chore(ci): 🔧 Action SHA ピン留めを CI で強制し AI ガイドラインに明記 - #138
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
Warning Review limit reached
More reviews will be available in 53 minutes and 14 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughGitHub Actionsワークフロー内で外部Actionを参照する際に、可変ブランチ参照（@main等）を禁止し40桁コミットSHAでピン留めするという運用ガイドラインを定義しました。ドキュメント、Cursorルール、Copilot指示書にルールを追記し、actionlintワークフローに自動検証ステップを追加し、既存のワークフローをSHAピンで更新しています。 ChangesGitHub Actions uses参照のSHA固定化運用
🎯 2 (Simple) | ⏱️ ~12 minutesPossibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR #119 で AI 生成 PR が `qodo-ai/pr-agent@main` に巻き戻し、上流の リポジトリリネームと相まって PR Agent ワークフローが startup_failure となった。AI コーディングアシスタントが同じ巻き戻しを再発させない よう、`docs/ai-guidelines.md` (マスタ) に「外部 Action は 40 桁 SHA で必ずピン留めし、`@main`/`@master`/`@develop`/`@HEAD` は禁止」の ルールを明記し、`bun run sync:ai-guidelines` で `.cursorrules` と `.github/copilot-instructions.md` を再生成した。
外部 Action を `@main` で参照すると、上流リポジトリのリネームで `startup_failure` を引き起こす（PR Agent で実際に発生）ほか、不意な 破壊的変更を取り込むリスクもある。actionlint ワークフローに grep ベースの軽量ガードを追加し、`uses: owner/repo@(main|master|develop |trunk|HEAD)` パターンを CI で弾くようにする。 併せて既存の唯一の違反 `github/copilot-release-notes@main` を、 同リポジトリ main HEAD (2026-04-06) のコミット SHA に固定し、ガード 適用後も CI が通る状態にした。
21a4374 to
e5706d7
Compare
Up to standards ✅🟢 Issues
|
genzouw
changed the title
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR successfully addresses the PR Agent rollback and enhances repository security by mandating 40-digit SHA pinning for GitHub Actions. Codacy analysis indicates the changes are up to standards.
While the introduction of a CI guard to prevent mutable branch references is a positive step, the current grep-based implementation in 'actionlint.yml' is brittle and may trigger false positives if the workflow file's own formatting changes. Additionally, ensure the PR Agent workflow is manually triggered or verified, as the automated test scenario for its execution is currently marked as missing.
Test suggestions
- Grep-based CI guard correctly detects and fails on '@main' references in workflows
- Actionlint workflow passes when all external Actions are pinned to SHAs
- AI guideline synchronization correctly updates instruction files with the new pinning rule
- PR Agent workflow successfully initializes and executes using the new repository and SHA
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. PR Agent workflow successfully initializes and executes using the new repository and SHA
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
There was a problem hiding this comment.
Pull Request Overview
The PR successfully introduces a mechanism to enforce GitHub Action SHA pinning and updates the AI guidelines accordingly. While the Codacy analysis is 'up to standards', there are two significant issues that should be addressed before merging:
- CI Logic Reliability: The
grepcommand used to enforce SHA pinning is overly broad and will cause false positives by matching comments or documentation within the workflows directory. - Documentation Integrity: A critical section of the
docs/ai-guidelines.mdis grammatically incomplete and lacks closing punctuation, which may hinder AI assistants' ability to correctly parse the rules.
Additionally, there is no evidence of the 'sync:ai-guidelines' script mentioned in the requirements, which poses a risk to the consistency of AI instructions across the repository.
Test suggestions
- Verify that a workflow containing 'uses: owner/repo@main' causes the actionlint job to fail.
- Verify that workflows using 40-character SHAs (e.g., owner/repo@4406c0a9...) pass the CI check.
- Confirm that the 'sync:ai-guidelines' script correctly updates .cursorrules and copilot-instructions.md based on changes in docs/ai-guidelines.md.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that a workflow containing 'uses: owner/repo@main' causes the actionlint job to fail.
2. Verify that workflows using 40-character SHAs (e.g., owner/repo@4406c0a9...) pass the CI check.
3. Confirm that the 'sync:ai-guidelines' script correctly updates .cursorrules and copilot-instructions.md based on changes in docs/ai-guidelines.md.
Low confidence findings
- The PR requirements mention a 'sync:ai-guidelines' script to keep
.cursorrulesand.github/copilot-instructions.mdin sync withdocs/ai-guidelines.md. However, this script is not included or updated in this PR. Please ensure the synchronization process is automated or clearly defined to prevent configuration drift.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
`u[s]es:` の文字クラス分解で本ステップ自身が検出対象に hit する self-match を回避し、`^[[:space:]]*-?[[:space:]]*` の行頭アンカーと `--include='*.yml' --include='*.yaml'` の拡張子限定で、コメント・ ドキュメント中の偶発的な `uses:` 文字列に対する false positive を 排除した。これにより `.github/workflows/` 配下に将来 `.md` などの 非 YAML ファイルが置かれた場合でも CI が誤って fail しない。 レビューコメント: #138 (comment) レビュアー: codacy-production 優先度: medium
`actionlint` ワークフローの CI ガードは `(main|master|develop|trunk |HEAD)` を禁止対象としているが、ガイドライン本文の列挙には `@trunk` が抜けており、仕様（ドキュメント）とガード（実装）の間に整合性が 取れていなかった。`@trunk` をブランチ名一覧に追加し、併せて「禁止 対象一覧は CI ガードと同期している」旨の注記を加えて、片方を更新 した際にもう片方が取り残されないよう明示した。 `bun run sync:ai-guidelines` を実行し `.cursorrules` と `.github/copilot-instructions.md` を再生成済み。 レビューコメント: #138 (comment) レビュアー: codacy-production 優先度: medium
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-release-notes.yml:
- Line 52: Update the end-of-line comment on the uses line for the GitHub Action
so it follows the required version-name format: locate the line containing
"uses: github/copilot-release-notes@4406c0a9da86eee94820b8329856f3f5a6527c48"
and replace the trailing comment " # main HEAD as of 2026-04-06" with the
standardized version-style comment (e.g. " # vX.Y.Z" or the agreed release tag)
while keeping the action reference intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f7803174-6ae8-45d7-9c1a-ed7bd591f1df
📒 Files selected for processing (5)
.cursorrules.github/copilot-instructions.md.github/workflows/actionlint.yml.github/workflows/ai-release-notes.ymldocs/ai-guidelines.md
github/copilot-release-notes の行末コメントが `# main HEAD as of 2026-04-06` であり、本 PR で定めた `# vX.Y.Z` 形式のルールに違反していた。 最新リリース v1.0.1 の SHA に更新しコメントを統一形式に修正した。 レビューコメント: #138 (comment) レビュアー: coderabbitai 優先度: critical
1 participant
Summary
PR #137 で行った PR Agent ワークフローの即時修正に続き、同じ巻き戻し（
@main参照への退行）が今後再発しないための CI ガードと AI ガイドライン整備 を行います。github/copilot-release-notes@main→ 同リポジトリ main HEAD (4406c0a9/ 2026-04-06) の SHA に固定（残っていた唯一のブランチ参照）actionlintワークフローに grep ベースのステップを追加し、uses: owner/repo@(main|master|develop|trunk|HEAD)の混入を CI で弾くdocs/ai-guidelines.mdに「外部 Action は 40 桁 SHA でピン留め必須」のルールを追加し、bun run sync:ai-guidelinesで.cursorrules/.github/copilot-instructions.mdを再生成なぜブランチ参照のみを禁止するか
PR #137 で起きた
startup_failureの直接原因は「リネーム後のリポジトリ名 + ブランチ参照」の組み合わせです。タグ参照@v1は (1) 実害が比較的小さく、(2) より広域の検出はzizmor等の専用ツールに任せる方がコスパが良いため、本 PR では 「実害が大きいブランチ参照のみを最小コストで弾く」 スコープに留めました。関連
Test plan
uses: foo/bar@mainを含む workflow を追加し、actionlint ジョブが赤になることを確認workflow_dispatchで空打ちし、Generate release notesステップが少なくとも Action 解決まで進むことを確認Summary by CodeRabbit
@mainなど）の使用を検出・禁止する検証ステップを追加しました