[aditeyabaral]

📌 Description

Contributors now clone pesu-dev/auth, push a branch of their own to it, and open the pull request from that branch to dev, instead of working on a fork. This makes CI enforce that, and updates the docs and the agent instructions to match.

Supersedes #266. Thank you @Vector316I71A for starting this change; this PR builds on it.

Area	Change
.github/workflows/ci_checks.yml	The PR source checker fails a PR from a fork, from dev or main, or to anything but dev, and says where to ask for write access. Every other job needs it, so a rejected PR runs nothing else. Dependabot's and Copilot's branches are in this repository and still pass
.github/workflows/ci_checks.yml permissions	The workflow token is now read-only (contents: read). Fork PRs always got a read-only token, but a branch PR gets the repository's default, which is write, while CI runs the PR's unreviewed code. The image build keeps packages: write, because its reusable workflow asks for it; it pushes nothing on PRs
CONTRIBUTING.md	Clone this repository, branch from origin/dev with a name nobody else uses, push to origin; how to get write access; Copilot is assigned here; CI runs the live tests on every PR; PR previews, and never signing in to one with your own credentials
docs/development.md	Clone URL; how to re-point a clone made from a fork (with or without an upstream remote); Dependabot follow-ups (a maintainer pushing onto Dependabot's branch also bumps the version, since the Version check runs on that push) and Copilot without forks; the PR source checker; the version check against origin/dev
docs/testing.md	Branches of this repository receive the secrets, so CI runs the live tests on every PR except Dependabot's, in the merge queue and on dev
docs/deployment.md	New "Pull request previews" section: pesuauth-dev-pr-<number>.onrender.com, staging's environment variables, /health reports staging, never sign in with your own credentials
scripts/run_tests.py	A comment that said every PR runs without secrets; now only local runs without .env and Dependabot's PRs do
copilot-setup-steps.yml	Runs on pushes to dev only, so a branch with an open PR does not run it twice
.agents/pesudev-skills, .github/agents/	The submodule points at pesu-dev/skills#10 (merged as b8bceb1), which moves AGENTS.md, the skills and the roles to the same flow; release-manager.agent.md is regenerated because that role's description changed

ℹ️ Fixes / Related Issues
Related: #266, pesu-dev/skills#10, pesu-dev/actions#1

🧱 Type of Change

Please indicate the type of changes introduced in your PR. Anything left unchecked will be assumed to be non-relevant

• 🐛 Bug fix – Non-breaking fix for a functional/logic error
• ✨ New feature – Adds functionality without breaking existing APIs
• ⚠️ Breaking change – Introduces backward-incompatible changes (API, schema, etc.)
• 📝 Documentation update – README, docstrings, OpenAPI tags, etc.
• 🧪 Test suite change – Adds/updates unit, functional, or integration tests
• ⚙️ CI/CD pipeline update – Modifies GitHub Actions, pre-commit, or Docker build
• 🧹 Code quality / Refactor – Improves structure, readability, or style (no functional changes)
• 🐢 Performance improvement – Speeds up auth, profile retrieval, or reduces I/O
• 🕵️ Debug/logging enhancement – Adds or improves logging/debug support
• 🔧 Developer tooling – Scripts, benchmarks, local testing improvements
• 🔒 Security fix – Addresses auth/session/data validation vulnerabilities
• 🧰 Dependency update – Updates libraries in pyproject.toml, uv.lock

🧪 How Has This Been Tested?

Please indicate how you tested your changes. Completing all the relevant items on this list is mandatory

• Unit Tests (tests/unit/)
• Functional Tests (tests/functional/)
• Integration Tests (tests/integration/)
• Manual Testing

⚙️ Test Configuration:

• OS: Linux
• Python: 3.14 via uv
• Docker build tested

uv run pytest tests/unit passed (613). The functional, integration and live tests were not run locally; CI runs the full suite, live tests included, on this PR, since it comes from a branch of this repository. SKIP=pytest uv run pre-commit run --all-files passes, including sync-agents against the new submodule commit, and check_version_bump.py accepts 5.9.0 → 5.10.0.

✅ Checklist

Please indicate the work items you have carried out. Completing all the relevant items on this list is mandatory. Anything left unchecked will be assumed to be non-relevant

• My code follows the CONTRIBUTING.md guidelines
• I've performed a self-review of my changes
• I've added/updated necessary comments and docstrings
• I've updated relevant docs (README or endpoint docs)
• No new warnings introduced
• I've added tests to cover my changes
• All tests pass locally (scripts/run_tests.py)
• I've run linting and formatting (pre-commit run --all-files)
• Docker image builds and runs correctly
• Changes are backwards compatible (if applicable)
• Feature flags or .env vars updated (if applicable)
• I've tested across multiple environments (if applicable)
• Benchmarks still meet expected performance (scripts/benchmark/benchmark_requests.py)

🛠️ Affected API Behaviour

Please indicate the areas affected by changes introduced in your PR

• app/app.py – Modified /authenticate route logic
• app/pesu.py – Updated PESU Academy login or profile handling
• app/exceptions/ – Error types, their status codes or messages
• app/metrics/ – Metrics collection, exposition or the /metrics token
• app/docs/ – OpenAPI (Swagger) examples and descriptions

🧩 Models

• app/models/request.py – Input validation or request schema changes
• app/models/response.py – Authentication response formatting
• app/models/profile.py – Profile response schema
• app/models/upstream.py – Parsing of PESU Academy's login and profile responses

🐳 DevOps & Config

• Dockerfile – Changes to base image or build process
• .github/workflows/*.yml – CI/CD pipeline or deployment updates
• pyproject.toml / uv.lock – Dependency version changes
• .pre-commit-config.yaml – Linting or formatting hook changes
• .github/scripts/check_version_bump.py – The CI version check

📊 Benchmarks & Analysis

• scripts/benchmark/benchmark_requests.py – Performance or latency measurement changes
• scripts/benchmark/analyze_benchmark.py – Benchmark result analysis changes
• scripts/run_tests.py – Custom test runner logic or behavior updates (a comment only)

📸 Screenshots / API Demos (if applicable)

No API change.

🧠 Additional Notes (if applicable)

• Submodule: chore: take pull requests from branches of each repository instead of forks skills#10 is merged, and .agents/pesudev-skills points at its squash commit, b8bceb1.
• Version: 5.10.0, a minor bump by default. There is no API change, so 5.9.1 also fits if you prefer a patch for CI and docs work.
• Settings this needs, outside the PR: new contributors must be added to developer-team before they can push. Please confirm the "ask in #pesu-auth on PESU Discord" wording in CONTRIBUTING.
• Consequences of branches in this repository:
  • Every writer's branch workflows can read every secret the repository can use: TEST_*, but also RENDER_API_KEY, DOCKER_* and the org's RELEASE_BOT_*. TEST_* is accepted so that live tests run on PRs; moving the deploy and release secrets into the staging/production environments would take the rest out of reach.
  • Every PR gets a Render preview that shares staging's environment variables. This is kept, and documented here.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[Vector316I71A]

LGTM