ci: automatic advisory Quality Keeper runs on same-repo PRs (#146)

[sophiecarreras]

What this changes

Implements the SDK pilot in backblaze-labs/quality-keeper#146: Quality Keeper now runs automatically on same-repo pull requests to main, and stays advisory / non-blocking. Extends the existing .github/workflows/quality-run-demo.yml (no new file).

• Trigger: pull_request (NOT pull_request_target) on branches: [main], types opened/synchronize/reopened/ready_for_review. workflow_dispatch retained for manual demo/debug.
• Same-repo only / fork-safe: both jobs carry if: event == workflow_dispatch || head.repo.full_name == github.repository, so fork PRs skip entirely — untrusted fork code never runs in a job that can reach secrets or PR-write authority. (GitHub also withholds secrets / forces a read-only token on fork pull_request runs — defense in depth.)
• Two-job split preserved: quality-run (contents: read, runs the target's own code, QK_INSTALL_TOKEN only, no App key) → comment (pull-requests: write + actions: read, runs no target code, mints the App token downscoped to pull-requests: write).
• Advisory / non-blocking: run-found-checks exits non-zero when a safe check fails; that exit code is captured as advisory evidence (execution.json is written first), so a failing SDK check does not turn QK into a red/blocking check — while genuine QK errors (assess / post-execute) still fail. This workflow is not a required check and does not gate merge.
• Injection-safe: comment target = inputs.issue_url (manual) or github.event.pull_request.html_url (auto), passed via env: and quoted — no PR-controlled text expanded inline.
• Idempotent one-comment upsert, --expect-repo, and Repository Activation preserved. Per-PR concurrency with cancel-in-progress. All actions SHA-pinned with version comments.

No seeds, branches, issues, PRs, or auto-fixes are created.

Security / verification

• zizmor clean at regular and pedantic personas.
• YAML valid; triggers = pull_request + workflow_dispatch (no pull_request_target); all uses: SHA-pinned.
• The repo's GitHub Actions security check (security.yml → gha-security) runs on this PR and should pass.
• This PR is itself the first live automatic proof (a same-repo PR, not Gonzalo's): opening it triggers the advisory QK run, which should post/update one comment as quality-keeper[bot]. The run + comment will be linked back to quality-keeper#146.

Residual risk (documented, follow-up proposed)

QK_INSTALL_TOKEN is reachable by same-repo (trusted-collaborator) PR code in quality-run, because quality-keeper is private and must be pip-installed there. It must remain a read-only, repo-scoped credential. Safer follow-up: eliminate the install secret from the code-running job by publishing quality-keeper to an internal registry / prebuilt image / making it public.

Refs backblaze-labs/quality-keeper#146

🤖 Generated with Claude Code

[quality-keeper]

Quality Keeper — Quality Run

Source: backblaze-labs/b2-sdk-typescript

Quality Keeper assessed the source, executed checks, and collected results. This is a read-only run overview; it changes no Evidence State, and seeded scaffolds are next actions, not evidence, until applied and re-evaluated.

10 of 14 expectations verified or exercised. Remaining outcomes are listed below — executed-but-not-exercised, pending, missing, and review are separate from verified/exercised and are not counted as passing.

Outcome	Count
Verified before execution	3
Exercised this run	7
Selected, not executed	2
Missing — no seed proposal	2

Gaps and next actions

• Missing — no seed proposal · Contract Testing · public_or_network_boundaries_need_contract_testing — No seed proposal — an operator must design acceptable evidence for this expectation.
• Selected, not executed · Environmental Isolation Testing · external_resource_assets_need_environmental_isolation_testing — It was selected but produced no result — opt in (e.g. --include-expensive) or fix the command; do not just re-select it.
• Selected, not executed · Integration Testing · published_sdk_packages_need_integration_testing — It was selected but produced no result — opt in (e.g. --include-expensive) or fix the command; do not just re-select it.
• Missing — no seed proposal · Static Security Analysis · code_and_configuration_assets_need_static_security_analysis — No seed proposal — an operator must design acceptable evidence for this expectation.

---

New to these terms? See the Quality Keeper glossary.

[sophiecarreras]

Review findings addressed (commit a9556c7)

• ci(deps): bump the github-actions group with 7 updates #1 Draft PRs (Low) — fixed. Both job guards now also require github.event.pull_request.draft == false, so QK comments only once the PR is marked ready (ready_for_review re-triggers with draft == false). Manual dispatch unaffected.
• build(deps-dev): bump the dev-dependencies group with 4 updates #2 Inaccurate inline guarantee (Low) — fixed. Replaced "execution.json is always written first" with the true contract: check findings don't fail the job, but a genuine QK error (no execution.json) still fails step 3 (job red).
• build(deps-dev): bump vitest from 3.2.4 to 4.1.7 #3 Exit-code contract (altitude) — filed as a quality-keeper follow-up: backblaze-labs/quality-keeper#147 (give run-found-checks a findings-vs-error exit contract so advisory callers don't need the shell set +e wrapper). Out of scope for this SDK PR.
• build(deps-dev): bump @biomejs/biome from 1.9.4 to 2.4.16 #4 Redundant comment guard (cleanup) — kept deliberately. It's the only write-capable job; the mirrored guard is defense-in-depth against a future refactor dropping needs. Added a comment explaining why it's retained despite being redundant today.
• build(deps-dev): bump @vitest/coverage-v8 from 3.2.4 to 4.1.7 #5 cancel-in-progress trade-off (info) — documented. Noted that a superseded intermediate commit may not get its own comment (latest SHA wins), which is correct for an advisory signal.

Verified: YAML valid; both guards carry same-repo + non-draft; zizmor clean (regular + pedantic). This push re-triggers the advisory run on this (non-draft) PR, confirming the draft gate doesn't affect normal same-repo PRs.