fix(repo-maintenance): Quality Gate 必須チェックの fallback ワークフローを配布対象に追加 - #721
Conversation
setup-team-protection.sh はブランチ保護に "Quality Gate" を必須として登録するが、 ci.yml が paths フィルタでスキップされたり、claude[bot] / dependabot[bot] の GITHUB_TOKEN による push でワークフローが発火しなかった場合、Quality Gate が 報告されず PR が "Expected — Waiting for status to be reported" のまま blocked になる。 この状態を 3 時間ごとの n8n resolveGitConflict 監視が「CI 失敗」として誤検出し、 @claude PRがbaseにマージする際にCIが落ちています を誤投稿する原因になっていた (例: https://github.com/Elu-co-jp/prog-insight/pull/129)。 - templates/workflows/quality-gate-fallback.yml をテンプレート化 - repo-maintenance.md section 3.22 のマネージドファイルに追加し、 config 管理下の全リポジトリへ自動配布されるようにする - repo-maintenance.md に section 3.5.0.2 (Quality Gate Fallback Consistency Check) を追加し、ブランチ保護に Quality Gate がある repo で fallback 未配置時に警告 n8n 側の修正は keito4-org/n8n_custom_node#1857 で対応。
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR introduces a new GitHub Actions workflow, ChangesQuality Gate Fallback Implementation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Claude finished @keito4's task in 3m 3s —— View job コードレビュータスク一覧
総評PRの目的（bot push 後の PR stuck 問題の解消）は明確で、アプローチも合理的です。 verdict: minor/recommendation のみ → APPROVE 相当（修正は任意） 指摘事項[major]
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/commands/repo-maintenance.md:
- Around line 982-985: The check hardcodes "branches/main" so REQUIRED_CHECKS
misses protections on other branches; update the logic that calls gh api
"repos/{owner}/{repo}/branches/main/protection/required_status_checks" to
iterate the branch names in the existing PROTECT_BRANCHES (or otherwise-detected
branch list used for Next.js: main, pre-production, production) and aggregate
required contexts into REQUIRED_CHECKS; for each branch name call gh api
".../branches/{branch}/protection/required_status_checks" (or skip if API 404),
join/merge the .contexts results and fallback to empty if none so the subsequent
Quality Gate logic correctly detects required checks across all protected
branches.
In `@templates/workflows/quality-gate-fallback.yml`:
- Around line 32-33: The workflow currently grants only contents: read, but the
script calls github.rest.actions.listWorkflowRunsForRepo which requires the
actions: read permission; update the permissions section by adding actions: read
(in addition to contents: read) so the GITHUB_TOKEN has the required access for
the workflow-runs API.
- Around line 61-70: The current logic around ciRun treats any completed run
without conclusion 'success' as "did not run" and sets ci_running to true in
some branches; update the conditional in the ciRun handling so only
ciRun.conclusion === 'success' results in core.setOutput('ci_running','true')
and all other completed conclusions (failed, cancelled, timed_out) set
core.setOutput('ci_running','false') and log an appropriate message; also ensure
the workflow permissions include actions: read (in addition to contents: read)
so the listWorkflowRunsForRepo call works with GITHUB_TOKEN.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: accd105c-552b-453d-bfc7-b4d9e0da16cb
📒 Files selected for processing (2)
.claude/commands/repo-maintenance.mdtemplates/workflows/quality-gate-fallback.yml
| if gh api "repos/{owner}/{repo}/branches/main/protection/required_status_checks" >/dev/null 2>&1; then | ||
| REQUIRED_CHECKS=$(gh api "repos/{owner}/{repo}/branches/main/protection/required_status_checks" \ | ||
| --jq '.contexts // [] | join(",")' 2>/dev/null || echo "") | ||
| fi |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's locate and examine the file
find . -name "repo-maintenance.md" -type fRepository: keito4/config
Length of output: 96
🏁 Script executed:
# Once found, read the relevant section around lines 982-985
head -985 .claude/commands/repo-maintenance.md | tail -20Repository: keito4/config
Length of output: 1008
🏁 Script executed:
# Search for references to protected branches throughout the file
rg "main|master|pre-production|production" .claude/commands/repo-maintenance.md -n | head -30Repository: keito4/config
Length of output: 2593
🏁 Script executed:
# Check the PR objective section
rg -A 5 -B 2 "Objective|objective|PR objective" .claude/commands/repo-maintenance.md | head -50Repository: keito4/config
Length of output: 39
🏁 Script executed:
# Look for the fallback workflow section
rg -A 10 "quality-gate-fallback|fallback.*workflow" .claude/commands/repo-maintenance.md | head -50Repository: keito4/config
Length of output: 2308
🏁 Script executed:
# Check if there's any other logic handling multiple branches for Quality Gate
rg "Quality Gate|required_status_checks" .claude/commands/repo-maintenance.md -B 3 -A 3Repository: keito4/config
Length of output: 5022
🏁 Script executed:
# Verify the logic flow - check what happens after REQUIRED_CHECKS is set
sed -n '982,1010p' .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 1259
🏁 Script executed:
# Check if default branch is used anywhere else in the script
rg "defaultBranchRef|default.*branch|DEFAULT_BRANCH" .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 39
Hardcoding main creates inconsistency with multi-branch protection logic.
The Quality Gate check only inspects branches/main, but the script's PROTECT_BRANCHES logic supports main, pre-production, and production for Next.js projects. When Quality Gate is registered as required on pre-production or production, the hardcoded check misses them, incorrectly determining no fallback is needed and allowing the PR to block on "Expected — Waiting for status to be reported."
Dynamic branch detection is needed to align with the protection scope.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/commands/repo-maintenance.md around lines 982 - 985, The check
hardcodes "branches/main" so REQUIRED_CHECKS misses protections on other
branches; update the logic that calls gh api
"repos/{owner}/{repo}/branches/main/protection/required_status_checks" to
iterate the branch names in the existing PROTECT_BRANCHES (or otherwise-detected
branch list used for Next.js: main, pre-production, production) and aggregate
required contexts into REQUIRED_CHECKS; for each branch name call gh api
".../branches/{branch}/protection/required_status_checks" (or skip if API 404),
join/merge the .contexts results and fallback to empty if none so the subsequent
Quality Gate logic correctly detects required checks across all protected
branches.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7418f28dbf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } else if (ciRun && ciRun.conclusion === 'success') { | ||
| core.info(`CI workflow already succeeded (${ciRun.html_url}).`); | ||
| core.setOutput('ci_running', 'true'); | ||
| } else { |
There was a problem hiding this comment.
This logic marks ci_running=false whenever a CI run exists but finished with a non-success conclusion (for example failure or cancelled), so the fallback job then emits a successful Quality Gate check even though CI actually ran and failed. Because setup-team-protection.sh configures branch protection to require only the Quality Gate context (script/setup-team-protection.sh lines 271-273), repos that adopt this template can get a green required check from the fallback in the exact case where CI should block merging.
Useful? React with 👍 / 👎.
prog-insight#132 で fallback ワークフローが 403 Resource not accessible by integration で失敗し、Quality Gate が fail として報告されることを確認。 原因: github.rest.actions.listWorkflowRunsForRepo は actions: read 権限を 要求するが、permissions ブロックには contents: read のみ宣言していた。 - permissions に actions: read を追加 (templates/ と .github/workflows/ 両方) - 権限不足や API 障害で listWorkflowRuns が失敗した場合は ci_running='true' 扱いにして fallback の Pass emit をスキップ。誤った Pass / Fail よりは Required check が未報告のまま残る方が安全
|
🎉 This PR is included in version 1.111.4 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Why
setup-team-protection.shはブランチ保護にQuality Gateを必須として登録するが、対応する fallback ワークフローがtemplates/workflows/に存在せず、config 管理下の各リポジトリに自動配布されていなかった。その結果、以下のケースで PR が永続的に
Expected — Waiting for status to be reportedのまま blocked になる:pathsフィルタでスキップされるclaude[bot]/dependabot[bot]の GITHUB_TOKEN による push でワークフローが発火しない (GitHub の仕様)このブロック状態を 3 時間ごとの n8n
resolveGitConflict監視が「CI 失敗」として誤検出し、@claude PRがbaseにマージする際にCIが落ちていますを誤投稿する原因になっていた (例: https://github.com/Elu-co-jp/prog-insight/pull/129 で複数回ループ)。What
templates/workflows/quality-gate-fallback.ymlを新規作成 (.github/workflows/quality-gate-fallback.yml相当 + 既知の制限を明記したヘッダーコメント).claude/commands/repo-maintenance.mdsection 3.22 のマネージドファイル一覧にquality-gate-fallback.ymlを追加.claude/commands/repo-maintenance.mdに section 3.5.0.2Quality Gate Fallback Consistency Checkを追加し、ブランチ保護にQuality Gateがある repo で fallback 未配置時に警告 + full mode で section 3.22 経由で自動配置How
/repo-maintenance実行時、config 管理下の全リポジトリの.github/workflows/quality-gate-fallback.ymlが config の最新版で上書きされるRisk
.github/workflows/quality-gate-fallback.yml) はそのまま機能継続claude[bot]push 後のコミットでは fallback も発火しない。この場合は Claude Code Action の push に PAT を使うかworkflow_dispatchでの再トリガーが別途必要 (本 PR スコープ外)Test plan
prettier --checkパスpre-commithooks (lint / test 95 件) パス/repo-maintenance --mode fullを実行し、quality-gate-fallback.ymlが配置されることを確認🤖 Generated with Claude Code
Summary by CodeRabbit