[juliusmarminge]

Fork PRs never get the 📱 Native Change label, e.g. https://git.cafe/pingdotgg/t3code/pulls/26452, which edits Swift in a local Expo module. The fingerprint check runs PR code under pull_request, so a fork run has a read-only token, and the label step was gated off for forks.

The fix splits the workflow into two halves, the same way the desktop macOS preview does:

• mobile-fingerprint-check.yml (untrusted, runs PR code) no longer touches labels. It uploads a one-line fingerprint-result artifact with the changed platforms (empty when none changed). Its token drops to contents: read.
• New mobile-fingerprint-label.yml runs on workflow_run from main with a write token. It resolves the PR from the checked commit (workflow_run.pull_requests is empty for forks), skips the run if the PR's head moved on, reads the artifact as bytes and validates it (only ios, android, or both), then syncs the label with the existing script. It never checks out or runs PR code.

Same-repo PRs go through the same path, so there is one labeling path for every PR. A fork that edits the check workflow can at most mislabel its own PR, because the PR number comes from the commit lookup, not from the artifact.

Verified: YAML parses, vp fmt is clean, and the value check accepts and rejects the expected inputs. workflow_run only runs from the default branch, so the end-to-end check happens after merge: any new event on https://git.cafe/pingdotgg/t3code/pulls/26452 (push or title edit) should label it.

Model: Claude Opus 5.5 in Claude Code (T3 Code).

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 48d8e98

Macroscope's review found this PR approvable — Fork PRs gain the existing native-change label through a separate trusted workflow, while PR-executed code loses write permissions. Artifact validation and PR matching contain the change to advisory labeling without altering production release behavior.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: ci/fork-native-change-label
• File: .coderabbit.config.ts
• Commit: 48d8e98
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: fee05be3-d28e-471d-a5e4-696da96b9116

Commits

Reviewing files that changed from the base of the PR and between 8ff9ae1 and 48d8e98.

Files selected for processing: 2

• .github/workflows/mobile-fingerprint-check.yml
• .github/workflows/mobile-fingerprint-label.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

The fingerprint check now uploads its changed-platform result as a short-lived artifact. A separate workflow validates the completed run, artifact, and matching open pull request before creating, updating, adding, or removing the native-change label.

Changes: Mobile fingerprint labeling

Layer / File(s)	Summary
Produce the fingerprint result .github/workflows/mobile-fingerprint-check.yml	The check uploads the changed platform list as a one-day artifact. It no longer manages the label or requests label-write permissions.
Validate the completed run and pull request .github/workflows/mobile-fingerprint-label.yml	The workflow proceeds only for successful pull-request runs. It requires one unexpired result artifact and one open pull request matching the run’s head commit, branch, and repository.
Validate result and update the label .github/workflows/mobile-fingerprint-label.yml	The workflow accepts only supported platform values. It creates or updates label metadata, adds the label when a platform changed, and removes it when the result is empty.

Priority: Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: macroscopeapp

Merge Risk: Minimal · up to 48d8e

No actionable issue is established. Fork labeling still needs an end-to-end check after the workflow is available on the default branch.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description covers the problem (fork PRs never get the Native Change label, and the label step was gated off for forks) and the change (the workflow split into an untrusted check and a trusted wor…	Add a '## Scope and approval' section. Link the triaged bug issue or the discussion that records maintainer approval of this direction, including the approval comment. If no prior issue exists, explain why this fix qualifies as a very small…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title names the change: fork PRs now receive the Native Change label. It follows the conventional commit format and is specific. The raw summary and objectives both describe splitting fingerprint …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the change: fork PRs now receive the Native Change label. It follows the conventional commit format and is specific. The raw summary and objectives both describe splitting fingerprint checking from label updates so fork PRs can be labeled. The title does not name the split itself, but it states the primary user-facing result.

Full details: Description check

Explanation

The description covers the problem (fork PRs never get the Native Change label, and the label step was gated off for forks) and the change (the workflow split into an untrusted check and a trusted workflow_run labeler). It also covers verification (YAML parsing, vp fmt, value-check tests) and the post-merge end-to-end check. The template's Scope and approval section is missing. It does not link a triaged bug issue or maintainer approval, and it does not explain why the change qualifies without one. The description also omits the screenshot and UI guidance, which does not apply here.

Resolution

Add a '## Scope and approval' section. Link the triaged bug issue or the discussion that records maintainer approval of this direction, including the approval comment. If no prior issue exists, explain why this fix qualifies as a very small, focused fix of an obvious bug. Keep the existing Problem, Change, and Verification content. Rename the sections to match the template headings if they differ. Remove the Claude model line only if the repository does not require it; the template asks agent users to name the model and harness, and the current line already does so.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	+6 B (+0.1%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.3 KiB	+6 B (+0.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: 8ff9ae1 · PR result: 48d8e98 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.