chore: sync 4 org-standard workflow stub(s) from petry-projects/.github - #1378
Conversation
🤖 CodeAnt AI — Review Status
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughThe pull request updates workflow pins and checks, reorganizes engine execution, changes Dev-Lead and review scripts, removes duplicated prompt content, and adds repository maintenance rules and false-positive scan exclusions. ChangesReview automation
Estimated code review effort: 5 (Critical) | ~120 minutes Mergeability Score: 🟠 High · up to The current head changes shared workflow automation to add retries, broader review context, safer fixes, and broader rebasing, but it still contains unresolved duplicate or shadowed logic, a concurrency grouping bug, possible secret leakage into CI logs, insufficient verdict validation, and unsafe temporary-state writes. These could cause incorrect automated actions, concurrent processing, or credential exposure, so the PR is not merge-ready until the high-impact issues are fixed or explicitly accepted. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:XS
PR Summary by QodoSync org-standard workflow stubs to latest next/stable channels
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
48 rules 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
codeant-ai
Bot
added
size:XS
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
Dependency Advisory
Risk Legend
DetailsAll dependency changes appear low-risk. No action required. Additional context: This PR introduces the first
|
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
1 similar comment
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1378 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
1 similar comment
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (6)
scripts/dev-lead-fix-reviews.sh (1)
2735-2883: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove duplicate helper definitions.
scripts/dev-lead-fix-reviews.shstill contains seven definitions ofpost_reviews_rate_limitedand multiple definitions of the other helpers. Keep one definition of each helper, then rerun the repository ShellCheck command. ShellCheck currently reports zero warnings.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/dev-lead-fix-reviews.sh` around lines 2735 - 2883, Remove the duplicate definitions of post_reviews_rate_limited and the other helper functions in the script, retaining exactly one canonical definition of each helper and preserving its current behavior. Then rerun the repository’s ShellCheck command and resolve any warnings introduced by the cleanup, keeping the result warning-free.Source: Coding guidelines
.github/workflows/pr-review.yml (1)
106-119: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftKey
check_suiteconcurrency byhead_sha, not the first PR number.
CHECK_SUITE_PRSreviews every associated PR, butconcurrency.groupuses onlypull_requests[0]. A suite containing PR A and PR B is keyed to A, while a direct event for B uses B's group. Both runs can process B concurrently. Use a commonhead_shagroup for SHA-bearing events, or create per-PR jobs with per-PR concurrency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-review.yml around lines 106 - 119, Update the concurrency group expression around the PR URL and SHA fallbacks so check_suite events are keyed by github.event.check_suite.head_sha rather than pull_requests[0].number. Ensure SHA-bearing check_suite and direct pull_request events resolve to the same group for the same commit, while preserving the existing client_payload and PR URL fallbacks.scripts/engine.sh (4)
3061-3073: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRedact engine output before it reaches the workflow log
run_writerstreams raw output throughtee, and the workflow invokes the dev-lead scripts directly. Therefore, secrets can reach the Actions log before the later redaction step. Redact stdout before publishing it while retaining the raw capture for rate-limit detection.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/engine.sh` around lines 3061 - 3073, Update run_writer so streamed stdout is passed through the same secret-redaction patterns before tee publishes it to the workflow log, while preserving the unredacted capture used for rate-limit detection. Keep the existing redaction behavior anchored to redact_secrets and ensure only published output is sanitized, not the raw diagnostic data.
2778-2792: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winClear the rate-limit reset sidecar before fallback attempts.
run_writer_with_fallbackcan return2after skipping every engine without updating/tmp/dev-lead-rate-limit-reset. Clear this sidecar at wrapper entry so retry markers do not use a timestamp from an earlier attempt.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/engine.sh` around lines 2778 - 2792, Update the run_writer_with_fallback wrapper to remove or reset /tmp/dev-lead-rate-limit-reset immediately on entry, before any fallback engine attempts or early returns. Preserve the existing failure-reason handling and return codes.
2004-2031: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winValidate the verdict schema in both fast paths.
jq emptyacceptsnull, arrays, and objects withoutdecision, so malformed verdicts can pass extraction. Use an object-and-decisionpredicate in both fast paths.extract_verdict_jsonis defined twice at lines 2004 and 3244; update the active definition or remove the duplicate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/engine.sh` around lines 2004 - 2031, Update both fast-path validations in extract_verdict_json to require a JSON object containing the decision field, rather than accepting any jq-valid JSON. Apply the same predicate to the duplicate extract_verdict_json definition or remove the duplicate, ensuring the active implementation rejects null, arrays, and objects without decision.
2046-2058: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftProtect the fixed sidecar paths from symlink writes.
The fixed
/tmppaths use shell redirection afterrm -f. A process with runner access can race these operations or pre-create a symlink before the first write. This affects reset, failure, timeout, and session-output sidecars.Use an owner-only state directory with atomic, no-follow writes. Update all readers while preserving their contract.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/engine.sh` around lines 2046 - 2058, Replace the fixed /tmp sidecar files used by the reset, failure, timeout, and session-output flows with files inside an owner-only state directory, creating it securely if needed. Update every corresponding reader and writer to use the new paths, and perform writes atomically with no symlink following rather than shell redirection after rm -f; preserve each existing reader’s contract and sidecar contents.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-automerge.yml:
- Line 38: Remove the NOSONAR annotation from the reusable workflow reference in
the thin caller stub, leaving the first-party channel reference
dependabot-automerge/v2-next unchanged.
In @.github/workflows/pr-review.yml:
- Around line 428-496: Remove two of the three duplicate “Verify auth scopes”
steps in the job, keeping exactly one complete self-contained step with the
existing auth and scope validation logic. Ensure the remaining step still runs
once and preserve its current behavior and diagnostics.
- Around line 422-426: In the review job, remove the duplicate Claude CLI cache
steps surrounding “Cache claude-code CLI,” leaving exactly one cache step for
~/.npm-global with the existing key. Ensure the retained actions/cache reference
uses version v6.1.0.
In `@scripts/dev-lead-fix-reviews.sh`:
- Around line 1084-1169: Remove the duplicated appended blocks: in
scripts/dev-lead-fix-reviews.sh#L1084-L1169 delete the duplicate commit_and_push
while retaining post_reviews_terminal; in
scripts/dev-lead-fix-reviews.sh#L1423-L1720 delete the shadowed
NOOP_MARKER_PREFIX, pr_nets_to_zero, flag_noop_pr,
expire_stale_terminal_markers, expire_stale_rate_limited_marker,
post_reviews_rate_limited, and handle_rate_limit; in
scripts/dev-lead-fix-reviews.sh#L2045-L2276 delete the shadowed expire_*,
post_reviews_rate_limited, handle_rate_limit, and detect_conflicting_paths
definitions; and in scripts/dev-lead-fix-ci.sh#L192-L231 delete the duplicate
post_rate_limited, preserving the earlier definitions. Inspect the rest of the
PR for any other appended duplicate blocks.
---
Outside diff comments:
In @.github/workflows/pr-review.yml:
- Around line 106-119: Update the concurrency group expression around the PR URL
and SHA fallbacks so check_suite events are keyed by
github.event.check_suite.head_sha rather than pull_requests[0].number. Ensure
SHA-bearing check_suite and direct pull_request events resolve to the same group
for the same commit, while preserving the existing client_payload and PR URL
fallbacks.
In `@scripts/dev-lead-fix-reviews.sh`:
- Around line 2735-2883: Remove the duplicate definitions of
post_reviews_rate_limited and the other helper functions in the script,
retaining exactly one canonical definition of each helper and preserving its
current behavior. Then rerun the repository’s ShellCheck command and resolve any
warnings introduced by the cleanup, keeping the result warning-free.
In `@scripts/engine.sh`:
- Around line 3061-3073: Update run_writer so streamed stdout is passed through
the same secret-redaction patterns before tee publishes it to the workflow log,
while preserving the unredacted capture used for rate-limit detection. Keep the
existing redaction behavior anchored to redact_secrets and ensure only published
output is sanitized, not the raw diagnostic data.
- Around line 2778-2792: Update the run_writer_with_fallback wrapper to remove
or reset /tmp/dev-lead-rate-limit-reset immediately on entry, before any
fallback engine attempts or early returns. Preserve the existing failure-reason
handling and return codes.
- Around line 2004-2031: Update both fast-path validations in
extract_verdict_json to require a JSON object containing the decision field,
rather than accepting any jq-valid JSON. Apply the same predicate to the
duplicate extract_verdict_json definition or remove the duplicate, ensuring the
active implementation rejects null, arrays, and objects without decision.
- Around line 2046-2058: Replace the fixed /tmp sidecar files used by the reset,
failure, timeout, and session-output flows with files inside an owner-only state
directory, creating it securely if needed. Update every corresponding reader and
writer to use the new paths, and perform writes atomically with no symlink
following rather than shell redirection after rm -f; preserve each existing
reader’s contract and sidecar contents.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 62281d96-7a51-4012-84fb-f25da4123e46
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (10)
.github/workflows/dependabot-automerge.yml.github/workflows/pr-review.yml.github/workflows/test-dev-lead.yml.gitignoreprompts/shared.mdscripts/dev-lead-fix-ci.shscripts/dev-lead-fix-reviews.shscripts/engine.shscripts/review-one-pr.shtests/test_dependabot.bats
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1378 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Superseded by automated re-review at
|
Superseded by automated re-review at
|
Superseded by automated re-review at
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1378 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 0bdc72cb7991ccce81988f9c7bd48027335d82ac
Cascade: triage → deep (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)
Summary
Standards-sync PR (XXL) updating org workflows and review-pipeline scripts. Triage's primary concern — removal of the auth-scope verification block from pr-review.yml — is a false alarm: the PR base (remote main) contained two byte-identical 'Verify auth scopes' blocks and this PR removes one duplicate; the full check remains intact in the head (line ~278) and the workflow_call interface is byte-identical base-vs-head, so the 8 downstream consumers are unaffected. The .gitleaksignore edit merely re-fingerprints the same known fake test-fixture keys against a new subtree-import commit SHA (not a new secret), and the large engine.sh/dev-lead-fix-reviews.sh refactors show no security anti-patterns; all CI (shellcheck, CodeQL, SonarCloud, gitleaks, CodeRabbit) is green.
Downstream impact
This change is consumed by 8 downstream repo(s) that pin the affected reusable workflow / lib / prompt. Impacted consumers:
Impacted shared surfaces:
- .github/workflows/dev-lead-reusable.yml
- .github/workflows/pr-review.yml
Impacted consumers (8, fetching up to 10):
- petry-projects/.github (pins .github/workflows/dev-lead-reusable.yml)
.github/workflows/dev-lead.yml
- petry-projects/.github-private (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
.github/workflows/dev-lead.yml
.github/workflows/pr-review-canary.yml
.github/workflows/pr-review-trigger.yml
.github/workflows/test-dev-lead.yml
- petry-projects/ContentTwin (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
.github/workflows/dev-lead.yml
.github/workflows/pr-review.yml
- petry-projects/TalkTerm (pins .github/workflows/dev-lead-reusable.yml)
.github/workflows/dev-lead.yml
- petry-projects/bmad-bgreat-suite (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
.github/workflows/dev-lead.yml
.github/workflows/pr-review.yml
- petry-projects/broodly (pins .github/workflows/dev-lead-reusable.yml)
.github/workflows/dev-lead.yml
- petry-projects/google-app-scripts (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
.github/workflows/dev-lead.yml
.github/workflows/pr-review.yml
- petry-projects/markets (pins .github/workflows/dev-lead-reusable.yml,.github/workflows/pr-review.yml)
.github/workflows/dev-lead.yml
.github/workflows/pr-review.yml
Findings
- INFO [security]
.github/workflows/pr-review.yml:278: pr-review.yml removes a DUPLICATE inlined 'Verify auth scopes' step (base had 2 identical blocks; head retains 1 complete block at ~line 278). Fine-grained-PAT detection and repo/read:org + contents/pull_requests scope validation are fully preserved. Not a security regression. - INFO [compatibility]
.github/workflows/pr-review.yml: Reusable workflow_call interface (inputs/secrets) is byte-identical between base and head; the 8 downstream consumer repos pinning pr-review.yml/dev-lead-reusable.yml (petry-projects/.github, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets, .github-private) remain backward compatible. Downstream impact is informational only. - INFO [secret]
.gitleaksignore: .gitleaksignore change re-fingerprints the same 5 known fake test-fixture API keys (same files/lines/rule generic-api-key) against subtree re-import commit 95fe0d4; not masking any new/real credential. gitleaks CI passed. - INFO [maintainability]: Large refactor of scripts/engine.sh (+2073) and scripts/dev-lead-fix-reviews.sh (+1261) plus new list-prs.sh/review-one-pr.sh orchestration. Added lines contain no eval/curl|bash/token-echo smells; shellcheck, CodeQL(actions,python), SonarCloud, CodeRabbit all green.
- INFO [process]: run_secret_scanning MCP tool not available in this environment; skipped per instructions. Advisory bots yielded no actionable findings (Codex usage-limited, Gemini unsupported file types, SonarCloud quality gate passed).
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.
2 participants
User description
Syncs the following org-standard workflow stub(s) from
petry-projects/.github(standards/workflows/), deployed verbatim:dev-lead.ymlagent-shield.ymldependabot-rebase.ymlpr-auto-review.ymlOpened by
scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. Seestandards/ci-standards.md. Labeledstandards-syncand left for the normal review/auto-merge pipeline — the deploy script never merges directly.Summary by CodeRabbit
Workflow Improvements
Bug Fixes
Documentation
Maintenance
CodeAnt-AI Description
Make automated PR reviews safer, more resilient, and better informed
What Changed
Impact
✅ Fewer self-cancelling fixes✅ More reliable automated review retries✅ Current bot feedback reaches triage✅ Safer review logs💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.