fix: pr-build-zip uses explicit secrets instead of inherit - #1412
Conversation
Add @tg-autopilot review comment trigger for Copilot review
…ew-on-comment Add Copilot review on comment
…iew-on-comment Add PR review automation
Same root cause as themegrill/user-registration-pro#1542: this repo actually lives in themegrill (transferred from wpeverest), but this file still used secrets: inherit from before that was discovered. inherit cannot reliably cross the wpeverest/.github <-> themegrill org boundary.
|
Build for ⬇️ Download user-registration-5.2.7.zip (8.1M) Installs directly via Plugins → Add New → Upload Plugin. |
There was a problem hiding this comment.
🟡 Changes recommended
It introduces a new workflow not reflected in the PR’s stated scope and uses a mutable reusable-workflow ref that should be pinned for safety.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates GitHub Actions workflows to address cross-organization reusable-workflow secret passing, and introduces a reusable workflow hook to request Copilot reviews via PR events/comments.
Changes:
- Replaces
secrets: inheritwith explicit secret mappings for thepr-build-zipreusable workflow call. - Adds a new
copilot-review-on-commentworkflow that calls the shared reusable workflow inwpeverest/.githuband passesBOT_TOKEN.
File summaries
| File | Description |
|---|---|
.github/workflows/pr-build-zip.yml |
Switches from inherited secrets to explicit BOT_TOKEN/artifact credential mappings for the reusable ZIP-build workflow. |
.github/workflows/copilot-review-on-comment.yml |
Adds a workflow that triggers on PR open / comment creation and calls the shared Copilot review reusable workflow with BOT_TOKEN. |
Review details
Suppressed comments (1)
.github/workflows/copilot-review-on-comment.yml:11
- Using a mutable ref (
@master) for a reusable workflow can change behavior without any change in this repo (supply-chain / unexpected breakage). Prefer pinning to a specific commit SHA (or a version tag) and updating intentionally when needed.
uses: wpeverest/.github/.github/workflows/copilot-review-on-comment.yml@master
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| name: Copilot review on comment | ||
|
|
||
| on: | ||
| pull_request_target: | ||
| types: [opened] | ||
| issue_comment: | ||
| types: [created] |
Same root cause as themegrill/user-registration-pro#1542: this repo actually lives in
themegrill(transferred fromwpeverest), but this file still usedsecrets: inheritfrom before that was discovered.Confirmed failing for real (3 recent runs, all
Secret BOT_TOKEN is required, but not provided while calling) -- switches to naming every secret explicitly, same as every other themegrill repo.