feat: implement issue #385 — Migrate pr-review.yml caller to secrets: inherit (last by-name pr-review caller) - #394
Conversation
…: inherit` (last by-name pr-review caller)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR review workflow now uses ChangesSecret inheritance
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates TalkTerm’s PR Review Agent workflow caller to forward secrets using secrets: inherit, aligning with the org-standard reusable workflow caller pattern and removing the last by-name secret mapping for pr-review in this repo.
Changes:
- Replaced the explicit per-secret mapping in
.github/workflows/pr-review.ymlwithsecrets: inheritfor the reusablepr-review.ymlcall. - Updated the workflow header comments to reflect the new secret-forwarding mechanism and rationale.
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
🤖 CodeAnt AI — Review Status
|
|
Approved by human |
codeant-ai
Bot
added
the
size:XS
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #394 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-review.yml:
- Around line 22-24: Update the documentation comments in the pr-review workflow
to name the exact inherited secrets consumed by the reusable workflow, including
DON_PETRY_BOT_GH_PAT_CLASSIC and its DON_PETRY_BOT_GH_PAT fallback; remove
references to org workflow names such as GH_PAT_DON_PETRY.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e9bbad37-3389-410f-9244-9b87ae5b2e1f
📒 Files selected for processing (1)
.github/workflows/pr-review.yml
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 533b63c3f203026fdf7f29c369bcec8ab5f71cf3
Cascade: triage → audit (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)
Summary
PR #394 replaces six by-name secret mappings with secrets: inherit in TalkTerm's pr-review.yml caller, the last by-name caller in the org (closes #385). Verified at head SHA 533b63c: the identical inherit + moving-tag pattern already exists in the same repo (dev-lead.yml) and in six other pr-review callers, so this PR adds zero marginal secret exposure — anyone able to repoint tags in .github-private already receives the full inherited set via existing callers. Triggers are plain pull_request (not pull_request_target, and fork PRs receive no secrets), top-level permissions: {} with minimal job permissions, callee is a first-party same-org private reusable, and all security scanners (gitleaks, CodeQL actions+python, SonarCloud, agent-shield) pass at the pinned head. Risk held at MEDIUM per round-up policy for secrets-handling changes, but the change is safe to approve; the only remaining gate is the required org-leads human review per CODEOWNERS.
Downstream impact
This change is consumed by 5 downstream repo(s) that pin the affected reusable workflow / lib / prompt. Impacted consumers:
Impacted shared surfaces:
- .github/workflows/pr-review.yml
Impacted consumers (5, fetching up to 10):
- petry-projects/.github-private (pins .github/workflows/pr-review.yml)
.github/workflows/pr-review-canary.yml
.github/workflows/pr-review-trigger.yml
.github/workflows/test-dev-lead.yml
- petry-projects/ContentTwin (pins .github/workflows/pr-review.yml)
.github/workflows/pr-review.yml
- petry-projects/bmad-bgreat-suite (pins .github/workflows/pr-review.yml)
.github/workflows/pr-review.yml
- petry-projects/google-app-scripts (pins .github/workflows/pr-review.yml)
.github/workflows/pr-review.yml
- petry-projects/markets (pins .github/workflows/pr-review.yml)
.github/workflows/pr-review.yml
Findings
- INFO:
secrets: inheritbroadens the forwarded set beyond the prior six named secrets, but the marginal exposure is zero: TalkTerm's own dev-lead.yml (line 67) and six other org callers already forwardsecrets: inheritto moving-tag reusables in the same petry-projects/.github-private repo. The prior explicit list already included the highest-value credentials (classic PATs capable of PR approval), so the compromise scenario (repointed tag in .github-private) yields no new capability from this change. - MINOR: Confirming deep-review finding: the moving
pr-review/stabletag ref is a deliberate, documented org convention (Dependabot SHA-bump incident #310, canonical NOSONAR exemption #549) and is pre-existing, not introduced here. The moving-tag + inherit combination is acceptable for this trust boundary because tag control requires write access to the same-org private .github-private repo, which is already equivalent to secret access via the seven existing inherit-based callers. Recommend (non-blocking) the org eventually adopt signed/immutable release refs for the reusable channel to shrink this standing trust assumption. - INFO: Trigger and permissions posture verified at head:
on: pull_request/check_suite/pull_request_review/workflow_dispatch/repository_dispatch— nopull_request_target; fork-originated pull_request events do not receive secrets, and this PR's head branch is same-repo. Top-levelpermissions: {}with job-level contents:read, pull-requests:write, checks:read. Concurrency group expression composes only non-attacker-controlled values (head SHA, dispatch inputs, run_id) and is not shell-interpolated — no expression-injection surface. - INFO: Diff contains secret names only, no values (gitleaks SUCCESS). CodeRabbit's sole actionable comment is resolved in the head commit (header now names DON_PETRY_BOT_GH_PAT_CLASSIC with DON_PETRY_BOT_GH_PAT fallback; stale GH_PAT_DON_PETRY reference gone). mergeStateStatus BLOCKED reflects only the required @petry-projects/org-leads CODEOWNERS review, not a failing check; CANCELLED dev-lead runs are the agent's own superseded self-runs.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 533b63c3f203026fdf7f29c369bcec8ab5f71cf3
Review mode: triage-approved (single reviewer)
Summary
XS single-file change migrating TalkTerm's pr-review.yml caller from by-name secret passing to 'secrets: inherit', exactly as specified in issue #385. The target reusable workflow is first-party (petry-projects/.github-private) pinned to the pr-review/stable channel ref, and this matches the pattern already used by the org's 6 other pr-review callers and TalkTerm's own dev-lead.yml. Header comments were updated coherently. Triage assessment (low-risk, mechanical alignment change) is confirmed correct.
Linked issue analysis
Closes #385 (now CLOSED). Acceptance criteria met verbatim: the explicit 6-entry 'secrets:' block is replaced with 'secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable', matching the canonical caller-stub form. This unblocks the Copilot-token cleanup tracked in .github-private#1327/#1326.
Findings
- No secret values added or exposed; the diff only removes by-name secret plumbing. Gitleaks check: SUCCESS. (run_secret_scanning MCP tool unavailable in this environment — gitleaks CI covers the scan.)
- 'secrets: inherit' is scoped to a first-party, same-org reusable pinned via channel ref (NOSONAR S7635/S7637 annotations present) — not a third-party trust expansion.
- The single CodeRabbit review thread (minor, security/privacy) is resolved and outdated.
- Prior automated review at this same head SHA approved at MEDIUM risk; a human ('Approved by human') also signed off. No unanswered human questions.
- Rated MEDIUM (not LOW) because the change touches CI secret-forwarding mechanics, albeit mechanically and per org standard.
CI status
All completed checks passing: AgentShield, gitleaks, CodeQL (actions + python), SonarCloud (quality gate passed), CodeRabbit, Graphite AI Reviews, pr-auto-review dispatch. A few 'dev-lead / dispatch' and 'dev-lead / ci-relay' lanes show CANCELLED — these are concurrency-deduplicated duplicates of lanes that completed SUCCESS at the same SHA, not failures. Remaining checks SKIPPED by design (ecosystem-specific audits).
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
User description
Closes #385
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Forward all repository secrets automatically to the PR Review workflow
What Changed
Impact
✅ Fewer workflow failures from missing secrets✅ Easier adoption of newly required review credentials✅ Reliable automated PR approvals💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit