3 Commits

Include renames

Author	SHA1	Message	Date
chichuan	20d1f7c614	feat(eval-dispatch): optional sha= for own-PR dispatch; structural cases ref validation ... - /eval on one's own PR may omit sha=: the guard auto-pins the dispatch-time head (commenter == PR author leaves no third-party swap window); dispatching another author's PR still requires the explicit reviewed SHA (keeps the P1-2 TOCTOU remedy where the threat lives) - cases= is now validated structurally per git check-ref-format semantics (leading/trailing//double slashes, '..', dot-leading components, .lock suffixes) and rejects '-'-leading values to prevent git fetch option injection (review P2)	2026-08-11 15:46:16 +08:00
chichuan	42e764a7a8	fix(ci): harden eval dispatch authorization	2026-08-11 13:57:42 +08:00
chichuan	2d38abe681	feat(ci): PR 评论 /eval 触发内网 MCP 评测的 dispatch workflow ... - issue_comment 触发，author_association ∈ OWNER/MEMBER/COLLABORATOR 门控 - 不 checkout、不执行 PR 代码；触发通道与凭证全部经 secrets 注入 - scripts/ci/eval_comment_parse.py 解析 /eval <products> [cases=<ref>]（10 个单测）	2026-08-10 15:34:01 +08:00