feat: implement issue #343 — Compliance: stub-surface-drift-dependency-audit.yml-concurrency - #356
feat: implement issue #343 — Compliance: stub-surface-drift-dependency-audit.yml-concurrency#356don-petry wants to merge 2 commits into
Conversation
…y-audit.yml-concurrency
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the dependency-audit-workflow.bats test script to assert that the thin caller stub does not define a top-level concurrency block, replacing previous tests that verified concurrency group definition and cancellation. Feedback suggests using a safe fallback (or {}) when loading the YAML file to prevent a potential TypeError if the file is empty.
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Removes the repository-local GitHub Actions concurrency block from the dependency audit workflow and updates the Bats audit tests to enforce parity with the centrally managed canonical workflow.
Changes:
- Removed top-level
concurrencyconfiguration from.github/workflows/dependency-audit.yml. - Replaced concurrency-positive assertions with a test ensuring the stub workflow does not define
concurrency. - Updated test documentation/comments to reflect centralized ownership of workflow semantics.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| scripts/tests/dependency-audit-workflow.bats | Updates tests to assert absence of top-level concurrency on the thin caller stub. |
| .github/workflows/dependency-audit.yml | Removes repository-local concurrency block so the workflow matches the canonical source. |
| permissions: | ||
| contents: read | ||
|
|
||
| # Cancel a superseded in-progress run on the same ref so a new push/PR commit | ||
| # doesn't race an older run — trims redundant concurrent runs (issue #264). | ||
| # Caller-local reliability addition; mirrors ci.yml. Does not alter the trigger | ||
| # events, the `uses:` line, or the job name (the required status check). | ||
| concurrency: | ||
| group: dependency-audit-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| dependency-audit: | ||
| uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref |
There was a problem hiding this comment.
Acknowledged. The removal is intentional: the stub is meant to be a verbatim copy of the canonical workflow (petry-projects/.github/standards/workflows/dependency-audit.yml), which defines no top-level concurrency block. Adding concurrency behaviour to the centrally-owned reusable workflow (dependency-audit-reusable.yml) is the right long-term home for it — that change belongs in a PR against petry-projects/.github, outside the scope of this stub-alignment PR.
There was a problem hiding this comment.
No code change needed. @don-petry's explanation covers it: the stub must be a verbatim copy of the canonical workflow (petry-projects/.github/standards/workflows/dependency-audit.yml), which defines no top-level concurrency block, so the stub must not either. All 7 bats tests pass, including the new no top-level concurrency block (matches canonical) assertion in scripts/tests/dependency-audit-workflow.bats. Adding concurrency behaviour to the reusable workflow is the right long-term home and belongs in a separate PR against petry-projects/.github.
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
|
Closing as part of the 50-PR cap drain. The dev-lead fix-loop repairs #1340 (self-cancellation), #1290 (comment-inertness) and #806 (thread-resolution) have all landed, so this deadlocked PR can be regenerated cleanly through the repaired loop. The driving issue stays open and its dev-lead label is re-fired — no work is lost. |
Pull request was closed
Closes #343
Implemented by dev-lead agent. Please review.