feat: implement issue #216 — [Fleet Monitor] petry-projects/ContentTwin — pr-auto-review.yml - #249
Conversation
…in — pr-auto-review.yml
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
Updates the repository settings automation script to adjust the fork-PR contributor approval policy so that PR Auto-Review workflow runs are less likely to be gated as action_required, addressing the elevated failure rate flagged in issue #216.
Changes:
- Adds a GitHub Actions fork-PR contributor approval policy update (
first_time_contributors_new_to_github) viagh api. - Adds a lightweight verification step to fetch and report the configured
approval_policy.
|
Warning Review limit reached
More reviews will be available in 50 minutes and 15 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe script now configures and verifies a GitHub fork-PR contributor approval policy. After disabling the Claude app's check-suite auto-trigger, it sets ChangesFork PR Contributor Approval Policy
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates scripts/apply-repo-settings.sh to loosen the fork pull request contributor approval policy to first_time_contributors_new_to_github. However, the review highlights a critical issue: the GitHub REST API endpoint used to set this policy does not exist, and the script needs to be updated to use the correct workflow permissions endpoint.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/apply-repo-settings.sh`:
- Around line 93-99: The POLICY read-back currently swallows failures and only
warns on mismatch; change the gh api call used to set POLICY (gh api
"repos/$REPO/actions/permissions/fork-pr-contributor-approval") to detect
failure and exit non-zero: run the gh api command without redirecting stderr,
capture its exit status, and if it fails print an error and exit 1; then compare
the captured POLICY value to "first_time_contributors_new_to_github" and if it
does not match print an error and exit 1 (instead of just warning), ensuring the
script fails hard when the API read or policy verification fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f3b6a040-be99-4796-b0bd-22191770b426
📒 Files selected for processing (1)
scripts/apply-repo-settings.sh
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
6 similar comments
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 0b01c2cdfcde66226af6a5e1b4a0e4d358b00a72
Review mode: triage-approved (single reviewer)
Summary
PR #216 fix: apply-repo-settings.sh now sets the fork-PR contributor approval policy to first_time_contributors_new_to_github and verifies it, so the Copilot reviewer bot stops landing workflow runs in action_required purgatory (which had pushed pr-auto-review.yml over the fleet-monitor failure threshold). Small (+36/-0, 2 files), test-covered, all CI green.
Linked issue analysis
Closes #216. The root cause was the default first_time_contributors policy treating the Copilot PR-reviewer bot as a first-time contributor on each PR, gating its pull_request_review workflow runs to action_required, which fleet_monitor.sh counts as failures. Narrowing the policy to first_time_contributors_new_to_github addresses this directly while still gating genuinely new-to-GitHub fork contributors. Substantively addressed.
Findings
- Change is self-verifying: under
set -euo pipefail, thegh api -X PUTand the read-backgh api ... --jq .approval_policyboth hard-fail (exit 1) on any API error or value mismatch, so a wrong endpoint/payload would surface loudly rather than silently misreport success. - A prior bot review (gemini) flagged the
actions/permissions/fork-pr-contributor-approvalendpoint as non-existent. This is the documented GitHub REST endpoint for fork-PR contributor approval and acceptsapproval_policy; the HEAD code uses it correctly. That thread is resolved/outdated. - Minor (non-blocking): the author's final thread comment states the endpoint was switched to
actions/permissionswithenabled_for_fork_pull_requests, but HEAD still usesfork-pr-contributor-approval+approval_policy. HEAD is the correct form, so this is a stale comment, not a code defect — worth a glance to confirm intent. - Security note: this loosens a GitHub Actions fork-PR approval control, but the scope is narrow (only accounts new to GitHub are now exempted) and well-justified in an inline comment. bats test covers the new branch.
CI status
All 3 checks green: CodeQL / Analyze (actions) SUCCESS, CodeRabbit SUCCESS. SonarQube Cloud quality gate passed (0 new issues). mergeable=MERGEABLE (mergeStateStatus BLOCKED pending this required review). No failing or pending checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
|
CI Failure: SonarCloud Code AnalysisStep: Quality Gate (SonarCloud Code Analysis) SonarCloud detected 10 new Security Hotspots in the changes introduced by this PR. The added shell script code in Suggested fix: Open the SonarCloud Security Hotspots dashboard, review each of the 10 hotspots, and either mark confirmed false-positives as "Safe" (if the values are provably static) or refactor the API call to use |
Closes #216
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit