fix(ci): set write permissions for Claude GitHub Action by spideystreet · Pull Request #21 · opensource-together/ost-linker

spideystreet · 2026-03-06T15:20:13Z

Summary

Fix Claude Code Action permissions from read to write on contents, pull-requests, and issues
Without write permissions, Claude could only react with 👀 but couldn't post comments

Test plan

Tag @claude in an issue or PR comment and verify it responds with a full comment instead of just the eyes emoji

🤖 Generated with Claude Code

…d embedding assets

…ck start Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Remove obsolete ignore rules (Django, Flask, Celery, etc.), untrack models/lid.176.ftz (should be downloaded at build time, not stored in git), and update models/README.md with current resource paths. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

- go-check: vet + build for scraper and fetcher - docker-build: build image without push to catch Dockerfile errors early - prisma-validate: validate schema without a database - security: pip-audit for dependency vulnerabilities + gitleaks for secret leaks - quality: add --cov-fail-under=80 coverage threshold Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Installs torch from the CPU-only index before the main pip install, then strips torch/nvidia/triton/cuda lines from requirements.txt so pip doesn't re-download the CUDA variant. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Add known-third-party for dagster packages to prevent ruff from misdetecting the local dagster/ runtime directory as a first-party package, causing import order differences between local and CI. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

- Add dummy DATABASE_URL for Prisma validate step - Remove SQLFluff lint from CI (dbt templater needs DB; dbt parse suffices) - Make gitleaks continue-on-error when license is missing - Skip docs-sync PR creation when no new commits vs main Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Use gitleaks CLI directly instead of gitleaks-action which requires a paid license. Scans the working tree (--no-git) to avoid false positives from old commits. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

- New user_recommendation_job: embed users + dbt match models + public sync - New user_recommendation_schedule: every 2h (Europe/Paris) - Reduce run_all_schedule from 5x/day to 1x/day at 3 AM (scraping new projects doesn't need to be frequent; user recommendations do) Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

@Map

…d match models - Rename @@Map("verification_token") to @@Map("verification") to align with backend - Remove unused ProjectEmbedding model and its relation on Project - Add MatchGlobalRecommendation and MatchUserRecommendation (dbt-managed, read-only) - Add migration for all three changes Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Move prisma schema, migrations and seeds to opensource-together/prisma repo and reference it as a git submodule (same pattern as docs/). Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

- Add OST_PRISMA_TOKEN secret to quality-checks and caller workflows - Update prisma-validate to checkout with submodule token - Add prisma-submodule SHA check (mirrors docs-submodule pattern) - Add sync-prisma-submodule.yml to auto-PR schema changes to prisma repo Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Prisma stays as a regular directory in ost-linker (source of truth). Schema changes will be synced to ost-backend via CI workflow instead. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

- Remove prisma-submodule check job and OST_PRISMA_TOKEN - Revert prisma-validate to simple checkout (no submodule) - Replace sync-prisma-submodule.yml with sync-prisma-backend.yml that copies prisma/ to ost-backend and creates a PR on changes Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

@claude

Add claude.yml (PR/issue assistant via @claude mention) and claude-code-review.yml (auto code review on PR events). Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

…flows - pipeline-doctor: Dagster pipeline debugging (opus, memory) - dbt-analyst: dbt model review and debugging (sonnet, memory) - security-auditor: security audit before PRs (opus, stateless) - go-service-reviewer: Go scraper/fetcher review (sonnet, memory) Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

…cture refactor: restructure project for production readiness

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

- CODE_OF_CONDUCT: Contributor Covenant v2.1 - SECURITY: vulnerability reporting via GitHub issues - CLAUDE.md: add git flow, Claude CI workflows, custom agents Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

The Claude Code Action needs write permissions on contents, pull-requests, and issues to post comments. Read-only permissions only allowed the eyes emoji reaction without responding. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Add explicit base_ref guards so publish-develop, sync-docs, and sync-prisma only run on PRs targeting staging/main. On develop, only claude-code-review should run. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

spideystreet · 2026-03-06T15:29:32Z

Doublon — cette branche cible develop via PR #20

spideystreet added 30 commits December 2, 2025 23:26

refactor: switch to 384 vector dim

0fef9b2

refactor: switch to generic class name for embedding model

a082ce5

fix: embedding model resource name

c548417

fix: correct embeding model resource name

431b404

fix: add embeding model as required resource

c5e7112

fix: switch to 384 dim

f679535

build: up torch v

f0d79c5

feat: embedding flow OK

311a30e

refactor: Makefile -> entrypoint

572049b

refactor: Makefile content on entrypoint for auto-deployment

1b85902

build: fasttext model download on stage

d2ea5b6

build: add dbt dependancies

f71aa46

build: entrypoint fix to running migrations

df52962

chore: dbt profile

ae29037

chore: user

b2eed2d

feat: add dbt project

46e8c0e

refactor: dagster home to dagster/

fb08d18

chore: dagster.yaml

53ad831

chore: fix syntax

86bc222

refactor: pivot model before prod, for embedding usage

5ce561a

refactor(infra): update project structure and config for local execution

d29dc44

fix(assets): correct table names and uuid casting in raw sql

a916500

feat(scraper): add explicit rate limit logging and error handling

9a0a795

feat(db): update schema and add migrations for raw, int, and embd tables

34a0bd1

refactor(pipeline): cleanup logic, naming, and comments in scraper an…

cbcd834

…d embedding assets

build(prisma): upgrade to v6.19.0 and remove python client

66fc91f

refactor(pipeline): replace prisma with psycopg2 and flatten assets

188c444

chore(dbt): update model schemas to analytics

fc335a6

feat(scripts): add model download script

6b0ee50

refactor(pipeline): rename load asset and fix lineage dependencies

7728c1d

spideystreet and others added 26 commits March 5, 2026 14:54

docs: make README more concise with tech stack table and Makefile qui…

f57ba0c

…ck start Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

chore: track utility scripts previously hidden by global *.sh ignore

db648a8

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

chore(deps): add pip-audit to dev dependencies

14e5e24

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

fix(deps): upgrade dbt-common 1.37.2 → 1.37.3 (GHSA-w75w-9qv4-j5xj)

ab15212

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

ci: enable uv cache for Python CI jobs

aacb3c0

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

ci: add gitleaks allowlist for README false positives

821d49e

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

docs: update submodule pointer after MDX rewrite

a3ae0c0

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

refactor(prisma): convert prisma/ to shared submodule

4e0b1af

Move prisma schema, migrations and seeds to opensource-together/prisma repo and reference it as a git submodule (same pattern as docs/). Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

revert(prisma): convert back from submodule to regular directory

eae5718

Prisma stays as a regular directory in ost-linker (source of truth). Schema changes will be synced to ost-backend via CI workflow instead. Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

ci: add Claude GitHub Actions workflows

ce9c4a5

Add claude.yml (PR/issue assistant via @claude mention) and claude-code-review.yml (auto code review on PR events). Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

docs(claude): add test-first bug fixing rule to CLAUDE.md

2ec230f

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

Merge pull request #19 from opensource-together/refactor/project-stru…

facf2bf

…cture refactor: restructure project for production readiness

ci(review): set Claude Sonnet as model for PR review workflow

1a5ff8a

Co-Authored-By: spidecode-bot <263227865+spicode-bot@users.noreply.github.com>

spideystreet self-assigned this Mar 6, 2026

spideystreet closed this Mar 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): set write permissions for Claude GitHub Action#21

fix(ci): set write permissions for Claude GitHub Action#21
spideystreet wants to merge 298 commits into
stagingfrom
fix/post-review-fixes

spideystreet commented Mar 6, 2026

Uh oh!

spideystreet commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

spideystreet commented Mar 6, 2026

Summary

Test plan

Uh oh!

spideystreet commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant