Repository navigation
feat: implement issue #201 — [Fleet Monitor] petry-projects/repo-template — .github/workflows/ci.yml - #203
Conversation
…late — .github/workflows/ci.yml
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reachedNext included review available in 53 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe CI workflow now keys concurrency groups by ref instead of ref and commit SHA. New Bats tests verify the concurrency block, ref-based group, absence of SHA keying, and cancellation setting. ChangesCI concurrency cancellation
Priority: ⬆️ High Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix · Severity of issue fixed: High Merge Risk: ⚪ Minimal · up to New commits on the same ref now cancel stale CI runs, with tests guarding the configuration. No current merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:M
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #203 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
No description provided. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new BATS test file, tests/ci-concurrency-cancellation.bats, which acts as a compliance regression guard to ensure that the GitHub Actions CI workflow configuration (ci.yml) implements concurrency cancellation correctly (specifically, that it is keyed by github.ref, does not contain github.sha, and has cancel-in-progress enabled). Feedback suggests making the regular expression for checking cancel-in-progress more robust to handle quotes and inline comments.
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Superseded by automated re-review at
|
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: a924f09188e748ea8639b27761f2629451246482
Review mode: triage-approved (single reviewer)
Summary
The production fix is correct and minimal: ci.yml's concurrency group drops ${{ github.sha }} and keys by ${{ github.ref }} alone with cancel-in-progress: true, so a new push to a ref now supersedes the stale in-flight run instead of letting both complete (root cause of the 58.9% failure rate flagged by Fleet Monitor in issue #201). Both findings from the prior cascade review at c9f5a57 are resolved in the follow-up commit and were re-verified by direct repro: (1) major — group_value() now strips inline YAML comments, so the adversarial case 'group: ci-static # github.ref is required' correctly FAILS the github.ref assertion instead of passing on comment text; (2) minor — the cancel-in-progress assertion now tolerates quoted values and trailing inline comments with no false negative. No new issues introduced; the only commit since the prior review touches the bats guard exclusively.
Linked issue analysis
Issue #201 ([Fleet Monitor] ci.yml, CRITICAL, 58.9% failure / 33 of 56 runs, p50 28s fast-failure signature) is substantively addressed. Embedding github.sha in the concurrency group put every commit in its own group, so cancel-in-progress could never match an in-flight run for the same ref; burst pushes on automation branches then ran superseded commits to completion as failures. Keying by github.ref matches every sibling workflow's stable-identity convention, and the new bats regression guard pins the fix (group exists, keyed by github.ref, no github.sha, cancel-in-progress true) with comment-stripping so a commented-out or comment-decorated key can never satisfy an assertion.
Findings
- Prior major finding (inline-comment bypass in group_value) — RESOLVED: verified by running the guard's own awk/grep/sed logic; real ci.yml yields group_value 'ci-${{ github.ref }}' (passes), adversarial 'ci-static # github.ref is required' yields 'ci-static' (correctly fails).
- Prior minor finding (over-strict cancel-in-progress regex) — RESOLVED: quoted value with trailing comment ('"true" # keep') now passes; no false negative.
- Both inline review threads (gemini-code-assist, codeant-ai) are resolved and outdated.
- Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check is green and the diff contains no credential-like content.
- No security surface touched: permissions: {} unchanged, no new actions or third-party workflows, no secrets handling.
CI status
All required checks green: SonarCloud ✓, CodeQL ✓, agent-shield / AgentShield ✓, dependency-audit / Detect ecosystems ✓. Also green: build-and-test, coverage, Analyze (actions), Secret scan (gitleaks), SonarCloud Code Analysis, pr-auto-review dispatch, CodeRabbit. The three CANCELLED entries (dev-lead / dispatch, ci-relay, resume) are non-required agent-orchestration jobs — the fix commit intentionally carried [skip ci-relay]. mergeStateStatus BLOCKED reflects only the pending required review.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: a924f09188e748ea8639b27761f2629451246482
Review mode: triage-approved (single reviewer)
Summary
Confirmation review (triage-approved) of the fix for Fleet Monitor issue #201. The PR removes ${{ github.sha }} from ci.yml's concurrency group (now keyed by github.ref only) so cancel-in-progress can actually supersede stale in-flight runs, and adds tests/ci-concurrency-cancellation.bats as a regression guard. The root-cause analysis is sound: embedding the sha placed every commit in its own concurrency group, defeating cancellation and inflating the failure rate (58.9%) during push bursts. The new group key matches the stable-identity pattern used by every sibling workflow in the repo. The bats guard is well-constructed — it scopes assertions to the top-level concurrency block, strips comment lines and inline comments so comment text cannot satisfy a guard, asserts github.ref is present, github.sha is absent, and cancel-in-progress is true (tolerating quoting and trailing comments). No permissions, secrets, or action-pinning changes; no security smells.
Linked issue analysis
Linked issue #201 ([Fleet Monitor] ci.yml, 58.9% failure rate, CRITICAL) is substantively addressed. The failure signature (fast failures during push bursts, superseded runs never cancelled) is traced to the sha-embedded concurrency group; keying by ref restores cancel-in-progress semantics. A regression test pins the fix so the sha cannot be reintroduced silently.
Findings
No blocking findings.
- Prior-cycle review feedback is resolved: both review threads (gemini: quoted-true tolerance; codeant-ai: inline-comment stripping in group_value) are marked resolved and the corresponding fixes are present in the final test file.
- Secret scan: the run_secret_scanning MCP tool is not available in this run; the gitleaks CI check passed (SUCCESS) and the diff introduces no credentials or secret-adjacent content.
- Minor note (non-blocking): on pull_request events github.ref resolves to refs/pull/N/merge, which is the standard, correct grouping for per-PR cancellation.
CI status
All substantive checks green at a924f09188e748ea8639b27761f2629451246482: build-and-test, coverage, CodeQL, Analyze (actions), SonarCloud (quality gate passed), Secret scan (gitleaks), agent-shield, dependency-audit — all SUCCESS. The few CANCELLED entries (dev-lead dispatch/ci-relay/resume) are superseded orchestration runs with later SUCCESS duplicates, not CI failures.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: a924f09188e748ea8639b27761f2629451246482
Review mode: triage-approved (single reviewer)
Summary
Confirmation review (triage-approved). The PR rekeys ci.yml's concurrency group from ref+sha to ref only, so cancel-in-progress can supersede stale in-flight runs — the exact root cause of the ~59% failure rate in issue #201 (every commit previously landed in its own group, so burst pushes ran superseded runs to failure). A bats regression guard pins the fix: group keyed by github.ref, no github.sha in the group, cancel-in-progress true. The guard is robust — assertions are scoped to the top-level concurrency block, comment lines and inline comments are stripped so comment text cannot satisfy a check, and quoted true is accepted. Both prior bot review threads (quoted-true false negative; inline-comment bypass) are resolved with fixes present in the current diff. Triage assessment confirmed.
Linked issue analysis
Linked issue #201 ([Fleet Monitor] ci.yml CRITICAL, 58.9% failure rate) is substantively addressed: the concurrency key embedding github.sha defeated cancel-in-progress; keying by github.ref alone restores supersession, and the new tests/ci-concurrency-cancellation.bats prevents regression. The issue is already closed; the PR body's Closes #201 is a no-op against a closed issue.
Findings
No blocking findings. Secret-scan MCP tool unavailable in this run (noted, not blocking); gitleaks CI check passed and the diff contains no secret-like content. The change touches only the concurrency block of ci.yml plus a new test file — no permissions, secrets, or third-party action changes. Minor non-blocking observation: pushes to main now also cancel in-flight main runs, which is the org-standard pattern used by sibling workflows.
CI status
All validation checks green: build-and-test, CodeQL, Analyze (actions), SonarCloud quality gate, Secret scan (gitleaks), coverage, AgentShield, CodeRabbit, pr-auto-review. CANCELLED entries are superseded dev-lead orchestration runs with later SUCCESS runs of the same jobs.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
User description
Closes #201
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Cancel outdated CI runs for the same branch
What Changed
Impact
✅ Fewer failed superseded CI runs✅ Faster feedback after repeated pushes✅ Reduced duplicate CI workload💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
Chores
Tests