CNTRLPLANE-3677: address-review-pr: add author authorization check - #590
Merged
openshift-merge-bot[bot] merged 2 commits intoJul 6, 2026
Conversation
openshift-ci
Bot
added
the
approved
Contributor
WalkthroughA new authorization check is added for review-comment authors, and the review skill now uses it before processing comments. The plugin version is updated to 1.1.7 in both manifest and marketplace metadata. ChangesAuthor authorization flow
Plugin version metadata
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (8 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
enxebre
force-pushed
the
address-review-pr-author-authorization
branch
2 times, most recently
from
June 30, 2026 13:17
9f141e0 to
4f77060
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@plugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py`:
- Around line 46-52: The gh subprocess calls in run_gh and the other
subprocess.run usage should not wait indefinitely. Add a bounded timeout to each
gh invocation, and in the surrounding error handling convert
subprocess.TimeoutExpired into the same documented nonzero error exit used for
other failures. Keep the fix localized to the helper that wraps gh and the later
call site so Step 0.5 fails fast instead of hanging.
- Around line 104-150: The OWNERS/OWNERS_ALIASES lookup in check_authorized.py
is swallowing real fetch/parsing errors and only printing warnings, which causes
authorized reviewers to be treated as unauthorized. Update the OWNERS_ALIASES
and OWNERS loading logic in the authorization flow to distinguish
missing/optional files from actual gh/API/parsing failures, and re-raise or
propagate the real failures so the caller can return exit 2 instead of falling
through to not_authorized. Keep the existing authorized/aliases merge behavior,
but make sure genuine lookup errors from run_gh, yaml.safe_load, or alias
processing are not silently ignored.
- Around line 126-148: The fallback path in check_authorized.py does not process
nested filters entries, so authorized names under filters are missed when
HAS_YAML is false. Update the non-YAML branch to either fail fast with exit 2 if
PyYAML is unavailable, or extend the fallback parsing logic used by
_parse_simple_yaml_list so it also reads approvers and reviewers inside filters
sections. Keep the behavior consistent with the HAS_YAML branch and verify
authorized.add receives those nested entries too.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5fd2424c-21d2-43b3-832e-e3112783ca51
📒 Files selected for processing (4)
docs/index.htmlplugins/openshift-developer/.claude-plugin/plugin.jsonplugins/openshift-developer/skills/address-review-pr/SKILL.mdplugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py
enxebre
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@enxebre: This pull request references CNTRLPLANE-3677 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Only process review comments from authorized users: OWNERS, OWNERS_ALIASES members, approved bots (coderabbitai), or org members. Prevents untrusted actors from instructing the agent to make changes via review comments. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
enxebre
force-pushed
the
address-review-pr-author-authorization
branch
from
June 30, 2026 13:37
4f77060 to
e223311
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@plugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py`:
- Around line 180-194: The org membership lookup in is_org_member() is treating
transport/auth/timeouts as a normal non-member result, which causes main() to
exit with the wrong status. Update is_org_member() to distinguish a real
404/non-member response from gh API failures and exceptions, returning False
only for an actual non-member and surfacing lookup errors (for example via an
exception or separate failure signal) so main() can follow its error path and
exit 2.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a547ab59-a5ea-49b2-a3f4-7a3f08c4364a
📒 Files selected for processing (5)
docs/index.htmlplugins/openshift-developer/.claude-plugin/plugin.jsonplugins/openshift-developer/README.mdplugins/openshift-developer/skills/address-review-pr/SKILL.mdplugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py
✅ Files skipped from review due to trivial changes (3)
- plugins/openshift-developer/README.md
- plugins/openshift-developer/.claude-plugin/plugin.json
- docs/index.html
🚧 Files skipped from review as they are similar to previous changes (1)
- plugins/openshift-developer/skills/address-review-pr/SKILL.md
Distinguish real non-member responses (404) from API/auth/network failures in is_org_member(). Failures now raise OrgMembershipLookupError so main() routes them to exit 2 (error path) instead of exit 1 (not authorized). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
plugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py (1)
200-204: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winChain the re-raised exceptions with
from e.Both re-raises inside the
exceptblocks drop the original traceback context, per the Ruff B904 hint.🔧 Proposed fix
except subprocess.TimeoutExpired: - raise OrgMembershipLookupError(f"Org membership check timed out for {login}") + raise OrgMembershipLookupError(f"Org membership check timed out for {login}") from None except Exception as e: - raise OrgMembershipLookupError(f"Failed to check org membership for {login}: {e}") + raise OrgMembershipLookupError(f"Failed to check org membership for {login}: {e}") from e🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py` around lines 200 - 204, Update the exception handling in the org membership check logic so the re-raised OrgMembershipLookupError instances preserve the original exception context. In the try/except block that catches subprocess.TimeoutExpired and the generic Exception as e, raise the new OrgMembershipLookupError using exception chaining with from e, and keep the bare raise only where you are intentionally re-throwing an existing active exception.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@plugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py`:
- Around line 200-204: Update the exception handling in the org membership check
logic so the re-raised OrgMembershipLookupError instances preserve the original
exception context. In the try/except block that catches
subprocess.TimeoutExpired and the generic Exception as e, raise the new
OrgMembershipLookupError using exception chaining with from e, and keep the bare
raise only where you are intentionally re-throwing an existing active exception.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 42fdf2a8-6eaf-46e5-b723-f0fe6ac0ab3b
📒 Files selected for processing (1)
plugins/openshift-developer/skills/address-review-pr/scripts/check_authorized.py
bryan-cox
approved these changes
Jul 6, 2026
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox, enxebre The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
check_authorized.pyscript that verifies PR comment authors against OWNERS, OWNERS_ALIASES, approved bots, and org membership before processing their feedbackThis replicates the authorization logic from the review-agent
comment_analyzer.pyas a standalone reusable script.Test plan
check_authorized.py openshift hypershift enxebre→ authorized (owners), exit 0check_authorized.py openshift hypershift 'coderabbitai[bot]'→ authorized (approved_bot), exit 0check_authorized.py openshift hypershift random-attacker-user→ not authorized, exit 1check_authorized.py openshift hypershift openshift-ci-robot→ ignored bot, exit 1🤖 Generated with Claude Code
Summary by CodeRabbit