Default github-token to github.token so the review comment posts without setup#167
Merged
Conversation
…ithout setup
Most repos got the encrypted free review by tracking a moving action ref,
not by a proactive upgrade, so they never added github-token + permissions.
Result: the review link goes only to the job summary (a page almost nobody
opens). Day-2 production: ~476 reviews created, 3 opened.
Defaulting github-token to the built-in github.token means the comment is
posted automatically wherever the job's GITHUB_TOKEN already has write
permission, with no workflow edit. Repos whose default token is read-only
still fall back to the summary (the permissions line genuinely needs a
workflow edit); fork PRs are unchanged.
Also makes the comment the honest first-touch notice it now is:
- precise privacy wording (key lives in the URL fragment, never sent to a
server, so oasdiff cannot read the specs) instead of "specs stay private";
- "anyone with the link can open" (the capability-by-URL model) instead of
"anyone can open";
- an explicit opt-out line ("set review: false") since the comment is now
posted by default.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Drop product-jargon ('in context'), the share prompt (the review page has a
per-change 'Copy link'), the 'anyone with the link' line (covered by the docs
'How it works' link), and 'no install or account needed' (self-evident on
click). Keep the title (the value), the 7-day TTL, the privacy explanation,
and the opt-out footer.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… name the upload A user who got the comment via a moving action ref (not a deliberate opt-in) is the one most likely to want to turn it off. Two changes so they find how: - link 'oasdiff GitHub Action' to /docs/free-review#github-action, the section that explains what posted the comment and how to disable it; - reframe the off-switch from 'stop posting this comment' to 'turn this off (no spec upload, no comment)', since review: false stops the upload too, which is what a privacy-minded first-time reader actually wants. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Most repos picked up the encrypted free review by tracking a moving action ref, not by a proactive upgrade, so they never added
github-token+permissions. The review link then goes only to the job summary, which almost nobody opens. Production day 2: ~476 reviews created, 3 opened (~0.6%). The feature is on, but invisible.Change
Default
github-tokento${{ github.token }}inbreaking/action.ymlandchangelog/action.yml. The PR comment now posts automatically on any repo whose jobGITHUB_TOKENalready has write access, with no workflow edit. Repos whose org forces a read-only default token still fall back to the job summary (thepermissions: pull-requests: writeline genuinely needs a workflow edit); fork PRs are unchanged (read-only token).Verified end-to-end in CI: a workflow that does not pass
github-tokenposted the comment via the resolved default (github-actions[bot]). Confirmed the expression default resolves through the Dockerargspath (thewith:block loggedgithub-token: ***, a masked non-empty value, despite nothing being passed).Comment copy
Since the comment is now posted by default, it's the first-touch notice for many maintainers, so it's been made more transparent:
review: false."🤖 Generated with Claude Code