vyos-documentation.git/.github/workflows/ai-validation.yml, branch test/ai-validation-e2e-v1.1.0

ci: bump AI-validation reviewer pin to reviewer-v1.1.0

2026-11-01T18:02:11+00:00

reviewer-v1.1.0 carries the Opus 5.5 batch fixes, the pass-1 resolver rework, and MyST extraction from a CommonMark token stream (lists, blockquotes and HTML comments handled correctly). Without this bump the per-PR review keeps running the v1.0.4 pass-1 code. 🤖 Generated by [robots](https://vyos.io)

ci: pin claude-code-action to v1.0.266 for Opus 5.5 support

2026-11-01T10:25:45+00:00

v1.0.119 installs Claude Code 2.1.138, which predates claude-opus-5-5 (added in Claude Code 2.1.280). v1.0.266 installs 2.1.316. The inputs this workflow passes are unchanged between the two releases. 🤖 Generated by [robots](https://vyos.io)

ci: bump AI-validation reviewer model to claude-opus-5-5

2026-11-01T09:16:48+00:00

Move the Pass 2 review in ai-validation.yml from claude-opus-4-7 to claude-opus-5-5, matching the reference copy in VyOS-Networks/vyos-docs-opus-reviewer. 🤖 Generated by [robots](https://vyos.io)

ci: T9208: bump AI-validation reviewer pin to v1.0.4 for scutum branch map (#2201)

2026-08-14T15:05:10+00:00

🤖 Generated by [robots](https://vyos.io)

ci: bump REVIEWER_REF to reviewer-v1.0.3 (rolling branch-map fix) (#2182)

2026-08-03T16:57:30+00:00

The reviewer-v1.0.2 tag ships a branches.json that maps docs branch 'rolling' to vyos-1x branch 'current'. The vyos-networks/vyos-1x mirror renamed 'current' to 'rolling', so the 'Checkout vyos-1x at mapped branch' step fails on every rolling-based PR (first observed run 30565684480, PR #2177). reviewer-v1.0.3 carries the corrected mapping (rolling -> rolling) plus CI/docs-only changes; no reviewer Python source changes between the two tags. 🤖 Generated by [robots](https://vyos.io)

T8960: ai-validation — mint vyos-bot token via get-token@production

2026-06-03T00:32:24+00:00

Swap the cross-repo-checkout token from the dedicated vyos-docs-reviewer App (VYOS_APP_ID/_PRIVATE_KEY) to the shared vyos-bot App via the fleet get-token composite, scoped contents:read. Skip-check now gates on APP_CLIENT_ID + APP_PRIVATE_KEY + ANTHROPIC_API_KEY (org-level vyos-bot creds); reword the stale token comment. PR-comment posting still uses the default GITHUB_TOKEN. Byte-identical to the paired reference copy in VyOS-Networks/vyos-docs-opus-reviewer (scripts/ai-validation.yml). 🤖 Generated by [robots](https://vyos.io)

ci(ai-validation): allow Pass 2 review on external-contributor PRs

2026-05-29T09:15:36+00:00

The upstream `anthropics/claude-code-action` performs a write-permission check on `github.actor` before our skip logic runs. On `pull_request_target` the actor is the PR author; external contributors resolve to `read` and the action exits 1 with `Actor does not have write permissions to the repository`. Net effect: AI validation has been failing on every external-contributor PR (LiudmylaNad, teslazonda, scottlaird in the last 4 weeks) while succeeding on maintainer PRs. Failure reproduced on run 26541079685 (PR #2061). Fix: set `allowed_non_write_users: '*'` on the Pass 2 step. The action bypasses the actor check when this input is set and `github_token` is provided (already the case). The action also auto-scrubs Anthropic / cloud / GHA secrets from subprocess envs when this input is set. Safe in THIS workflow because the existing defense-in-depth bounds what Pass 2 can do with untrusted PR content: - `allowedTools` restricted to inline-comment + read-only surfaces - `github_token` is the PR-scoped default (not the broader VYOS_APP_ID) - prompt marks PR content as untrusted via `` - workspace-wipe removes `CLAUDE.md` / `.claude/` before Pass 2 - prepare bundles MD via `git show HEAD:` (blob, not `cp`) Full rationale inlined as a comment block above the new input. 🤖 Generated by [robots](https://vyos.io)

ci(ai-validation): skip prepare on Mergify-authored PRs

2026-05-14T06:27:19+00:00

Lifts the existing Mergify-author short-circuit (today inside validate's `secrets-check` step) to a job-level `if:` on `prepare`, so the whole pipeline skips for backport/queue PRs. Why now: every Mergify backport whose merge ref shares no shallow ancestor with the (advanced) base branch fails the prepare step at git diff "$BASE...HEAD" --name-only ... fatal: FETCH_HEAD...HEAD: no merge base (because base is `git fetch --no-tags --depth=1` and the merge ref is `fetch-depth: 2`). Proximate symptom: run 25842928620 on PR #2042 (sagitta backport of #2023). AI Validation isn't a required check so the queue isn't blocked, but every Mergify backport is left with a red "prepare" check that adds noise to PR review. The validate-level skip in commit 0e8a2956 was correct for the "claude-code-action rejects bot-initiated runs" failure mode but fires too late — prepare has already run and crashed before validate's `if: needs.prepare.outputs.has_md_changes == 'true'` even evaluates. Implementation: single job-level `if:` on prepare. validate's `needs: [prepare]` cascades the skip naturally (skipped needs make the dependent's expression-based `if:` evaluate against empty outputs). The in-step author check in validate stays as defense-in-depth. 🤖 Generated by [robots](https://vyos.io)

ci(ai-validation): skip validation on Mergify-authored PRs

2026-05-13T22:16:59+00:00

The upstream anthropics/claude-code-action rejects bot-initiated workflow runs with: Workflow initiated by non-human actor: mergify (type: Bot). Add bot to allowed_bots list or use '*' to allow all bots. This leaves a failing required check on every Mergify backport PR (#2025 today is the proximate symptom — circinus backport of #2016 is blocked from auto-merging by this). Per org policy, Mergify-authored PRs skip the bot-review flow entirely: the underlying change was already reviewed on the source PR. Re-running validation on the backport would also post duplicate findings. Fix: extend the existing `secrets-check` step (kept the id for backwards compat with the cascade of `if: steps.secrets-check.outputs.skip != 'true'` gates) to also short-circuit when `github.event.pull_request.user.login` equals `mergify[bot]`. Add a `skip_reason` output so the notify-on-PR step can distinguish bot-skip (silent) from missing-secrets (post a notice comment). Implementation notes: - PR author is bound through env: PR_AUTHOR (same pattern as secret bindings) so the template-expansion happens before bash sees the value as an already-quoted env variable. - Uses `printf '...%s\n' "$PR_AUTHOR"` for the notice line so the shell — not the YAML template engine — interpolates the author into the workflow log output. - Renamed step name to "Decide whether to skip validation" to reflect the broader scope; step id stays `secrets-check`. 🤖 Generated by [robots](https://vyos.io)

ci(ai-validation): stop retargeting origin to fork URL

2026-05-12T06:20:17+00:00

The previous CR-driven fix (7a7a8002) re-pointed origin to the PR's HEAD fork on the assumption that claude-code-action calls `git fetch origin `. That assumption is wrong for fork PRs: the action detects a fork PR and fetches `pull//head` instead, and those refs only exist on the base repo. Retargeting origin to the fork therefore breaks the fork-PR fetch path with: PR # is from a fork, fetching via refs/pull//head... fatal: couldn't find remote ref pull//head Observed on run 25689321499 (PR #1891 from natali-rs1985/vyos-documentation). Leave origin pointed at vyos/vyos-documentation (the base repo) — that's where actions/checkout left it after the merge-ref checkout, and where `pull//head` resolves. Replace the step with an explanatory comment. 🤖 Generated by [robots](https://vyos.io)