svm-rs/.github/workflows/cyclops-audit.yml at master · alloy-rs/svm-rs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: Cyclops audit

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened, ready_for_review]
  pull_request_target: # zizmor: ignore[dangerous-triggers] Audits conflicting same-repo pushes without checking out PR code.
    types: [opened, synchronize, reopened, ready_for_review]
  issue_comment:
    types: [created]

permissions: {}

jobs:
  audit:
    if: >-
      contains(fromJSON('["pull_request","pull_request_target"]'), github.event_name) &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      (
        github.event.action != 'labeled' ||
        github.event.label.name == 'cyclops' ||
        github.event.label.name == 'agentic-audit'
      )
    permissions:
      id-token: write
      contents: read
      pull-requests: read
      statuses: write
    uses: tempoxyz/gh-actions/.github/workflows/pr-audit.yml@252d87d9636b94551796b4b8a5cb4e27b8916cf6 # 2026-10-12T22-06-06Z-252d87d9
    with:
      required-labels: |
        cyclops
        agentic-audit
      audit-on-push: true
      audit-on-command: true
    secrets:
      EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
      EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
      EVENTS_ARGS: ${{ secrets.EVENTS_ARGS }}

  audit-comment:
    if: >-
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      (
        startsWith(github.event.comment.body, 'cyclops audit') ||
        startsWith(github.event.comment.body, '@decofe cyclops audit') ||
        startsWith(github.event.comment.body, 'derek audit')
      )
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      issues: write
      pull-requests: write
    steps:
      - name: Secure runner
        uses: tempoxyz/gh-actions/actions/secure-runner@252d87d9636b94551796b4b8a5cb4e27b8916cf6 # 2026-10-12T22-06-06Z-252d87d9
      - uses: tempoxyz/gh-actions/actions/pr-audit-comment@252d87d9636b94551796b4b8a5cb4e27b8916cf6 # 2026-10-12T22-06-06Z-252d87d9
        with:
          command-regex: '^(?:@decofe\s+)?(?:cyclops\s+audit|derek\s+audit)\b'
          permission-check-mode: association
          organization: mablr
          events-key: ${{ secrets.EVENTS_KEY }}
          events-cert: ${{ secrets.EVENTS_CERT }}
          events-args: ${{ secrets.EVENTS_ARGS }}
          github-token: ${{ github.token }}