feat: implement issue #883 — [Phase 1] Parameterize initiative-driver.yml on target_repo + bats for a non-self sweep - #893
Conversation
….yml on target_repo + bats for a non-self sweep
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe ChangesCross-repo targeting in initiative-driver
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new BATS test case to tests/test_initiative_driver.bats to verify cross-repository sweep behavior. The test ensures that when a non-self target repository is specified, all GitHub API queries and label operations are correctly qualified to that target repository. There are no review comments, and I have no feedback to provide.
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T16:05:44Z. |
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 558b49627233b225fc6c311958f3c8fb35245872
Review mode: triage-approved (single reviewer)
Summary
Workflow-only parameterization of .github/workflows/initiative-driver.yml to accept an optional target_repo workflow_dispatch input (REPO = target_repo || github.repository) with concurrency keyed per target repo, plus a bats case asserting a non-self sweep. Mirrors the already-merged initiative-planner.yml pattern; scripts/initiative-driver.sh is correctly left untouched.
Linked issue analysis
Closes #883. All five acceptance criteria are met: (1) target_repo input added and REPO resolves to target_repo || github.repository; (2) concurrency.group rekeyed to initiative-driver-${{ ... target_repo || github.repository }}, removing the single global lane; (3) the Drive step's GH_PAT_WORKFLOWS guard is unchanged (not touched by the diff); (4) scripts/initiative-driver.sh is unchanged; (5) tests/test_initiative_driver.bats gains a non-self target_repo case asserting every gh read and the release 'gh issue edit --repo other/repo --add-label dev-lead' target the foreign repo and that .github-private is never touched.
Findings
No blocking issues.
- target_repo is a workflow_dispatch input (requires write access to trigger) and flows only into env: REPO and the concurrency: key — not interpolated into any run: shell block — so there is no Actions template-injection sink. The script consumes it as a quoted "$REPO" env var. Pattern matches the proven initiative-planner.yml.
- New bats test is well-scoped: positively asserts target-repo-qualified reads/labeling and negatively asserts no self-repo leakage.
- Secret-scanning MCP tool not exposed in this environment; relied on gitleaks CI (passed). Diff contains no credentials.
- Advisory bots CodeRabbit and Codex were rate-limited (no substantive review); gemini-code-assist reviewed with no feedback and SonarCloud Quality Gate passed. Rate-limit reset (16:05Z) has elapsed.
CI status
All required checks green. SUCCESS: CI (Lint, ShellCheck, bats, gh-aw-compile, Agent Security Scan, Secret scan/gitleaks, Compile agentic workflows), CodeQL (actions + python), SonarCloud, AgentShield, holdout-guard, Test-Deletion Guard, unit-tests, validate-agent-profiles, review/review. SKIPPED: dependency-audit ecosystems, dependabot-automerge (expected). mergeStateStatus is BLOCKED pending the required org-leads team review (human gate), not a failing check.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #893 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T17:23:29Z. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: e21585a841a9b70f1fa1b6016c753e54adca202f
Review mode: triage-approved (single reviewer)
Summary
Phase-1 parameterization of initiative-driver.yml on an optional target_repo input (REPO = target_repo || github.repository), with concurrency keyed per target repo, plus a bats test asserting a non-self cross-repo sweep. +55/-4 across 2 files (workflow + test). Scope matches issue #883 exactly; the orchestration script is left unchanged as required.
Linked issue analysis
Closes #883. All 5 acceptance criteria are met: (1) optional target_repo workflow_dispatch input added; REPO env resolves to target_repo when set else github.repository (workflow L62); (2) concurrency.group keyed per target repo (initiative-driver-${target_repo||github.repository}), mirroring initiative-planner.yml; (3) Drive step still uses GH_PAT_WORKFLOWS as GH_TOKEN and the PAT-present guard is retained (L90-93); (4) scripts/initiative-driver.sh untouched; (5) new bats case verifies that a REPO=other/repo sweep repo-qualifies every gh read and the release 'gh issue edit --repo other/repo --add-label dev-lead', and asserts nothing leaks to .github-private.
Findings
No blocking findings. Schedule/close (non-dispatch) events leave target_repo empty, so REPO and the concurrency group fall back to github.repository — self/dogfood behavior is preserved. The test mocks gh and exercises the script's REPO plumbing directly; the workflow→script wiring is straightforward env passing. gemini-code-assist reviewed with no feedback. MCP secret scanning tool unavailable in this environment; gitleaks CI check passed and the diff introduces no secrets/credentials.
CI status
All required checks green: shellcheck, bats, unit-tests, CodeQL (actions+python), gitleaks, SonarCloud, agent-shield/AgentShield, holdout-guard, validate-agent-profiles, gh-aw-compile, and more. The CANCELLED/SKIPPED entries are superseded duplicate runs whose successful re-runs are present. reviewDecision=APPROVED (donpetry-bot).
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
Closes #883
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
New Features
Tests