Repository navigation
feat: implement issue #194 — Compliance: non-stub-dependency-audit.yml - #235
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughThis PR updates ChangesCompliance Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #235 |
|
Note I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
There was a problem hiding this comment.
Pull request overview
This PR brings the repository’s centralized dependency audit workflow into compliance with org standards by pinning the reusable workflow reference to @v1, aligning with issue #194’s requirement for a non-stub dependency audit workflow.
Changes:
- Updated
.github/workflows/dependency-audit.ymlto usepetry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1(org-standard pin).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 646d8d1d8d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependency-audit.yml:
- Line 33: The unpinned `uses:` in dependency-audit.yml (the line referencing
petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1) will
trigger zizmor’s `unpinned-uses` rule and cannot be changed in this caller stub,
so either (A) update the central reusable workflow repository to publish a
pinned ref: change the reusable workflow `dependency-audit-reusable.yml`
publication/consumer to reference a specific commit SHA (i.e., replace the `@v1`
tag with an exact SHA) so callers remain compliant, or (B) add an org-level
zizmor exemption/suppression for this canonical caller stub (the
`dependency-audit.yml` caller) to allow the shared `@v1` reference; target the
reusable filename `dependency-audit-reusable.yml` and the `uses:` invocation in
`dependency-audit.yml` when applying the fix.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7433e163-104b-46b3-a4e6-a3b2bb12af46
📒 Files selected for processing (1)
.github/workflows/dependency-audit.yml
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #235 |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 1d315a2f8abaf611a5b7007850d5b588153d465a
Cascade: triage → audit (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)
Summary
The deep review's central claim is factually incorrect: the org .github repo standard template and compliance-audit script both designate @v1 as the expected pin for dependency-audit-reusable.yml. This PR brings ContentTwin's stub from the non-compliant @v2 into alignment with the canonical @v1 template — closing issue #194 as intended. No security, supply-chain, or required-status-check concerns; the v1 reusable preserves the Detect ecosystems job name.
Findings
- INFO: Verified via gh api that petry-projects/.github main standards/workflows/dependency-audit.yml pins
uses:todependency-audit-reusable.yml@v1. The deep review's assertion that the standard template pins to@v2is incorrect. - INFO: Verified via gh api that petry-projects/.github main scripts/compliance-audit.sh, function check_centralized_workflow_stubs, declares the expected pin as
dependency-audit.yml:dependency-audit-reusable:v1. The deep review's claim that the org has 'upgraded the standard to @v2' is contradicted by the compliance script itself. - INFO: Issue #194 explicitly states: 'Centralized workflow
dependency-audit.ymlreferences the reusable but is not pinned to@v1(org standard). Replace with the canonical stub fromstandards/workflows/dependency-audit.ymlwhich delegates topetry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1.' This PR performs exactly the remediation requested. - INFO: The 'MUST NOT change uses: line' guidance in the stub header is a constraint against deviating from the canonical template, not against aligning with it. ContentTwin main currently deviates (
@v2) from the canonical template (@v1); the PR restores alignment, which is the correct read of the stub contract. - INFO: Both v1 and v2 reusables expose the
detectjob namedDetect ecosystems, so the required status checkdependency-audit / Detect ecosystemscontinues to be produced after the downgrade. No branch-protection break. - INFO: The pin moves between two tags on petry-projects/.github (the org's own reusable workflow repo) — not an external dependency. v1 tag resolves to commit d3d768dabb7f28cc63283cdfe48630da53700e50, v2 to 376a4fcb1117444595e3e702fa450873d0e54310. Both are first-party and governed by the org's release process. No typosquat, no third-party action introduced.
- INFO: The Codex P1 advisory comment incorrectly assumed
@v2is the org standard based on it being the higher tag number. This contradicts the standards template, the compliance script, and issue #194. The dev-lead agent's dismissal of the Codex finding as a false positive was correct. - INFO: CodeRabbit's zizmor
unpinned-usesflag (separate from the v1/v2 question) is non-blocking: this repo's CI Lint job runs only shellcheck. Per the stub header, SHA-pinning would have to be applied upstream in petry-projects/.github, not in this caller stub.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
CI Failure: SonarCloud Code AnalysisStep: SonarCloud Code Analysis The PR downgrades the reusable dependency-audit workflow reference from Suggested fix: Revert the change in |
Closes #194
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit