ci(repo): publish the evidence of a borrowed-device session on its pull request

[mikepitre]

Description

This is the last of four pull requests that replace the eleven of stack #10100. It holds #10163 and the edits that #10219, #10221, and #10230 made to the publish script. It sits on #10237. The tree of this branch is the tree of the old top, 1f335171b on #10230, file for file, plus the review fixes merged up from #10237.

A cloud agent cannot put a run's video and screenshots on its pull request. Its sandbox refuses the upload, and the Actions token cannot attach files. So attach in #10237 hands the files to the session's runner, which keeps them as the artifact verify-evidence. This pull request adds the workflow that reads that artifact and puts the evidence in the pull request description, as a table of a before run and an after run.

File	Lines	Copied or own
.github/workflows/verify-attach.yml	83	Own. Read this first.
scripts/verify-attach.mjs	1,001	A byte copy of .github/scripts/verify-attach.mjs on main of clerk/clerk-ios, reviewed there in clerk/clerk-ios#688 and the pull requests after it.
scripts/verify-attach.test.mjs	2,212	The clerk-ios test, with one line changed to import describe and it from vitest.
.github/workflows/ci.yml	4	Runs those tests in the Unit Tests job, on its Node 24 leg.
.github/actionlint.yaml	5	Lets concurrency.queue through in this one workflow, because actionlint 1.7 does not know the key.

What needs attention is the trust boundary of verify-attach.yml:

• It runs on workflow_run when a verify-remote.yml session that someone started by workflow_dispatch in this repository ends. GitHub starts it only from the copy on main, so it does nothing until this stack has merged.
• The job has actions: read and contents: read. The token that edits the description is VERIFY_EVIDENCE_TOKEN, a secret of the environment verify-evidence, which allows only main. Only the step that runs gh holds it. The environment and the secret exist. There is no repository secret of that name, and there must not be one.
• Branch code wrote the artifact, so the job treats it as data. It never checks out, installs, or runs anything from the branch or from the artifact. The script reads the zip itself and refuses anything outside a fixed manifest of names, sizes, counts, and leading bytes.
• It publishes only to the open pull request of the session's branch. The commit the run was made at must be a commit of that pull request. The commit the session started on must be a commit of the pull request or a commit that its base branch holds.

Not proven, and not provable before this is on main: that a real session's end starts the workflow and the job gets the environment's secret, and that a fine-grained token with only "Pull requests: read and write" can attach files with gh pr edit --attach.

vitest run --root scripts verify-attach passes 198 of 198 tests on this branch, and npm test in integration/expo-native/ passes 836 of 836.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other: CI

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 606d18a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 15, 2026 7:57pm UTC
swingset	Ready	Preview	Oct 15, 2026 7:57pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10238

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10238

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10238

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10238

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10238

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10238

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10238

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10238

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10238

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10238

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10238

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10238

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10238

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10238

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10238

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10238

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10238

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10238

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10238

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10238

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10238

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10238

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10238

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10238

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10238

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10238

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10238

commit: 606d18a