feat: implement issue #159 — Compliance: check-suite-auto-trigger-347564 - #195
Conversation
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 58 minutes and 53 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the repository settings script to disable the CodeRabbit check-suite auto-trigger via the GitHub API. Additionally, a redundant entry for .dev-lead/ was added to the .gitignore file, which the reviewer correctly identified as unnecessary clutter that should be removed.
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Implements repository compliance for issue #159 by disabling the CodeRabbit GitHub App’s check-suite auto-trigger via GitHub’s REST API.
Changes:
- Adds a
gh apicall to updatecheck-suites/preferencesfor app_id347564(CodeRabbit). - Prints a targeted status message and outputs the updated
auto_trigger_checkspreferences.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@donpetry-bot please review — compliance fix awaiting auto-review (manually triggered after pr-auto-review.yml is not deployed to this fleet repo) |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 6b0361df0abe972cba5819695b5a0c5a162b7fff
Review mode: triage-approved (single reviewer)
Summary
Adds a single gh api PATCH call to .github/scripts/apply-repo-settings.sh that disables CodeRabbit's (app_id 347564) check-suite auto-trigger, directly resolving compliance finding #159. Change is idempotent, scoped to one settings script, and uses a fixed app_id matching the standard reference.
Linked issue analysis
#159 — Compliance: check-suite-auto-trigger-347564. The issue states CodeRabbit's auto-trigger creates queued check suites that never complete, permanently blocking auto-merge, and instructs running the repo-settings script. The PR substantively addresses this by adding the exact remediation: a PATCH /repos/{repo}/check-suites/preferences with auto_trigger_checks: [{app_id: 347564, setting: false}]. Resolution mechanism (the Closes #159 keyword) will auto-close the issue on merge.
Findings
- ✅ Change is minimal and surgical (7 additions, 0 deletions, 1 file).
- ✅ Heredoc input is single-quoted (
<<'JSON'), so no variable interpolation concerns. - ✅ Script remains idempotent — re-running the PATCH is safe.
- ✅ App ID
347564is hard-coded and matches the compliance standard reference, so there is no injection or dynamic-input risk. - ✅ No secrets, credentials, migrations, or auth surface touched.
- ✅
set -euo pipefailalready in effect; the new pipeline will fail loudly if the API call fails.
No blocking issues found.
CI status
All required checks passing:
- CodeQL (Analyze actions): ✅ SUCCESS
- CodeQL: ✅ SUCCESS
- CodeRabbit status: ✅ SUCCESS
- SonarQube Cloud Quality Gate: ✅ Passed (0 new issues, 0 security hotspots)
Merge is currently BLOCKED only because review is required from @petry-projects/org-leads; this approval should unblock it (subject to branch-protection rules).
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
|
@don-petry assigned me as reviewer — starting a fresh review now. Results will appear in a few minutes. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 6b0361df0abe972cba5819695b5a0c5a162b7fff
Review mode: triage-approved (single reviewer)
Summary
Adds a single gh api PATCH call to .github/scripts/apply-repo-settings.sh that disables CodeRabbit's (app_id 347564) check-suite auto-trigger, directly resolving compliance finding #159. Change is minimal (7 additions, 0 deletions, 1 file), idempotent, scoped to one settings script, and uses the exact fixed app_id from the standard reference.
Linked issue analysis
#159 — Compliance: check-suite-auto-trigger-347564. The issue states CodeRabbit's auto-trigger creates queued check suites that never complete, permanently blocking auto-merge, and instructs running the repo-settings script. The PR substantively addresses this by adding a PATCH /repos/{repo}/check-suites/preferences call with auto_trigger_checks: [{app_id: 347564, setting: false}]. The Closes #159 keyword in the PR body will auto-close the issue on merge.
Findings
- ✅ Change is minimal and surgical (7 additions, 0 deletions, 1 file).
- ✅ Heredoc input is single-quoted (
<<'JSON'), so no variable interpolation concerns. - ✅ Script remains idempotent — re-running the PATCH is safe.
- ✅ App ID
347564is hard-coded and matches the compliance standard reference; no injection or dynamic-input risk. - ✅ No secrets, credentials, migrations, or auth surface touched.
- ✅
set -euo pipefailalready in effect upstream; the new pipeline will fail loudly if the API call fails. - ✅ Triage tier's low-risk assessment is correct — no findings missed.
No blocking issues found.
CI status
All required checks passing:
- CodeQL (Analyze actions): ✅ SUCCESS
- CodeQL: ✅ SUCCESS
- CodeRabbit status: ✅ SUCCESS
- SonarQube Cloud Quality Gate: ✅ Passed (0 new issues, 0 security hotspots)
- Dev-Lead Agent dispatch: ✅ SUCCESS
Merge is currently BLOCKED only pending required review from @petry-projects/org-leads; this approval should unblock the gate (subject to branch-protection rules).
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
Superseded by automated re-review at 6b0361d.
|
…564 (#195) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Closes #159
Implemented by dev-lead agent. Please review.