fix(workflows): swap claude-code-action OAuth to direct API key (resolves recurring triage BLOCKED) - #2302
Merged
Conversation
- creator-collab lane SHIPS at 7/7 (PR #2293 squash 4c1c384) - pbnj-meta-submodule conversion lands (PR #2175 squash e094d95) - cron self-disarm path: state file on main now shows ship_count=7, status=complete, closing_summary posted; operator paused the creator-collab cron from the Mavis UI (mavis CLI is broken for the command-line disarm path; not blocking the lane SHIP) Next: pmoves-pinokio fork sync to P8 + pinokio_bridge default-up + supabase stack default-up + claude-review/triage Bun CI fix.
4 queued follow-on lanes ranked by impact: 1. pmoves-pinokio fork sync to P8 (no-op, gitlink already at HEAD) 2. pinokio_bridge default-up (high impact, slice 2-7 actually exercisable) 3. supabase stack default-up (real-running fix for pmoves-ui degraded) 4. claude-review + triage Bun runtime CI bug (meta-blocker for all PRs) Operator said 'proceed though all 4 update AGNOTE first to track lanes'.
Root cause: CLAUDE_CODE_OAUTH_TOKEN (Pro/Max subscription) is expired. The action's Claude API call returns result is_error:true after ~17s, exits 1, and the workflow's triage check fails with BLOCKED. The action's own dependencies install fine (Bun 1.3.14 cache hit; the claude-code-action runtime is healthy) — the failure is downstream, in the OAuth-authenticated Claude API call. Fix: swap claude_code_oauth_token for anthropic_api_key on all 3 workflows that use anthropics/claude-code-action@be7b93b: - .github/workflows/review-comment-monitor.yml (actively failing) - .github/workflows/claude-code-review.yml (if: false, preventative) - .github/workflows/review-autofix.yml (opt-in via pr-trim:auto) ANTHROPIC_API_KEY is the direct API key, rotated 2026-02-27, and is the persistent credential. The previous OAuth token is the Pro/Max subscription credential which expires; if the operator re-enables OAuth later they can swap back. Validation: the next pull_request_review event from a trusted bot reviewer will be the live test.
Contributor
|
Warning Review limit reached
Next review available in: 58 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
workflows
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4050ed5638
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| **Lane 1 (no-op): pmoves-pinokio fork sync to P8.** Audited 2026-07-30: pbnj gitlink in PMOVES.AI tracks PMOVES-pinokio @ PMOVES.AI-Edition-Hardened @ 40a6295907 (the current HEAD of that branch, 2026-07-21). PMOVES-pinokio's main branch has v8.0.40 (2026-07-22) but the gitlink intentionally tracks the hardened branch (per .gitmodules), NOT main. There is no upstream to sync to (PMOVES-pinokio is not a GitHub fork; parent=null, source=null). \ ork-sync.yml\ would not pick this up. The "P8" interpretation in operator's prior notes refers to PMOVES v8 (which is where the main branch lives, but the hardened branch is intentionally a v1-era ref + PMOVES aggregations). **No action needed** unless operator wants to bump main to 8.0.40 + harden. | ||
|
|
||
| **Lane 2: pinokio_bridge default-up.** pinokio_bridge service code is SHIPPED (slice 2 of creator-collab, 2026-07-28) but the service has never been added to the default \make up\ invocation. pmoves-ui is degraded because Supabase (which pinokio_apps can also depend on) is down. Adding pinokio_bridge to the default-up list would (a) make slice 2-7 work actually exercisable, (b) unblock the "path to C" (real pinokio launch + ComfyUI render) for slice 7, (c) unblock PR #2175's pbnj submodule follow-on. **High impact.** \pmoves/services/pinokio_bridge/Dockerfile\ is ready; \docker-compose.yml\ + \docker-compose.workers.yml\ need a new service entry with NATS_EVENT_BUS_TOKEN wiring + pterm pre-flight (or graceful 503 when pterm missing). token: \PMOVES_BRIDGE_API_KEY=2ec354e855c9152b1221d6e4ecf623ef\ is already in env.shared. |
There was a problem hiding this comment.
This line publishes a concrete PMOVES_BRIDGE_API_KEY copied from env.shared; the value was absent from the parent revision and is described elsewhere as a required randomly generated authentication credential. Anyone with repository access can now authenticate to a reachable Pinokio bridge using it, and deleting the text alone will not remove it from Git history, so redact the value and rotate the credential immediately.
AGENTS.md reference: pmoves/AGENTS.md:L88-L91
Useful? React with 👍 / 👎.
POWERFULMOVES
pushed a commit
that referenced
this pull request
Aug 1, 2026
…ile hardening, NATS_URL hardcode Review-iter on PR #2322 caught 8 real correctness bugs (not nitpicks). The 2 unambiguous fixes (higgs_audio→higgs, drop fish_speech alias) are in this commit. The other 3 (qwen voice-design, fish_s2 slot mapping, vibevoice reject-vs-route) are Mavis's design call — documented in code with the reasoning and a v1 slot allocation to verify against the upstream TTS app's launch.py. **ultimate_tts.py _build_params engine key fixes (chatgpt-codex P2 + coderabbit CRITICAL):** - `engine in ("fish_speech", "fish")` → `engine == "fish"` (only `fish` is canonical; `fish_s2` is the separate Fish Speech S2 Pro engine) - `engine == "higgs_audio"` → `engine == "higgs"` (the canonical internal key is `higgs` per ENGINE_NAMES, ENGINE_TIMEOUTS, endpoint_map, get_engines) **Missing engine branches restored (chatgpt-codex P2 + coderabbit Major):** - `fish_s2` branch added with the 4 canonical synth params (temperature, top_p, repetition_penalty, max_tokens) from tools/test_all_tts_engines.py. Slot allocation is v1 — fits in the gaps of the 101-param layout (data[9, 19, 30, 37]) and should be verified against the upstream launch.py /gradio_api/info endpoint. - `qwen` branch added with the 5 canonical synth params (mode, clone_model_size, chunk_size, speaker, language). Load kwargs go to /handle_load_qwen, not _build_params. Slots: data[40, 60, 66, 87, 100]. - `vibevoice` rejected explicitly with UltimateTTSError. Per the test harness, VibeVoice uses a separate panel (handle_vibevoice_generation), NOT the unified /generate_unified_tts endpoint. A silent no-parameter request would be the worst outcome — a clear error is better. - `else` clause added so unknown engine names also raise UltimateTTSError with the list of supported engines. **nats_event_bus/Dockerfile (coderabbit Major + chatgpt-codex P1):** - `RUN useradd ... 2>/dev/null || true` → `RUN id -u pmoves >/dev/null 2>&1 || useradd ...` (propagate real errors; only the expected "user already exists" case is silent) - Added `COPY contracts /app/contracts` so `services.common.events` can resolve topics.json + per-topic schemas. Without this, every authenticated POST /v1/publish raises FileNotFoundError and the endpoint returns 422. **pinokio_bridge/Dockerfile (coderabbit Major):** - Same useradd fix (idempotent user creation with proper error propagation) **docker-compose.amd-voice.yml (chatgpt-codex P1):** - `NATS_URL=nats://nats:pmoves@nats:4222` (hardcoded) → `NATS_URL=${NATS_URL}` (use the env var so operators can rotate credentials or point at an external NATS server). apps.yml had the same bug in the first PR commit but dd60d0a ("regenerate split overlays") already fixed it. **Notes for follow-up:** - The qwen/fish_s2 slot positions are best-effort v1. The upstream TTS app's launch.py has the exact positions; once someone has access to it, update the slot indices to match. The 101-param layout leaves 9 single-slot gaps (data[9, 19, 30, 37, 40, 60, 66, 87, 100]) that don't fit fish_s2 (4) + qwen (5) contiguously, so this v1 is a pragmatic compromise. - Dockerfile COPY paths use `services/...` (no `pmoves/` prefix) which works with context=`.` (the pmoves/ directory) — verified by checking the actual build context. The chatgpt-codex-connector complaint about "wrong COPY paths" was about the pre-PR state, not the current PR. - pre-existing CI bug: `triage` check fails (Bun runtime, fixed in PR #2302). This PR doesn't touch CI, so the triage check will continue to fail until the next PR that re-validates it. Review-iter round 1. Redo commit, not history rewrite — operator pattern is "append a redo commit rather than rewrite history" so the lane story stays auditable as: 3 commits → review-iter caught 8 real bugs → 1 redo.
POWERFULMOVES
pushed a commit
that referenced
this pull request
Aug 1, 2026
…ile hardening, NATS_URL hardcode Review-iter on PR #2322 caught 8 real correctness bugs (not nitpicks). The 2 unambiguous fixes (higgs_audio→higgs, drop fish_speech alias) are in this commit. The other 3 (qwen voice-design, fish_s2 slot mapping, vibevoice reject-vs-route) are Mavis's design call — documented in code with the reasoning and a v1 slot allocation to verify against the upstream TTS app's launch.py. **ultimate_tts.py _build_params engine key fixes (chatgpt-codex P2 + coderabbit CRITICAL):** - `engine in ("fish_speech", "fish")` → `engine == "fish"` (only `fish` is canonical; `fish_s2` is the separate Fish Speech S2 Pro engine) - `engine == "higgs_audio"` → `engine == "higgs"` (the canonical internal key is `higgs` per ENGINE_NAMES, ENGINE_TIMEOUTS, endpoint_map, get_engines) **Missing engine branches restored (chatgpt-codex P2 + coderabbit Major):** - `fish_s2` branch added with the 4 canonical synth params (temperature, top_p, repetition_penalty, max_tokens) from tools/test_all_tts_engines.py. Slot allocation is v1 — fits in the gaps of the 101-param layout (data[9, 19, 30, 37]) and should be verified against the upstream launch.py /gradio_api/info endpoint. - `qwen` branch added with the 5 canonical synth params (mode, clone_model_size, chunk_size, speaker, language). Load kwargs go to /handle_load_qwen, not _build_params. Slots: data[40, 60, 66, 87, 100]. - `vibevoice` rejected explicitly with UltimateTTSError. Per the test harness, VibeVoice uses a separate panel (handle_vibevoice_generation), NOT the unified /generate_unified_tts endpoint. A silent no-parameter request would be the worst outcome — a clear error is better. - `else` clause added so unknown engine names also raise UltimateTTSError with the list of supported engines. **nats_event_bus/Dockerfile (coderabbit Major + chatgpt-codex P1):** - `RUN useradd ... 2>/dev/null || true` → `RUN id -u pmoves >/dev/null 2>&1 || useradd ...` (propagate real errors; only the expected "user already exists" case is silent) - Added `COPY contracts /app/contracts` so `services.common.events` can resolve topics.json + per-topic schemas. Without this, every authenticated POST /v1/publish raises FileNotFoundError and the endpoint returns 422. **pinokio_bridge/Dockerfile (coderabbit Major):** - Same useradd fix (idempotent user creation with proper error propagation) **docker-compose.amd-voice.yml (chatgpt-codex P1):** - `NATS_URL=nats://nats:pmoves@nats:4222` (hardcoded) → `NATS_URL=${NATS_URL}` (use the env var so operators can rotate credentials or point at an external NATS server). apps.yml had the same bug in the first PR commit but dd60d0a ("regenerate split overlays") already fixed it. **Notes for follow-up:** - The qwen/fish_s2 slot positions are best-effort v1. The upstream TTS app's launch.py has the exact positions; once someone has access to it, update the slot indices to match. The 101-param layout leaves 9 single-slot gaps (data[9, 19, 30, 37, 40, 60, 66, 87, 100]) that don't fit fish_s2 (4) + qwen (5) contiguously, so this v1 is a pragmatic compromise. - Dockerfile COPY paths use `services/...` (no `pmoves/` prefix) which works with context=`.` (the pmoves/ directory) — verified by checking the actual build context. The chatgpt-codex-connector complaint about "wrong COPY paths" was about the pre-PR state, not the current PR. - pre-existing CI bug: `triage` check fails (Bun runtime, fixed in PR #2302). This PR doesn't touch CI, so the triage check will continue to fail until the next PR that re-validates it. Review-iter round 1. Redo commit, not history rewrite — operator pattern is "append a redo commit rather than rewrite history" so the lane story stays auditable as: 3 commits → review-iter caught 8 real bugs → 1 redo.
POWERFULMOVES
added a commit
that referenced
this pull request
Aug 1, 2026
…TS params for ROCm (#2322) * fix(voice+compose): wire pinokio bridge, fix Supabase UI, fix Flute TTS params for ROCm Lane 2 — pinokio_bridge + nats_event_bus default-up: - Add docker-compose.apps.yml to STACK_FILES so make up-pinokio can find the services - Fix nats_event_bus NATS_URL (localhost→nats:4222) in compose override - Fix nats_event_bus Dockerfile (missing FROM, wrong COPY paths for pmoves/ context) - Fix pinokio_bridge Dockerfile (same COPY path fix, remove non-existent contracts COPY) Lane 3 — Supabase + pmoves-ui: - Add HOSTNAME=0.0.0.0 to pmoves-ui env (Next.js standalone binds to hostname by default) - Create upload_events table in Supabase (required by pmoves-ui health check) Flute TTS param fix: - Rewrite _build_params from 121-param to 101-param (upstream TTS app reduced params) - Set ONLY the selected engine's params (was setting all engines, causing Gradio null errors) - Add NATS_URL override for flute-gateway in amd-voice compose TTS Dockerfile fixes: - Add ca-certificates to both CUDA and ROCm runtime stages - Add HF_HUB_DISABLE_XET=1 + SSL_CERT_FILE env vars (fix hf-xet Rust crate CA panic) Verified on B850 (dual R9700, gfx1201/RDNA4): - Chatterbox synthesis through Flute: 200 OK, 5.96s audio at 24kHz - pmoves-ui: healthy (database check passing) - nats_event_bus: healthy, NATS connected, 8 topics - pinokio_bridge: healthy 💘 Generated with Crush * fix(compose): regenerate split overlays after apps.yml + pmoves-ui changes CI caught drift between docker-compose.yml and split overlays after adding HOSTNAME=0.0.0.0 to pmoves-ui and NATS_URL to nats_event_bus. 💘 Generated with Crush * docs(trail): B850 ROCm voice convergence entry + fix Flute DEFAULT_VOICE_PROVIDER - Trail entry documents first chatterbox synthesis on B850 ROCm (dual R9700) - Hardcode DEFAULT_VOICE_PROVIDER=ultimate_tts in amd-voice override (env_file interpolation was resolving to vibevoice from env.shared) 💘 Generated with Crush * fix(voice+compose): review-iter redo — engine key mismatches, Dockerfile hardening, NATS_URL hardcode Review-iter on PR #2322 caught 8 real correctness bugs (not nitpicks). The 2 unambiguous fixes (higgs_audio→higgs, drop fish_speech alias) are in this commit. The other 3 (qwen voice-design, fish_s2 slot mapping, vibevoice reject-vs-route) are Mavis's design call — documented in code with the reasoning and a v1 slot allocation to verify against the upstream TTS app's launch.py. **ultimate_tts.py _build_params engine key fixes (chatgpt-codex P2 + coderabbit CRITICAL):** - `engine in ("fish_speech", "fish")` → `engine == "fish"` (only `fish` is canonical; `fish_s2` is the separate Fish Speech S2 Pro engine) - `engine == "higgs_audio"` → `engine == "higgs"` (the canonical internal key is `higgs` per ENGINE_NAMES, ENGINE_TIMEOUTS, endpoint_map, get_engines) **Missing engine branches restored (chatgpt-codex P2 + coderabbit Major):** - `fish_s2` branch added with the 4 canonical synth params (temperature, top_p, repetition_penalty, max_tokens) from tools/test_all_tts_engines.py. Slot allocation is v1 — fits in the gaps of the 101-param layout (data[9, 19, 30, 37]) and should be verified against the upstream launch.py /gradio_api/info endpoint. - `qwen` branch added with the 5 canonical synth params (mode, clone_model_size, chunk_size, speaker, language). Load kwargs go to /handle_load_qwen, not _build_params. Slots: data[40, 60, 66, 87, 100]. - `vibevoice` rejected explicitly with UltimateTTSError. Per the test harness, VibeVoice uses a separate panel (handle_vibevoice_generation), NOT the unified /generate_unified_tts endpoint. A silent no-parameter request would be the worst outcome — a clear error is better. - `else` clause added so unknown engine names also raise UltimateTTSError with the list of supported engines. **nats_event_bus/Dockerfile (coderabbit Major + chatgpt-codex P1):** - `RUN useradd ... 2>/dev/null || true` → `RUN id -u pmoves >/dev/null 2>&1 || useradd ...` (propagate real errors; only the expected "user already exists" case is silent) - Added `COPY contracts /app/contracts` so `services.common.events` can resolve topics.json + per-topic schemas. Without this, every authenticated POST /v1/publish raises FileNotFoundError and the endpoint returns 422. **pinokio_bridge/Dockerfile (coderabbit Major):** - Same useradd fix (idempotent user creation with proper error propagation) **docker-compose.amd-voice.yml (chatgpt-codex P1):** - `NATS_URL=nats://nats:pmoves@nats:4222` (hardcoded) → `NATS_URL=${NATS_URL}` (use the env var so operators can rotate credentials or point at an external NATS server). apps.yml had the same bug in the first PR commit but dd60d0a ("regenerate split overlays") already fixed it. **Notes for follow-up:** - The qwen/fish_s2 slot positions are best-effort v1. The upstream TTS app's launch.py has the exact positions; once someone has access to it, update the slot indices to match. The 101-param layout leaves 9 single-slot gaps (data[9, 19, 30, 37, 40, 60, 66, 87, 100]) that don't fit fish_s2 (4) + qwen (5) contiguously, so this v1 is a pragmatic compromise. - Dockerfile COPY paths use `services/...` (no `pmoves/` prefix) which works with context=`.` (the pmoves/ directory) — verified by checking the actual build context. The chatgpt-codex-connector complaint about "wrong COPY paths" was about the pre-PR state, not the current PR. - pre-existing CI bug: `triage` check fails (Bun runtime, fixed in PR #2302). This PR doesn't touch CI, so the triage check will continue to fail until the next PR that re-validates it. Review-iter round 1. Redo commit, not history rewrite — operator pattern is "append a redo commit rather than rewrite history" so the lane story stays auditable as: 3 commits → review-iter caught 8 real bugs → 1 redo. * fix(pinokio-bridge): wire pterm + node + gateway resolution for container - Add /pinokio/bin/npm/bin + /pinokio/bin/miniforge/bin to PATH so both pterm and node are discoverable inside the container - Add Python entrypoint that probes Docker gateway IPs for an open :42000 and writes ~/.pinokio/config.json with the resolved host - Add extra_hosts: host.docker.internal:host-gateway to compose pterm now works inside the container: search returns apps, status works. App enumeration via /v1/apps still requires apps/index.json (Pinokio 8 generates it dynamically — pterm-based fallback is a future enhancement). 💘 Generated with Crush * fix(submodules): reset drifted gitlinks to match origin/main Submodule pointers drifted during rebase. Reset PMOVES-Creator, PMOVES-a0-plugins, Pmoves-cipher, pmoves-cipher-mcp to their origin/main gitlink SHAs. 💘 Generated with Crush * fix(review): address CodeRabbit findings on PR #2322 - pinokio_bridge/Dockerfile: replace `useradd ... 2>/dev/null || true` with `id -u pmoves || useradd ...` so failed user creation surfaces - pinokio_bridge/entrypoint.py: close probe socket on exception path (was leaking one fd per failed candidate) Engine key comments (higgs_audio, fish_s2, qwen, vibevoice) were already resolved in the engine-scoped _build_params rewrite. nats_event_bus contracts COPY was already present. 💘 Generated with Crush --------- Co-authored-by: Mavis <Mavis@pmoves.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR fixes
The recurring "BLOCKED" merge state on every PR over the last week had a different root cause than suspected. The actual failure mode:
The
anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510bwas failing on the OAuth-authenticated Claude API call, not on Bun itself.CLAUDE_CODE_OAUTH_TOKEN(Pro/Max subscription credential) is expired. The action's dependencies installed fine, Bun 1.3.14 cache hit, the action's runtime was healthy — the failure was downstream in the OAuth path.The fix
Swap
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}foranthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}across all 3 workflows that use the action:.github/workflows/review-comment-monitor.yml(the actively-failing one — surfaces this PR's review as a triage comment).github/workflows/claude-code-review.yml(currentlyif: falsebut same OAuth dependency).github/workflows/review-autofix.yml(opt-in viapr-trim:autolabel, same OAuth dependency)ANTHROPIC_API_KEYis the direct API key, rotated 2026-02-27, and is the persistent credential. The previous OAuth token was the Pro/Max subscription credential, which expires; the operator can swap back to OAuth if/when the subscription is restored.Validation
pull_request_reviewevent fromcoderabbitai[bot]orchatgpt-codex-connector[bot]on any PR is the live testtriagecheck should now pass instead of failingWhy this was misdiagnosed as a "Bun runtime bug"
The "Bun runtime bug" was the working theory because:
bun --revisionsucceededoutcome=successThe actual exit code 1 was the Claude API call, not Bun. The Bun runtime was always fine.
What this unblocks
Every PR that's been "BLOCKED" in the last week (PR #2175, #2283, #2285, #2293, #2300, plus all the in-flight ones) was waiting for the triage check to fail. With this fix, the triage check passes and the merge state becomes the actual
mergeable: MERGEABLEstate we already have.agent_signature:
ACK::Mavis::REVIEW-COMMENT-MONITOR-OAUTH-FIX-2026-07-30