ci(verify-pr): register pull_request_target trigger on main

[mrizzi]

Problem

Since TC-6331 merged into verify-pr-fullsend, the verify-pr harness stopped dispatching entirely — PR #307 (and any PR) got zero fullsend-verify-pr.yml runs.

Root cause: TC-6331 switched the trigger from pull_request to pull_request_target. GitHub registers/dispatches pull_request_target from the workflow file on the default branch (main) — unlike pull_request, which is read from the PR's base branch. The real workflow lived only on verify-pr-fullsend; main still carried the workflow_dispatch placeholder, so GitHub saw no pull_request_target trigger and fired nothing (fork or same-repo). No pull_request_target run has ever occurred in this repo.

Fix

Replace the placeholder on main with the real workflow so the event registers. A branches: [verify-pr-fullsend] filter scopes the rollout to PRs targeting the feature branch — verify-pr does not yet review PRs into main. The base-branch copy still executes in trusted base context. Widen/remove the filter when the feature graduates to main.

After merge

• Same-repo PRs into verify-pr-fullsend (e.g. fix(verify-pr): self-exclude own workflow check-runs from CI Status #307) dispatch on push/reopen.
• Fork PRs dispatch once a maintainer applies ok-to-test (TC-6331).
• To kick fix(verify-pr): self-exclude own workflow check-runs from CI Status #307 immediately: push a commit or reopen it (a synchronize/reopened event).

🤖 Generated with Claude Code

Summary by Sourcery

Register and enable the trusted verify-pr pull request workflow on main for pull requests targeting verify-pr-fullsend.

New Features:

• Run verify-pr automatically for pull requests targeting the verify-pr-fullsend branch after required checks reach a terminal state, including maintainer-approved fork pull requests.
• Dispatch verify-pr through the reusable fullsend workflow with CI results available as review input.

Bug Fixes:

• Restore pull_request_target event registration on the default branch so verify-pr runs are dispatched for eligible pull requests.

Enhancements:

• Add concurrency control, fork safety through ok-to-test gating and label removal on new commits, and support for both successful and failed CI outcomes.

[sourcery-ai]

Reviewer's Guide

Registers the real verify-pr workflow on main so GitHub can dispatch pull_request_target events, while limiting rollout to the feature branch and safely orchestrating CI-aware, fork-gated harness runs through the reusable dispatch workflow.

Sequence diagram for the verify-pr pull_request_target dispatch

sequenceDiagram
    participant GitHub
    participant Workflow as verify-pr workflow
    participant Checks as PR checks
    participant Dispatch as reusable-dispatch.yml
    participant Harness as verify-pr harness

    GitHub->>Workflow: pull_request_target
    Workflow->>Checks: Wait for other PR checks
    Checks-->>Workflow: Terminal conclusions
    Workflow->>Workflow: Build verify-pr dispatch matrix
    Workflow->>Dispatch: Invoke reusable-dispatch.yml
    Dispatch->>Harness: Mint review token and run fullsend
    Harness-->>Dispatch: Review result

Loading

Flow diagram for fork PR approval and verify-pr execution

flowchart TD
    A["Fork PR targets verify-pr-fullsend"] --> B{"ok-to-test label applied?"}
    B -- No --> C["No verify-pr dispatch"]
    B -- Yes --> D["pull_request_target workflow runs"]
    D --> E["Wait for other PR checks"]
    E --> F["Dispatch verify-pr in base-repo context"]
    G["New fork PR commit"] --> H["Remove ok-to-test label"]
    H --> B

Loading

File-Level Changes

Change	Details	Files
Replace the main-branch workflow placeholder with a CI-aware pull-request-target harness that dispatches verify-pr after checks settle.	Register pull_request_target for opened, synchronized, reopened, and approved-label events, scoped to verify-pr-fullsend targets. Wait up to 45 minutes for all other checks, treating every terminal result as data rather than a gate. Construct the reusable-dispatch matrix from the PR event and invoke the verify-pr harness with OIDC, repository configuration, mapped Jira secrets, and pinned fullsend v0.43.0. Add concurrency cancellation so newer PR pushes supersede in-flight runs.	.github/workflows/fullsend-verify-pr.yml
Add maintainer approval gating and automatic invalidation for fork pull requests.	Allow same-repository PRs to run without a label while requiring ok-to-test for fork PRs. Remove ok-to-test on every new fork commit so changed code requires renewed maintainer approval. Grant only the workflow permissions needed for check/status reads, dispatch execution, and label management.	.github/workflows/fullsend-verify-pr.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/fullsend-verify-pr.yml" line_range="120" />
<code_context>
+        uses: lewagon/wait-on-check-action@369769072fe522a3a8a85c03c96af1e5242a1994 # v1.9.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          running-workflow-name: wait-for-checks
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
</code_context>
<issue_to_address>
**issue (bug_risk):** `wait-on-check-action` is given the job name `wait-for-checks`, but the workflow's name is `fullsend verify-pr`. The action therefore does not exclude the current workflow's check from its wait, so the check remains in progress until the 45-minute timeout and `verify-pr` never dispatches.

**Triggers:** When an eligible pull request has this workflow's check run visible on its head SHA.

**Suggested fix:** Pass the workflow name (`fullsend verify-pr`, or `${{ github.workflow }}`) if the action filters workflow names; otherwise use the action's documented input for excluding the current job/check.

```suggestion
          running-workflow-name: ${{ github.workflow }}
```
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this changes a pull_request_target trust boundary and grants a PR-triggered reusable workflow broad write permissions, OIDC access, and repository secrets; a mistake in the fork or label gating could let untrusted PR activity mint credentials or modify repository state. Reverting removes the trigger, but any credentials exposed or repository changes made before the revert would not be recoverable by it.

Blocking findings: .github/workflows/fullsend-verify-pr.yml:120

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook