guide/.github/workflows/pull-request.yml at main · arillso/guide · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
---
name: Pull Request
run-name: |
    Pull Request by @${{ github.actor }}

on:
    pull_request:
        branches: [main]
        types: [opened, synchronize, reopened, ready_for_review]

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

permissions:
    contents: read
    actions: read
    pull-requests: write
    issues: read
    id-token: write

jobs:
    build-docs:
        name: Build Documentation
        runs-on: ubuntu-latest
        steps:
            - name: Checkout Code
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

            - name: Setup Python
              uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
              with:
                  python-version: "3.15.2"
                  cache: "pip"

            - name: Install Dependencies
              run: pip install -r requirements.txt

            - name: Build Documentation
              run: ./build.sh

            # Reuse the rst/ tree that build.sh already generated (collections
            # rendered + normalized) and validate every external link. Internal
            # :ref:/:doc: references are already enforced by the nitpicky html
            # build above; this catches dead external URLs.
            - name: Check Links
              run: sphinx-build -b linkcheck rst build/linkcheck -c .

    security-secrets:
        name: Secret Detection Scan
        uses: arillso/.github/.github/workflows/security-secrets.yml@2026-10-24

    security-deps:
        name: Dependency Review
        uses: arillso/.github/.github/workflows/security-deps.yml@2026-10-24
        permissions:
            contents: read
            pull-requests: write
            security-events: write

    claude-review:
        name: Claude Code Review
        uses: arillso/.github/.github/workflows/ai-claude-review.yml@2026-10-24
        secrets:
            CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}