Closes the dogfood blind spot decided in review: the repo's own workflows now exercise the repo's own code.
The gap
Every job in buddy.yml ran bunx @buddysh/buddy — the published npm package. The real scheduled runs never executed main's code, so a merged change wasn't exercised in production until the next release. That's how defects like the preset-cadence bug survived green CI: nothing that runs with real tokens ever ran the new code.
What changes
buddy.yml — dogfood main. All nine bunx @buddysh/buddy invocations become bun ./bin/cli.ts (bun runs the TS source directly; bun install already happens in every job). Merged changes are now exercised by the next 2-hourly run.
Checkout pinning — the security half. The workflow also fires on pull_request: [edited] (rebase checkbox), where the default checkout is the PR merge commit. Running local source from that checkout would execute PR-modified code in a job holding BUDDY_TOKEN (a repo+workflow PAT). The two jobs reachable from that trigger (setup, check) pin ref: main, so scheduled, dispatched, and PR-triggered runs all execute main's code only.
ci.yml — secretless PR smoke. New buddy-smoke job on every PR: the PR's own CLI reviews its own branch — bun ./bin/cli.ts review --branch --base origin/main --light --format github — with permissions: contents: read and no token or API key in env. The pre-merge half of the gap, closed with zero credential exposure. (Verified locally under a detached-HEAD checkout, matching CI's state: exit 0.)
Verification
- Both files parse (Bun.YAML).
review --lightover the change: no findings.- This PR exercises its own smoke job —
buddy-smokeshould appear in the checks below.
🤖 Generated with Claude Code