G
YouTube TikTok Games
Skip to content

ci: remove the pr-audit workflow - #321

Open
grandizzy wants to merge 1 commit into
mainfrom
ci/remove-pr-audit-workflow
Open

grandizzy wants to merge 1 commit into
mainfrom
ci/remove-pr-audit-workflow

Conversation

@grandizzy

Copy link
Copy Markdown
Contributor

Removes the pr-audit workflow, which is no longer needed.

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed this PR and found no bugs. It is a clean deletion, but it removes the repo's automated PR security audit and its commit-status gate, so a maintainer should confirm that is intended and that branch protection does not still require that status.

What was reviewed:

  • The deleted .github/workflows/pr-audit.yml: the push-triggered pr-audit job (reusable workflow, statuses: write gate) and the comment-command pr-audit-comment job.
  • Searched the rest of the repo for references to pr-audit, the audit command words, and the EVENTS_* secrets. Nothing else references them, so no other workflow or doc breaks.
  • Not checked: whether the PR Audit status is a required check in branch protection or rulesets. That lives in repo settings, not in the checkout.
Extended reasoning...

The change deletes one file, .github/workflows/pr-audit.yml (70 lines), and touches no application code. That workflow ran an org-level security audit on every PR push, could also be triggered by a member's comment command, and posted a commit status. Deleting it also removes a pull_request_target trigger, which shrinks the attack surface. Nothing else in the repo references the workflow or its secrets, and there is no CODEOWNERS file. I deferred because turning off a security review control is a policy decision, and whether its status is a required check cannot be confirmed from the repository.

mattsse
mattsse previously approved these changes Nov 13, 2026
@tempo-voight-kampff

Copy link
Copy Markdown

Hi @mattsse — your review approval was detected by Voight-Kampff and a prompt was sent to your registered device, but no response came back before the approval window closed. Your review did not count toward this PR.

You can also try approving the PR directly via CLI with

vk approve pr https://github.com/tempoxyz/wallet-cli/pull/321

@tempo-voight-kampff
tempo-voight-kampff Bot dismissed mattsse’s stale review November 13, 2026 12:59

Voight-Kampff: dismissing this approval review — it was never confirmed through a Voight-Kampff prompt, so it must not count toward merging this pull request. Re-submit the review and complete the Voight-Kampff prompt if you want this verdict to count.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants