fix(ci): validate static workflow identity

[liangshuo-1]

Summary

Fix Semantic Review failures after CI adopted the dynamic CI / <PR number> run name. Workflow identity is now verified from the static Actions workflow metadata while preserving the existing fail-closed repository, event, path, and SHA checks.

Changes

• Resolve the triggering workflow through its validated workflow_id in both the PR quality summary and semantic review jobs.
• Verify the static workflow name and path, and reject mismatches between workflow metadata and the workflow-run payload path.
• Add regression coverage that prevents dynamic workflow_run.name from being reused as workflow identity.

Test Plan

• make script-test (150 tests)
• make unit-test
• go vet ./...
• gofmt -l . produces no output
• go mod tidy leaves go.mod and go.sum unchanged
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main reports 0 issues

Related Issues

• Reproduced by Semantic Review run 29927302591.

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of CI workflow identity and file paths during pull request quality and semantic reviews.
  • Added safeguards to reject mismatched or dynamically derived workflow metadata.
  • Strengthened automated checks to ensure reviews reference the intended CI workflow consistently.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6650be99-6418-4f6a-99d2-0a78331896ba

📥 Commits

Reviewing files that changed from the base of the PR and between abf6f99 and 1abebab.

📒 Files selected for processing (2)

• .github/workflows/semantic-review.yml
• scripts/semantic-review-workflow.test.sh

---

📝 Walkthrough

Walkthrough

Workflow-run validation in both review jobs now resolves the workflow from run.workflow_id, verifies the CI name and exact path, and checks provided run paths. Shell tests assert these requirements and reject dynamic workflow-name validation.

Changes

Workflow identity validation

Layer / File(s)	Summary
Resolve workflow identity from workflow ID .github/workflows/semantic-review.yml	Both review jobs parse run.workflow_id, fetch the workflow, validate the static CI name and path, and reject mismatched run.path values.
Test static workflow checks scripts/semantic-review-workflow.test.sh	Assertions require static workflow identity and path checks while prohibiting dynamic run.name identity usage.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/semantic-review-workflow-name

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@1abebabab4a09b4aef5827ffbceacdcaf2af5403

🧩 Skill update

npx skills add larksuite/cli#fix/semantic-review-workflow-name -y -g

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@abf6f99). Learn more about missing BASE report.
⚠️ Report is 32 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2015   +/-   ##
=======================================
  Coverage        ?   75.16%           
=======================================
  Files           ?      912           
  Lines           ?    96451           
  Branches        ?        0           
=======================================
  Hits            ?    72495           
  Misses          ?    18380           
  Partials        ?     5576           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.