(2.15) [IMPROVED] MQTT: Pipeline inbound QoS1 PUBLISH JetStream stores #2982
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code | |
| # GITHUB_TOKEN needs contents:read and actions:read — required by | |
| # claude-code-action for restoring trusted config files from the base branch. | |
| # All other GitHub API access uses the App token. | |
| permissions: | |
| contents: read | |
| actions: read | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| pull_request_target: | |
| types: [opened, reopened] | |
| jobs: | |
| claude: | |
| name: Claude Review | |
| uses: synadia-io/ai-workflows/.github/workflows/claude.yml@v2 | |
| if: contains( | |
| fromJson('["OWNER","MEMBER","COLLABORATOR"]'), | |
| github.event.comment.author_association || github.event.pull_request.author_association | |
| ) | |
| with: | |
| gh_app_id: ${{ vars.CLAUDE_GH_APP_ID }} | |
| checkout_mode: "base" | |
| # review_focus is used only by the auto-review job (pull_request_target), not the | |
| # interactive @claude job — so the check below only needs github.event.pull_request, | |
| # which pull_request_target populates. On issue_comment events that field is absent, | |
| # so this evaluates to startsWith(null, 'backports/') -> false; harmless, since the | |
| # interactive job ignores review_focus. Can't be fixed in-expression: issue_comment | |
| # payloads carry no head ref at all. | |
| review_focus: | | |
| ${{ startsWith(github.event.pull_request.head.ref, 'backports/') && ' | |
| This is a BACKPORT / RELEASE pull request. Every cherry-picked commit | |
| originates from a PR that was already independently reviewed and approved | |
| on the source branch. Do NOT re-review the individual code changes and do | |
| NOT comment on the implementation of cherry-picked hunks — assume they are | |
| correct. | |
| Instead, focus exclusively on: | |
| - Cherry-pick completeness. Inspect the PRs/commits included in this | |
| backport. For each source PR, check its milestone, labels, and target | |
| branch to decide whether it belongs in this release line. Flag any PR | |
| that targets this release but is MISSING here, and any included PR that | |
| does not belong. | |
| - Non-clean picks. Call out commits that appear to have been modified | |
| during the cherry-pick (conflict resolution, adapted context) — those | |
| are the only changes that warrant a closer look. | |
| - Release overview. Produce a concise summary of what this release ships, | |
| grouped by area (JetStream, Raft/NRG, leafnodes, security, etc.), so | |
| reviewers can sanity-check the scope at a glance. | |
| ' || ' | |
| Additionally focus on: | |
| - Performance implications (hot paths, allocations, lock contention) | |
| - Concurrency safety (goroutine leaks, race conditions, deadlocks) | |
| - Raft consensus and JetStream clustering correctness | |
| - Security boundaries (authentication, authorization, TLS handling) | |
| ' }} | |
| secrets: | |
| claude_oauth_token: ${{ secrets.CLAUDE_OAUTH_TOKEN }} | |
| gh_app_private_key: ${{ secrets.CLAUDE_GH_APP_PRIVATE_KEY }} |