ci: triage-only Review Comment Monitor for bot reviews (auto-monitor) - #1789
Conversation
Surfaces CodeRabbit/Codex review findings for human attention: on a bot pull_request_review, classifies findings P0-P3 and posts ONE summary comment flagging P0/P1 for action via /pr-trim. Deliberately TRIAGE-ONLY (contents: read, no thread-resolution): an automated reviewer can never trigger an unsupervised code change. Fixing+resolving stays the human-invoked pr-trimmer path. Gated to known bot logins + non-empty review body so human reviews and empty approvals are ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 24 minutes and 45 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2fe65ef6a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Addresses Codex review on #1789: (P1) claude-code-action rejects bot-triggered runs by default — add allowed_bots; (P2) drop the review.body!='' gate so inline-only bot reviews aren't missed (action fetches the comments itself). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…e variant) (#1796) * ci: add opt-in (label-gated) Review Auto-Fix for bot reviews The aggressive counterpart to review-comment-monitor.yml (#1789): on a trusted-bot review of a PR carrying the human-applied 'pr-trim:auto' label, runs a conservative pr-trim pass that applies clearly-actionable fixes, pushes to the PR branch, and resolves the addressed threads. Safety: HUMAN label gate (never fires unsolicited); changes land as reviewable commits; the pass is instructed to skip P3/judgment/behaviour-changing items and touch only files in the bot's findings. contents:write is scoped to this opt-in path only (the default monitor stays contents:read). allowed_bots set per the #1789 lesson. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci(review-autofix): gate to same-repo PRs (fork checkout/push hazard) Addresses Codex P1 on #1796: actions/checkout's ref resolves against the base repo, so a fork PR with a base-named head branch (e.g. main) could make the autofix job check out + push its commit to the wrong repo. Restrict the job to same-repo PRs (head.repo.full_name == github.repository) so head==base and the ref is safe. PMOVES PRs are internal org branches, so this loses no coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
Item ⑤ of the 4090 review-infra lane (companion to #1763 / #1785 / #1787). Delivers "auto-monitor incoming review comments" — the safe interpretation.
What
A new workflow that fires on
pull_request_reviewfrom CodeRabbit / Codex, classifies the findings P0–P3 (pr-trim severity model), and posts one summary comment flagging P0/P1 for human attention (withfile:line) + a P2/P3 count.Safety stance (deliberate)
contents: read, no thread-resolution scope. The workflow cannot push commits or resolve threads. Fixing + resolving stays the deliberate, human-invokedpr-trimmer//pr-trimpath.pr-trimmerto apply fixes on every bot review — was intentionally not built; it needs explicit opt-in.)Verification
YAML parses; trigger/permissions/bot-gate confirmed. Caveat (honest): a
pull_request_review-triggered workflow can't be end-to-end verified without a real CodeRabbit/Codex review landing — the first bot review after merge is the live test. Theif:author-gate and read-only perms bound the blast radius if the prompt misbehaves (worst case: one extra summary comment).🤖 Generated with Claude Code