feat: implement issue #836 — Make initiative-driver / pr-auto-review / feature-ideation standard deployable shims (+ canonical-PAT migration) - #837
Conversation
…/ feature-ideation standard deployable shims (+ canonical-PAT migration)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 13 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe deployment script adds three standard workflow stubs, preserves existing ChangesStandard workflow deployment and credential migration
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant deploy-standard-workflows.sh
participant GitHub API
participant Target repository
deploy-standard-workflows.sh->>GitHub API: Query workflow contents and release tags
GitHub API-->>deploy-standard-workflows.sh: Existing body or missing stub plus tier ref
deploy-standard-workflows.sh->>Target repository: Seed template or re-pin existing body
Target repository-->>deploy-standard-workflows.sh: PR creation result
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #837 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds three new deployable workflows (initiative-driver.yml, pr-auto-review.yml, and feature-ideation.yml) to the deployment script, introducing a body-preserving mechanism for workflows with per-repo configurations, updating credential fallbacks to use GH_PAT_DON_PETRY, and adding BATS tests. The review feedback highlights potential script failures under set -e due to grep commands running on templates without uses: lines, recommends implementing a global cleanup array with an EXIT trap for temporary files, and suggests replacing the while loop assertions in the BATS tests with grep -v to prevent false positives.
There was a problem hiding this comment.
Pull request overview
Promotes initiative-driver, pr-auto-review, and feature-ideation into standard deployable workflow stubs and migrates their PAT wiring to a canonical-first secret fallback, with deploy-script logic to avoid clobbering feature-ideation’s per-repo project_context.
Changes:
- Migrates PAT usage in the three workflow templates to
${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}(with the by-name secret pass preserved forpr-auto-review). - Adds the three workflows to
DEPLOYABLE_WORKFLOWS, and implements “seed-if-absent + re-pin-in-place” handling forfeature-ideation.ymlto preserve per-repo tuned bodies. - Adds Bats tests covering the new secret wiring and the deploy-script’s feature-ideation seed/repin behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
standards/workflows/pr-auto-review.yml |
Updates the reusable secret pass to canonical-first fallback while keeping the passed secret key name GH_PAT_WORKFLOWS. |
standards/workflows/initiative-driver.yml |
Updates GH_TOKEN env wiring to canonical-first PAT fallback in guard + dispatch steps. |
standards/workflows/feature-ideation.yml |
Updates redispatch guard + redispatch step GH_TOKEN wiring to canonical-first PAT fallback. |
scripts/deploy-standard-workflows.sh |
Adds the three workflows to the deploy sweep and introduces body-preserving workflow handling for feature-ideation. |
test/workflows/pr-auto-review/stub-secrets.bats |
Tests canonical-first fallback and ensures the reusable secret pass remains keyed as GH_PAT_WORKFLOWS. |
test/workflows/initiative-driver/stub-secrets.bats |
Tests canonical-first fallback wiring for initiative-driver’s runtime GH_TOKEN env. |
test/workflows/feature-ideation/stub-secrets.bats |
Tests canonical-first fallback wiring for feature-ideation redispatch GH_TOKEN env without altering reusable secrets. |
test/scripts/deploy-standard-workflows/feature-ideation-seed-repin.bats |
Tests the deploy script’s seed-if-absent vs repin-in-place behavior (and pin emission) for feature-ideation, plus coverage for the new workflows’ dry-run outputs. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
@donpetry-bot all checks green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot green on |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 195ffc45208744fec00040975eb60dbbc7706e37
Cascade: triage → audit (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)
Summary
PR #837 migrates three fleet-wide workflow templates from bare secrets.GH_PAT_WORKFLOWS to the canonical-first chain secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS and makes them standard-deployable. The migration is explicitly authorized by issue #836 as part of the documented org-wide PAT retirement (.github-private#1326); both secret names carry the same underlying PAT, so behavior and blast radius are unchanged until the legacy secret is deleted. No injection vectors, the new CI workflow's checkout SHA pin was verified against the GitHub API as genuine v7.0.0, lockfile diffs are name-field-only with zero dependency changes, all security scans (gitleaks, CodeQL, npm audit, SonarCloud, AgentShield) pass at head SHA, and the CODEOWNERS human-review gate remains in force.
Findings
- INFO: Canonical-PAT migration is value-identical (issue #836 states GH_PAT_DON_PETRY is the same don-petry PAT already provisioned org-wide as GH_PAT_WORKFLOWS). The || fallback prevents breakage on repos lacking the canonical secret. New bats suites pin the exact wiring, including the by-name-pass footgun in pr-auto-review.yml where only the VALUE changes and the passed key stays GH_PAT_WORKFLOWS. (
standards/workflows/pr-auto-review.ymlline 58) - MINOR: Fleet-wide privileged workflow_dispatch routes through a person-named PAT (GH_PAT_DON_PETRY). This concentration/rotation risk is pre-existing org policy (same PAT previously named GH_PAT_WORKFLOWS), not introduced by this PR, but the org should track migrating to a GitHub App or org-owned machine credential to decouple automation from an individual account. (
standards/workflows/initiative-driver.ymlline 76) - MINOR: Guard error messages still read '::error::GH_PAT_WORKFLOWS is required' after GH_PAT_DON_PETRY became the preferred secret — slightly misleading during incident response once the legacy secret is deleted. Cosmetic; fix in a follow-up. (
standards/workflows/initiative-driver.ymlline 79) - INFO: New initiative-driver-tests.yml is sound: pull_request trigger (not pull_request_target), permissions: contents: read, timeout + concurrency set, and actions/checkout pinned to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 — verified via the GitHub API to be the authentic v7.0.0 tag commit. (
.github/workflows/initiative-driver-tests.ymlline 47) - INFO: Only raw run-block interpolation is ${{ github.repository }} in initiative-driver.yml (non-attacker-controlled, constrained charset, pre-existing line unchanged by this PR). Event-derived values (discussion.number, dispatch inputs) use env-var indirection. The discussion:created redispatch bridge is gated to non-bot authors in the Ideas category. (
standards/workflows/initiative-driver.ymlline 89) - INFO: package-lock.json and node_modules/.package-lock.json diffs change only the top-level name field (pr-834 -> pr-837); no packages added, removed, or re-versioned. gitleaks and npm audit green at head SHA 195ffc4. (
package-lock.jsonline 2)
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.
Closes #836
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
New Features
Bug Fixes
Tests