From c6671b269e3a033932c4a96e96a21df15f9d501a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Feb 2026 17:10:27 +0000 Subject: [PATCH 1/4] Initial plan From cf67e9d743129f72c143c2d27798387d0bbf06d4 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Feb 2026 17:12:00 +0000 Subject: [PATCH 2/4] fix(ci): improve cleanup workflow resilience and fork compatibility - Switch from pull_request to pull_request_target for fork compatibility - Use fetch-depth: 0 to get full history - Add git pull --rebase before push to handle concurrent merges - Soften startup hook reference to clarify it's configurable Co-authored-by: jstirnaman <212227+jstirnaman@users.noreply.github.com> --- .claude/commands/plan.md | 2 +- .github/workflows/cleanup-ephemeral-docs.yml | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.claude/commands/plan.md b/.claude/commands/plan.md index 49cd96e22b..d99da4d905 100644 --- a/.claude/commands/plan.md +++ b/.claude/commands/plan.md @@ -181,4 +181,4 @@ Agent: Updated PLAN.md: - PLAN.md is ephemeral - delete before merging to main - Use `/finish` skill to properly cleanup and merge - Tasks use standard markdown checkbox format: `- [ ]` and `- [x]` -- The startup hook auto-injects PLAN.md at session start +- A startup hook can be configured to auto-inject PLAN.md at session start diff --git a/.github/workflows/cleanup-ephemeral-docs.yml b/.github/workflows/cleanup-ephemeral-docs.yml index f2b7503146..efb360671e 100644 --- a/.github/workflows/cleanup-ephemeral-docs.yml +++ b/.github/workflows/cleanup-ephemeral-docs.yml @@ -20,7 +20,7 @@ name: Cleanup ephemeral docs on: - pull_request: + pull_request_target: types: [closed] branches: - master @@ -40,7 +40,7 @@ jobs: uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.base.ref }} - fetch-depth: 1 + fetch-depth: 0 - name: Check for ephemeral files id: check @@ -72,6 +72,9 @@ jobs: git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" + # Pull latest changes to avoid non-fast-forward errors + git pull --rebase origin ${{ github.event.pull_request.base.ref }} + # Remove files git rm -f ${{ steps.check.outputs.files }} From 8c68aae6b320b2e2dd38a30ce1c95cbc54a67023 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Feb 2026 17:13:18 +0000 Subject: [PATCH 3/4] fix(ci): add error handling and security documentation - Add fallback to regular merge if rebase fails due to conflicts - Document security considerations for pull_request_target usage - Clarify why this workflow is safe for fork PRs Co-authored-by: jstirnaman <212227+jstirnaman@users.noreply.github.com> --- .github/workflows/cleanup-ephemeral-docs.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cleanup-ephemeral-docs.yml b/.github/workflows/cleanup-ephemeral-docs.yml index efb360671e..46b086c536 100644 --- a/.github/workflows/cleanup-ephemeral-docs.yml +++ b/.github/workflows/cleanup-ephemeral-docs.yml @@ -12,6 +12,12 @@ # These files are tracked on feature branches but should be deleted before # merge. If they slip through, this action cleans them up. # +# Security Note: Uses pull_request_target to ensure write permissions for +# PRs from forks. This is safe because: +# 1. The workflow only checks out the base branch (not PR code) +# 2. File paths are validated (hardcoded list of allowed files) +# 3. No PR-controlled code is executed +# # To use in your repo: # 1. Copy this file to .github/workflows/cleanup-ephemeral-docs.yml # 2. Update the 'branches' list to match your main branch (master or main) @@ -73,7 +79,12 @@ jobs: git config user.email "github-actions[bot]@users.noreply.github.com" # Pull latest changes to avoid non-fast-forward errors - git pull --rebase origin ${{ github.event.pull_request.base.ref }} + # If rebase fails due to conflicts, fall back to regular merge + if ! git pull --rebase origin ${{ github.event.pull_request.base.ref }}; then + echo "Rebase failed, falling back to merge" + git rebase --abort + git pull origin ${{ github.event.pull_request.base.ref }} + fi # Remove files git rm -f ${{ steps.check.outputs.files }} From 3f3bf6f352b7d1cabf1e39da5094704ba1106f26 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Feb 2026 17:13:56 +0000 Subject: [PATCH 4/4] fix(ci): make merge strategy explicit in fallback Use --no-rebase --no-edit flags to ensure merge doesn't prompt for editor Co-authored-by: jstirnaman <212227+jstirnaman@users.noreply.github.com> --- .github/workflows/cleanup-ephemeral-docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cleanup-ephemeral-docs.yml b/.github/workflows/cleanup-ephemeral-docs.yml index 46b086c536..58f0176412 100644 --- a/.github/workflows/cleanup-ephemeral-docs.yml +++ b/.github/workflows/cleanup-ephemeral-docs.yml @@ -83,7 +83,7 @@ jobs: if ! git pull --rebase origin ${{ github.event.pull_request.base.ref }}; then echo "Rebase failed, falling back to merge" git rebase --abort - git pull origin ${{ github.event.pull_request.base.ref }} + git pull --no-rebase --no-edit origin ${{ github.event.pull_request.base.ref }} fi # Remove files