feat: implement issue #371 — Compliance: stub-surface-drift-feature-ideation.yml-permissions - #398
Conversation
…deation.yml-permissions
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe workflow adds a ChangesFeature ideation workflow
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant GitHubEvent as GitHub event
participant prep as prep job
participant ideate as ideate job
participant ReusableWorkflow as reusable workflow
GitHubEvent->>prep: Provide workflow_dispatch inputs
prep->>prep: Apply defaults and expose outputs
prep->>ideate: Provide resolved outputs
ideate->>ReusableWorkflow: Pass resolved workflow parameters
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-21T23:13:29Z. |
There was a problem hiding this comment.
Pull request overview
Synchronizes TalkTerm’s feature-ideation.yml caller stub with the org-standard template to resolve the compliance finding in #371 (permissions surface drift) and to incorporate upstream fixes for dispatch/input handling.
Changes:
- Re-sync the
feature-ideation.ymlstub structure to match the central standard, including the standardizedprepjob output pattern used to avoidinputs.*evaluation failures. - Update redispatch PAT resolution to accept
GH_PAT_DON_PETRYas a fallback toGH_PAT_WORKFLOWS. - Route reusable-workflow
with:values throughneeds.prep.outputs.*(and cast booleans viafromJSON) to keep the reusable call graph valid ondiscussionevents.
Superseded by automated re-review at
|
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
🤖 CodeAnt AI — Review Status
|
codeant-ai
Bot
added
the
size:M
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/feature-ideation.yml:
- Around line 157-164: Update the workflow output serialization around the
focus_area output block to use GitHub Actions multiline delimiter syntax,
preserving embedded newlines in FOCUS_AREA safely. Keep the existing defaults
and serialization for TARGET_DISCUSSION, RESEARCH_DEPTH, DRY_RUN, and
ENHANCE_BACKLOG unchanged, then re-sync the generated caller workflow as
requested.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a6bb2fe5-5e46-40b6-ae56-98248d1a3290
📒 Files selected for processing (1)
.github/workflows/feature-ideation.yml
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: b50572c15d5db607e1d52c06a3d13c056016ff11
Cascade: triage → audit (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)
Summary
The deep review's HIGH-risk premise is refuted: the canonical org standard (petry-projects/.github/standards/workflows/feature-ideation.yml, lines 110/118) already carries GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS verbatim, so this PR is a faithful re-sync of the thin caller stub, not stub auth drift. The permissions surface (root permissions: {}, redispatch/prep permissions: {}, ideate's least-privilege block) now matches the standard exactly, resolving compliance issue #371, and the only deviations from the template are explicitly permitted (project_context, tier channel pin v1-ring1) or strictly safer (random-delimiter heredoc for focus_area, preventing GITHUB_OUTPUT line injection that the standard's plain echo permits). No expression injection (all event data is env-bound), no new secret exposure, gitleaks/CodeQL-actions/AgentShield all green — approving with an org-level advisory that the personal-PAT pattern should be replaced centrally with a GitHub App or machine account.
Findings
- MINOR: Advisory (org-level, not PR-blocking): the canonical standard's
GH_PAT_DON_PETRY || GH_PAT_WORKFLOWSpattern binds org automation to a named individual's PAT (rotation/offboarding/bus-factor risk, broad-scope credential, misattributed automation). This PR merely mirrors the standard — the correct remediation is a PR against petry-projects/.github replacing the personal PAT with a GitHub App installation token or dedicated machine-account PAT, which will then propagate to all stubs. Blocking this compliance re-sync would itself create stub drift. - INFO: Two benign deviations from the verbatim template remain: (1) the guard error message names GH_PAT_DON_PETRY while the standard's message names only GH_PAT_WORKFLOWS — the PR's message is actually more accurate than the standard's; (2) the focus_area heredoc with
openssl rand -hex 8delimiter is a security hardening over the standard'secho "focus_area=${FOCUS_AREA:-}", which is vulnerable to GITHUB_OUTPUT key injection via multi-line input. Neither touches the forbidden surfaces (triggers, permissions, uses:, secrets:). Recommend upstreaming the heredoc pattern to the central standard so future compliance audits don't flag it as drift. - INFO: Injection surface reviewed: all github.event.* values reach shell via env vars (no inline expression interpolation into run: blocks); target_discussion on the redispatch path is a numeric discussion.number; free-form dispatch inputs (target_discussion, focus_area) are only settable by actors with write access, who already control all inputs directly — a multi-line value injected into prep's plain-echo outputs yields no privilege beyond what the actor already has, and prep runs with
permissions: {}. fromJSON casts on dry_run/enhance_backlog operate on GitHub-validated typed boolean inputs. - INFO: PR is MERGEABLE but mergeStateStatus=BEHIND main; all required checks green at head b50572c (gitleaks, CodeQL actions analysis, SonarCloud, AgentShield, CodeRabbit). Rebase/update before merge per normal flow.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.
|
User description
Closes #371
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Fix feature ideation workflow startup and preserve dispatch options
What Changed
Impact
✅ Fewer failed discussion-triggered ideation runs✅ Preserved workflow dispatch settings✅ More reliable automated feature discussions💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit