: context, label: "The patch, with the pull request's title and description", in: public }
  - { id: repo, kind: context, label: "The spec, guide, code, AGENTS.md and REVIEW.md, from main", in: public }
  - { id: review, kind: ai, op: check, label: "Review the patch for bugs, with fresh context, keeping only the findings that survive a second look", in: public }
  - { id: secreview, kind: ai, op: check, label: "Review the patch for security, in a separate session, alongside the bug review", in: public }
  - { id: post, kind: code, op: do, label: "Once both reviews are done, post each as a check on the head commit: passed if it found nothing, failed if it found something Important, neutral if only Nits or Pre-existing faults, with its findings ranked", in: public }
  - { id: checks, kind: outside, label: "Post the Bug review and Security review checks: Allow", in: public }
  - { id: forks, kind: comment, label: "A fork's pull request, or one opened by anyone without write access, starts nothing here: its author could steer the sessions, which hold the maintainer's login token" }
  - { id: ownfiles, kind: comment, label: "A patch that touches Claude Code's own settings, .claude/, .mcp.json or a CLAUDE.md, is refused before any session starts, and no session loads settings or servers from the tree" }
  - { id: notoken, kind: comment, label: "Findings that carry anything like the login token are refused, never uploaded or posted" }
  - { id: mains, kind: comment, label: "The reviews read the patch as data and follow main's prompts and REVIEW.md, so a branch can't rewrite what it's held to" }
  - { id: neutral, kind: comment, label: "An Important finding fails its check, so the change takes a fix, or the maintainer's deliberate bypass, to merge. Nits and Pre-existing faults only mark it neutral" }
lines:
  - { from: pushed, to: bring, kind: start, label: "the pull request" }
  - { from: token, to: bring, kind: data, label: "the patch and main's files" }
  - { from: bring, to: patch, kind: data }
  - { from: bring, to: review, kind: start }
  - { from: bring, to: secreview, kind: start }
  - { from: patch, to: review, kind: data }
  - { from: repo, to: review, kind: data }
  - { from: patch, to: secreview, kind: data }
  - { from: repo, to: secreview, kind: data }
  - { from: review, to: post, kind: start, label: "its findings" }
  - { from: secreview, to: post, kind: start, label: "its findings" }
  - { from: post, to: checks, kind: data }
  - { from: checks, to: token, kind: data }
  - { from: forks, to: pushed, kind: tie }
  - { from: mains, to: bring, kind: tie }
  - { from: neutral, to: post, kind: tie }
  - { from: ownfiles, to: bring, kind: tie }
  - { from: notoken, to: post, kind: tie }
implementations:
  actions:
    label: "GitHub Actions, review.yml"
    blocks:
      - { id: github, label: "GitHub: pull requests and checks", parts: [pushed, token, patch, repo, checks] }
      - { id: reviewjob, label: "Actions job: review, with a token that only reads", platform: actions-code, parts: [bring] }
      - { id: reviewagent, label: "Claude Code, claude-opus-5-5, a fresh session for each review", platform: actions-agent, in: reviewjob, parts: [review, secreview] }
      - { id: postjob, label: "Actions job: post the checks, with a token that may only write checks, running nothing from the branch", platform: actions-code, parts: [post] }
    comments:
      - { id: scrub, label: "Each session keeps the login token from the commands it runs (awml #121)", in: reviewagent, ties: [review, secreview] }