Repository navigation
feat(push): push change-requests from the container (CR-1021) - #15
Draft
StoneyJackson wants to merge 14 commits into
Draft
StoneyJackson wants to merge 14 commits into
StoneyJackson wants to merge 14 commits into
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also say in the docs that the tracker data lives in change-requests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lock the volume's mount point rather than the script's own repo, so a worktree's copy still serializes with other containers; tests lock a temp dir through OURPLCC_LOCK_DIR. Reject an unfinished clone, a rebase already in progress, and a rebase that fails without a conflict with a push.bash: message instead of raw git errors, never leaving a rebase half done. Point a failed push at git's message and the token. Warn before CONTRIBUTING's reset --hard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StoneyJackson
marked this pull request as draft
October 13, 2026 17:33
Brings in main's edits to the devcontainer permissions spec, which the open-check results amend next. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Settled on plcc-ng's branch: the forwarded SSH agent can only be hidden, so the boundary is keeping no GitHub key in the host agent; the Codespace token can create draft releases; its token expires about 12 hours after start and Codespaces' own helper is no fresher, so the fallback helper is dropped; volumes survive a Codespace restart; the lock crosses containers. Verification narrows to a smoke test for repos after plcc-ng. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A workflow's permissions block can raise the read-only GITHUB_TOKEN default, so a workflow pushed from a Codespace runs with write access to its repo. Accepted; CONTRIBUTING advises running agents regularly in a local container and only watched one-offs in a Codespace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Naming them tells a phisher whose token is worth taking; the spec needs only the exception, not the person. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The spec assumed OAuth app access was unrestricted so that hosts could push through Git Credential Manager. It was already restricted, which cut GCM off and also stops gh's browser-login token reaching ourPLCC. Keep the restriction, approve GCM alone, and add the host's switch to HTTPS through GCM to the migration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CR-1021, Rollout step 3 of the devcontainer permissions spec.
Merge order: the spec PR first, then this one in cutover step 6, after the split's PR (cutover step 4).
🤖 Generated with Claude Code"