feat: implement issue #286 — Compliance: check-suite-prefs-unreadable

[don-petry]

Closes #286

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 49 minutes and 17 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4eb18c29-cc4a-41a4-b6f1-3e1558d5b503

📥 Commits

Reviewing files that changed from the base of the PR and between 1c7c074 and 19ff8dd.

📒 Files selected for processing (2)

• scripts/apply-repo-settings.sh
• scripts/tests/apply-repo-settings.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-286-20260619-1533

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request adds a verification step to confirm that the check-suite auto-trigger setting for the Claude app is successfully disabled. It captures the PATCH response from the GitHub API and uses an inline Python script to parse and verify the preferences, with corresponding tests added to the BATS suite. Feedback was provided to make the inline Python script more robust by wrapping the entire parsing and extraction logic in a try-except block to prevent potential unhandled exceptions.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-19T16:55:55Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 19ff8dd209453afa805f2a652606cb5b5059bc15
Review mode: triage-approved (single reviewer)

Summary

Adds a read-back verification step to scripts/apply-repo-settings.sh: the check-suites/preferences PATCH response is now captured to a temp file (cleaned up via EXIT trap) and parsed to confirm auto-trigger for the Claude app (id 1236702) is disabled, emitting [OK]/[WARN] accordingly. Inline Python parsing is fully wrapped in try/except and degrades to 'unreadable'. Three new bats tests cover the PATCH payload assertion, the readable happy path, and the unreadable-warning path. Small (+97/-2, 2 files), test-backed, and tightly scoped to the compliance finding.

Linked issue analysis

Closes #286 (Compliance: check-suite-prefs-unreadable). The change directly addresses the finding by reading back the check-suite preferences after the PATCH and reporting whether they are readable and correctly applied, which is what lets the compliance audit clear the finding with confidence. Substantively addressed.

Findings

No blocking issues.

• Logic review: temp-file capture, EXIT-trap cleanup, and read-back parsing are correct; Python is wrapped in try/except and fails safe to 'unreadable'; the [WARN] branch preserves prior behavior when the response body is empty.
• gemini-code-assist (advisory) suggested wrapping the inline Python parse/extract in try/except for robustness — already implemented in the submitted code.
• Secret scan: MCP run_secret_scanning was unavailable (permission not granted in this run); relied on the gitleaks CI check, which passed. Diff content is shell/Python/bats logic with no credentials (app_id 1236702 is the Claude app identifier, not a secret).
• Advisory bots codex and CodeRabbit were rate-limited (not failures). Triage tier already cleared this PR as low-risk; this confirmation review agrees.

CI status

All required checks green or skipped. SUCCESS: CI Lint/Format/Test, CodeQL (Analyze actions), Secret scan (gitleaks), SonarCloud (Quality Gate passed, 0 new issues), AgentShield, dependency-audit (Detect ecosystems), dev-lead dispatch, pr-auto-review, review. SKIPPED: dependabot-automerge, dependency-audit ecosystem scanners (no matching ecosystems), dev-lead ci-relay. CodeRabbit/codex advisory bots rate-limited (non-blocking). mergeable=MERGEABLE.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Lint/style

The SonarCloud quality gate failed on new code introduced in scripts/apply-repo-settings.sh. The verify_check_suite_pref function uses an embedded Python heredoc with 2>/dev/null || true error suppression inside a command substitution, which SonarCloud flags as a reliability code smell — the || true masks failures silently, making the function appear to succeed even when Python is missing or the file is unreadable. SonarCloud also tends to flag the cognitive complexity of embedding a multi-line language (Python) inline within a shell function.

Suggested fix: Extract the inline Python snippet into a standalone helper script (e.g., scripts/lib/parse_check_suite_pref.py) and call it directly, removing the 2>/dev/null || true suppression so failures surface explicitly.

View run logs