ci(repo): publish the evidence of a borrowed-device session on its pull request

[mikepitre]

Description

This is the last of four pull requests that replace the eleven of stack #10100. It holds #10163 and the edits that #10219, #10221, and #10230 made to the publish script. It sits on #10237, and it adds nothing to the device tests or the fixture.

A cloud agent cannot put a run's video and screenshots on its pull request. Its sandbox refuses the upload, and the Actions token cannot attach files. So attach in #10237 hands the files to the session's runner, which keeps them as the artifact verify-evidence. This pull request adds the workflow that reads that artifact and puts the evidence in the pull request description, as a table of a before run and an after run.

File	Lines	Copied or own
.github/workflows/verify-attach.yml	83	Own. Read this first.
scripts/verify-attach.mjs	1,001	A byte copy of .github/scripts/verify-attach.mjs on main of clerk/clerk-ios, reviewed there in clerk/clerk-ios#688 and the pull requests after it.
scripts/verify-attach.test.mjs	2,212	The clerk-ios test, with one line changed to import describe and it from vitest.
.github/workflows/ci.yml	4	Runs those tests in the Unit Tests job, on its Node 24 leg.
.github/actionlint.yaml	5	Lets concurrency.queue through in this one workflow, because actionlint 1.7 does not know the key.
.github/workflows/actions.lock	13	The pinned actions of the new workflow.

What needs attention is the trust boundary of verify-attach.yml:

• It runs on workflow_run when a verify-remote.yml session that someone started by workflow_dispatch in this repository ends. GitHub starts it only from the copy on main, so it does nothing until this stack has merged.
• The job has actions: read and contents: read. The token that edits the description is VERIFY_EVIDENCE_TOKEN, a secret of the environment verify-evidence, which allows only main. Only the step that runs gh holds it. The environment and the secret exist. There is no repository secret of that name, and there must not be one.
• Branch code wrote the artifact, so the job treats it as data. It never checks out, installs, or runs anything from the branch or from the artifact. The script reads the zip itself and refuses anything outside a fixed manifest of names, sizes, counts, and leading bytes.
• It publishes only to the open pull request of the session's branch. The commit the run was made at must be a commit of that pull request. The commit the session started on must be a commit of the pull request or a commit that its base branch holds.

Two things are not proven, and cannot be until this is on main. One is that a real session's end starts the workflow and the job gets the environment's secret. The other is that a fine-grained token with only "Pull requests: read and write" can attach files with gh pr edit --attach.

vitest run --root scripts verify-attach passes 198 of 198 tests on this branch, and npm test in integration/expo-native/ passes 917 of 917. The device suite passed on this stack's top commit (e828e76619) in run 39276831929: iOS 17 of 17, Android 16 of 16. One Android test passed on its second try, after the first launch of a cold emulator took longer than 60 seconds to show the home.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other: ci

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: b86f1cc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 19, 2026 5:05pm UTC
swingset	Ready	Preview	Oct 19, 2026 5:05pm UTC

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: d8ad08dd-91a1-4343-bf90-b8d41e205a24

📥 Commits

Reviewing files that changed from the base of the PR and between 9c4104f and b86f1cc.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: e2a34a19-a523-4557-a709-5dfb1e17051f

📥 Commits

Reviewing files that changed from the base of the PR and between e03c21d and e828e76.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing: 7

• .changeset/expo-verify-attach.md
• .changeset/expo-verify-session-start-on-base.md
• .github/actionlint.yaml
• .github/workflows/ci.yml
• .github/workflows/verify-attach.yml
• scripts/verify-attach.mjs
• scripts/verify-attach.test.mjs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The changes add a GitHub Actions workflow and CLI to fetch and publish verify-run evidence. The CLI validates artifact archives, manifests, files, session identity, and commit relationships. It adds evidence blocks and attachments to pull-request descriptions, with checks for pull-request changes during publication. A Vitest suite covers validation, fetching, publishing, and workflow configuration. CI runs the suite on Node 24.15.0.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: ⚪ Minimal · up to e828e

This change adds a workflow that posts evidence from a borrowed-device session to the session's pull request. No blocking defect was found, and the token-permission concern does not apply to this public repository. Whether the token can attach files will only be confirmed once the workflow runs from main.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 2.94% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 34 functions across 2 files. (5 skipped: 5…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: CI publishes borrowed-device session evidence on the pull request.
Description check		The description directly explains the new workflow, evidence publication, trust boundary, validation, testing, and known limitations. It is clearly related to the changeset.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 2.94% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 34 functions across 2 files. (5 skipped: 5 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10238

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10238

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10238

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10238

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10238

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10238

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10238

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10238

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10238

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10238

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10238

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10238

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10238

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10238

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10238

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10238

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10238

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10238

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10238

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10238

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10238

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10238

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10238

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10238

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10238

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10238

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10238

commit: b86f1cc