From 8f0986a6332b4cba0a67525a74d5e78821c85426 Mon Sep 17 00:00:00 2001
From: Colum Ferry <cferry09@gmail.com>
Date: Thu, 27 Aug 2026 17:36:50 +0100
Subject: [PATCH] ci(repo): pass --repo to gh in ai-review; raise scripts-ci
 timeout to 20m

---
 .github/workflows/ai-review.yml         | 11 ++++++++---
 .github/workflows/github-scripts-ci.yml |  6 +++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index b1072e63ea..36dda7c9d5 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -156,8 +156,12 @@ jobs:
           PR: ${{ needs.resolve.outputs.pr_number }}
         run: |
           mkdir -p /tmp/ai-review
-          gh pr diff "$PR" > /tmp/ai-review/pr.diff
-          gh pr view "$PR" --json number,title,body,baseRefName,headRefName,additions,deletions,changedFiles \
+          # `gh` infers the repo from the current directory's git remote, but this
+          # job checks out into `pr/` and `trusted/` subdirs, so $GITHUB_WORKSPACE
+          # itself is not a git repo — pass --repo explicitly.
+          gh pr diff "$PR" --repo "$GITHUB_REPOSITORY" > /tmp/ai-review/pr.diff
+          gh pr view "$PR" --repo "$GITHUB_REPOSITORY" \
+            --json number,title,body,baseRefName,headRefName,additions,deletions,changedFiles \
             > /tmp/ai-review/pr.json
 
       # Pin the exact published version so a new Claude Code release can't
@@ -303,7 +307,8 @@ jobs:
           PR: ${{ needs.resolve.outputs.pr_number }}
         run: |
           mkdir -p /tmp/ai-review
-          gh pr diff "$PR" > /tmp/ai-review/pr.diff
+          # Pass --repo explicitly so `gh` never depends on cwd being a git repo.
+          gh pr diff "$PR" --repo "$GITHUB_REPOSITORY" > /tmp/ai-review/pr.diff
 
       - name: Prepare merged-review output schema
         run: |
diff --git a/.github/workflows/github-scripts-ci.yml b/.github/workflows/github-scripts-ci.yml
index e4d415fbed..237e718ab1 100644
--- a/.github/workflows/github-scripts-ci.yml
+++ b/.github/workflows/github-scripts-ci.yml
@@ -21,7 +21,11 @@ jobs:
   test:
     name: Test and type-check
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # The shared setup installs the full workspace + Go toolchain via mise, which
+    # runs ~9-10 min; a 10-minute cap raced the install and got cancelled on a
+    # cold cache. 20 gives that install headroom. (This check is heavier than it
+    # needs to be for two scripts — slimming the setup is a possible follow-up.)
+    timeout-minutes: 20
     permissions:
       contents: read
     steps: