[COVAL-4730] Repair weekly CLI API parity automation - #108
Conversation
|
Warning Review limit reached
Next review available in: 53 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughAdded 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-parity-audit.yml:
- Around line 48-56: Update the “Verify rolling PR credential” step to perform a
non-mutating API authorization check for REGEN_PR_TOKEN after validating it is
non-empty, confirming the token has contents: write and pull-requests: write
access to coval-ai/cli. Fail immediately with a clear error if the token is
revoked or lacks either permission, before create-pull-request runs.
In `@README.md`:
- Around line 251-253: Update the workflow verification instructions around gh
workflow run and gh run watch to capture the dispatched run URL/ID and pass that
run ID explicitly to gh run watch. Derive expected_version and expected_tag from
Cargo.toml, query the corresponding release with gh release view, and require
grep -F "version \"$expected_version\"" so the checked release matches the
expected version.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 4229ce8a-7061-4976-b6d0-be942dd76158
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (9)
.github/workflows/api-parity-audit.yml.github/workflows/release.ymlCargo.tomlREADME.mdapi-coverage-report.mdapi-coverage.tomlsrc/client/mod.rssrc/commands/metrics.rstests/cli_tests.rs
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-parity-audit.yml:
- Around line 67-71: Define shared curl options for connection and total
transfer timeouts in the workflow, then apply them to each GitHub API call at
the repository, pull-request, and diff request sites. Reuse the same timeout
configuration consistently across all three calls, including the existing
api_headers arguments.
- Around line 91-93: Update both write-probe failure branches in the workflow to
classify non-422 responses before reporting missing permissions, using the HTTP
status, rate-limit headers, and a sanitized GitHub error body to distinguish
rate limiting, policy restrictions, and authorization failures. Preserve the
expected 422 handling, and apply identical classification behavior to both probe
paths rather than treating every non-422 response as insufficient access.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 12609726-24da-4ebc-9184-7600970209f6
📒 Files selected for processing (2)
.github/workflows/api-parity-audit.ymlREADME.md
🚧 Files skipped from review as they are similar to previous changes (1)
- README.md
2 participants
Summary
POST /metrics/{metric_id}/duplicateAPI ascoval metrics duplicateRoot cause
The scheduled workflow ran on August 3 and August 10, but
REGEN_PR_TOKENevaluated as empty, sopeter-evans/create-pull-requeststopped withInput 'token' not supplied. The secret record exists, but its presence does not prove that Actions receives a usable value. The latest run detectedPOST /metrics/{metric_id}/duplicateand then failed before it could open the rolling parity PR.The release audit also found that GitHub release v0.6.0 exists while the Homebrew formula is still v0.5.0:
HOMEBREW_TAP_TOKENauthenticated as a user without push access and the release failed with HTTP 403. This PR adds a permission preflight so future releases fail before building artifacts.Validation
actionlint .github/workflows/*.ymlpython -m unittest scripts/test_audit_api_coverage.py scripts/test_release_automation.py(31 passed)ruff check scriptsruff format --check scriptspython scripts/audit_api_coverage.py --write-markdown api-coverage-report.md(PASS: 119/175; 56 reviewed gaps)cargo fmt --checkcargo clippy --all-targets -- -D warningscargo test(131 passed)python scripts/release_version.py --expected-tag v0.7.0Required out-of-band recovery
Before this is marked ready, replace
REGEN_PR_TOKENwith a fine-grained token scoped tocoval-ai/cli(Contents and Pull requests read/write), and replaceHOMEBREW_TAP_TOKENwith one scoped tocoval-ai/homebrew-tap(Contents read/write). Then manually dispatch the weekly parity workflow. Recovering the stale Homebrew v0.6.0 formula requires a separate explicit release dispatch; this PR does not dispatch, merge, tag, or publish anything.