feat(ci): canonical bypass-audit standard + pipeline drift detection#51
Conversation
|
Warning Review limit reached
More reviews will be available in 21 minutes and 37 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR adds SHA-based deduplication to the bypass-audit workflow to prevent duplicate admin-bypass audit issues. The workflow now computes a short commit SHA, queries for prior issues from the workflow bot matching that SHA, and exits early if found instead of creating a new issue. Documentation is updated accordingly. ChangesAudit Issue Deduplication
Sequence DiagramsequenceDiagram
participant Workflow as bypass-audit workflow
participant GitHub as GitHub API
Workflow->>Workflow: Compute SHA_SHORT (7-char commit SHA)
Workflow->>GitHub: Query for existing issues with SHA_SHORT in title
GitHub-->>Workflow: Return matching issues
Workflow->>Workflow: Filter by github-actions[bot] author<br/>and full commit SHA in body
alt Match Found
Workflow->>Workflow: Exit without creating new issue
else No Match Found
Workflow->>GitHub: Create new admin-bypass audit issue
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
chris-yyau
force-pushed
the
fix/bypass-audit-dedup-guard
branch
from
914ce15 to
97b7f07
Compare
There was a problem hiding this comment.
chris-yyau has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…ction Supersedes the dedup approach. Two things: 1. Canonical standard — adopt diveanddev.com's design as helmet's template: push-only, identity-skip ONLY (no message-based skip a human could forge), fail-the-run on an indeterminate PR-lookup (never silent-skip, never false-positive), and NO dedup. Issue metadata is mutable, so a title/SHA dedup is an insider-editable suppression primitive (even an author filter is defeated by editing a bot-authored issue); the org audit log is the authoritative trail and a duplicate on a rare re-run is harmless. 2. Drift detection — vendored boilerplate was silently freezing at its onboarding generation (chrisyau.me/jikdak sat at v1.12 while helmet hit v1.21). Now: stamp `# helmet-pipeline: vX.Y.Z` into the template, and scripts/check-pipeline-drift.sh compares each repo's stamp to helmet's own template stamp (not plugin.json — avoids false drift on unrelated bumps), failing on any behind/unstamped/unreadable repo. Update SKILL.md template excerpt + detection-logic to match. ADR-0001 records the design, the vendored-not-reusable choice (keep repos self-contained), and the seatbelt sweep exception. .helmet-fleet.example documents the scan list. Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>
chris-yyau
force-pushed
the
fix/bypass-audit-dedup-guard
branch
from
97b7f07 to
0216cc1
Compare
chris-yyau
changed the title
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0216cc1d0c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| --description "Commit bypassed required status checks" \ | ||
| --repo "$REPO" 2>/dev/null || LABEL_OK=0 | ||
| --repo "$REPO" 2>/dev/null \ | ||
| || gh label list --repo "$REPO" --json name --jq '.[].name' 2>/dev/null | grep -qx "admin-bypass" \ |
There was a problem hiding this comment.
In repos with more than 30 labels where admin-bypass is not in the first page, this fallback treats an existing label as unavailable and creates the audit issue without the label. The GitHub CLI manual for gh label list documents --limit <int> (default 30) (https://cli.github.com/manual/gh_label_list), so the existence check can be a false negative even though the labeled gh issue create would have worked; this loses the label-based audit filtering the workflow depends on.
Useful? React with 👍 / 👎.
check-pipeline-drift.sh derives the canonical version from helmet's own bypass-audit.yml `# helmet-pipeline:` stamp (not plugin.json), so the onboarding instruction must tell the generator to copy that pipeline-template stamp verbatim and bump it only when the template changes. Stamping the plugin version (the old wording) would make every repo show false "ahead" drift on any unrelated plugin release. Also fix a dangling "see B4" pointer (B4 is multi-repo deployment, not drift detection) to reference ADR-0001, the authoritative decision record. Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
harden admin-bypass label-exists fallback: query the exact label endpoint instead of a page-capped label list scan (bypass-audit.yml)
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Query the exact label endpoint instead of a page-capped label-list scan, so the existence check can't false-negative on a repo with many labels (codex P2 on PR #51). Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>
chris-yyau
force-pushed
the
fix/bypass-audit-dedup-guard
branch
from
56e320a to
94188c7
Compare
# [1.22.0](v1.21.0...v1.22.0) (2026-06-05) ### Features * **ci:** canonical bypass-audit standard + pipeline drift detection ([#51](#51)) ([cd8b160](cd8b160))
1 participant
What
Two things, one foundation:
diveanddev.com's design as helmet's template: push-only, identity-skip only (no commit-message skip a human could forge), fail-the-run on an indeterminate PR-lookup, and no dedup (issue metadata is mutable → a title/SHA dedup is an insider-editable suppression primitive; the org audit log is the authoritative trail).# helmet-pipeline: vX.Y.Zstamp, andscripts/check-pipeline-drift.shflags any repo behind the canonical (read from helmet's own template stamp, so unrelated plugin bumps don't cause false drift).Why
helmet vendors workflows into each repo at onboarding, so they froze at their adoption generation —
chrisyau.me/jikdaksat at v1.12 while a freshly-authoreddiveanddev.comwas far ahead. Dependabot bumps action SHAs but never the logic, so the drift was silent. This makes the design uniform and the drift loud — while keeping every repo self-contained (no reusable-workflow coupling; see ADR-0001 for why).Changes
.github/workflows/bypass-audit.yml— canonical design + version stamp.skills/helmet/SKILL.md— excerpt + detection-logic updated to match; stamp instruction.scripts/check-pipeline-drift.sh— fleet drift scanner (shellcheck-clean)..helmet-fleet.example+.gitignore— fleet-list scaffolding.docs/adr/0001-bypass-audit-standard-and-drift-detection.md— the decision record.Follow-up (separate, after this lands)
diveanddev.com= the reference (no change).seatbelt= documented sweep exception.Test plan
actionlint(only pre-existing SC2016 jq-filter notes),shellcheckclean, litmus PASSscripts/check-pipeline-drift.sh --fleetreports the fleet honestly