Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
A --review-with pass is supposed to report findings and let the orchestrator apply them, but every reviewer was launched with full write access (--dangerously-skip-permissions / --sandbox danger-full-access / bypassPermissions) and the "do not touch the working tree" contract existed only as a sentence in $LOCAL_PROMPT. A reviewer that decides to fix things itself silently rewrites the caller's uncommitted work, and the loop never notices: it computes NEW_COMMITS/UNCOMMITTED, documents that they "should be zero" in review-only mode, and then never checks them. codex: the review-only invocation moves to --sandbox read-only, which makes the contract unbypassable at the OS level. The claim it replaces — that danger-full-access is required or "codex review produces no usable findings" — is empirically wrong: `codex --sandbox read-only review --base <ref>` reads the diff, tracked-file list, commit graph and base tree and returns normal severity-tagged findings, while a write inside the repo fails with `operation not permitted`. enhance-loop.md already ran codex read-only for exactly this reason, so this makes the two loops consistent rather than introducing a new idea. The reviewer-applies path keeps danger-full-access, which it needs. claude/agy/grok have no read-only mode, so they get a backstop instead: step 1 snapshots HEAD, the index, tracked content and untracked files (the same four artifacts enhance-loop.md uses, since a porcelain count alone misses an edit to an already-dirty tracked file or to a pre-existing untracked file), and the review-only branch of step 3 compares them, restores wholesale on violation, and warns. Unlike enhance-loop it KEEPS the findings — a reviewer's product is its findings list, which stays useful even when it wrongly applied them too, whereas an enhancer's product is the text it returns. The prompt line gains the reason rather than more emphasis: edits will be reverted, so applying a fix saves nothing and destroys in-progress state.
…ons/setup-node-7 chore(deps): bump actions/setup-node from 6 to 7
Enforce the review-only contract instead of only asking for it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patch release. No
feat:or breaking commits since v3.24.0 — the changes are a behavior hardening in the review loop plus a CI action bump.Code review — review-only reviewers can no longer quietly rewrite your working tree
A
--review-withpass is supposed to report findings and let the orchestrator apply them, but every reviewer was launched with full write access and the "don't touch the tree" contract existed only as a line in the prompt. A reviewer that decided to fix things itself would silently overwrite uncommitted work.--sandbox read-only, making the contract OS-enforced. Verified: read-only review still reads the diff, tracked-file list, commit graph and base tree and returns normal severity-tagged findings, while a write in the repo fails withoperation not permitted.lib/enhance-loop.mdalready used this posture, so the two loops are now consistent. The reviewer-applies path keepsdanger-full-access, which it needs.Dependencies
actions/setup-node6 → 7 (Dependabot, chore(deps): bump actions/setup-node from 6 to 7 #124).Test plan
npm test— 173 pass, 0 failsetup-node@v7already ran green on PR Enforce the review-only contract instead of only asking for it #125's CI (validateon Node 18/20/22 +shellcheck)Known risk:
release.yml'ssetup-node@v7step (which setsregistry-urlfor the npm publish) has not executed under v7 yet — onlyci.ymlhas. If npm auth regresses, the publish step is where it will show. Watching the release run.