feat: implement issue #296 — Compliance: check-suite-prefs-unreadable

[don-petry]

Closes #296

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 53 minutes and 3 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 76240429-b29e-4ae1-8ffa-baa87f320529

📥 Commits

Reviewing files that changed from the base of the PR and between b69ba42 and d0a1ca1.

📒 Files selected for processing (2)

• scripts/apply-repo-settings.sh
• scripts/apply-repo-settings.test.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-296-20260619-1553

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request refactors the apply-repo-settings.sh script to make it modular and testable. It extracts pure helper functions for resolving repository names and checking check-suite auto-trigger statuses, and wraps the main execution flow in a source guard. Additionally, a new unit test suite apply-repo-settings.test.sh is introduced to validate these helper functions in isolation. No review comments were provided, and I have no additional feedback to offer as the changes are well-structured and include appropriate test coverage.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #300
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-19T16:42:51Z

[don-petry]

Note

I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-19T16:42:51Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 5fc74697c4f20c6e7efede2f2343152deb82f757
Review mode: triage-approved (single reviewer)

Summary

Refactors scripts/apply-repo-settings.sh into sourceable, unit-tested pure helpers (resolve_repo, auto_trigger_status) behind a BASH_SOURCE main guard, and adds a dependency-free test suite. Behavior is preserved; the key new behavior is graceful handling of unreadable check-suite preferences (conservatively PATCHing all configured apps), which is exactly the compliance gap reported in #296.

Linked issue analysis

Closes #296 (compliance: check-suite-prefs-unreadable). The finding was that the script could not read check-suite preferences and therefore left auto-trigger compliance unevaluated. The new apply_check_suite_prefs reads preferences when possible and, when they cannot be read, falls back to applying the disable PATCH for every configured app — so the script no longer silently fails to evaluate. It also adds the bare-repo-name invocation form (apply-repo-settings.sh TalkTerm) matching the remediation instructions. Substantively addressed.

Findings

No blocking issues.

• App IDs are a hardcoded readonly integer array; the jq payload builder uses tonumber, so no injection surface.
• set -euo pipefail was correctly moved inside the main guard so sourcing for tests does not abort on helpers that intentionally return non-zero (e.g. resolve_repo); the test file sets its own strict mode.
• repo value flows only into quoted gh api URL paths — no shell-injection risk.
• jq path .preferences.auto_trigger_checks matches the GitHub check-suites/preferences response shape used in both helper and tests.
• MCP secret scan (run_secret_scanning) was not executable in this run (permission not granted); gitleaks CI check passed and the diff contains no secret-like content.

CI status

Substantive checks green: gitleaks (SUCCESS), CodeQL actions+python (SUCCESS), SonarCloud quality gate passed, AgentShield (SUCCESS), CodeRabbit status (SUCCESS), gemini-code-assist reviewed with no concerns. Two dev-lead/dispatch+ci-relay runs show CANCELLED but were superseded by a later dev-lead/dispatch (SUCCESS, 16:13:03) — not a code failure. mergeStateStatus is BLOCKED only because org-leads review is required (reviewDecision REVIEW_REQUIRED), which is the gate this review satisfies.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
15 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Lint/style

SonarCloud performs static analysis (including ShellCheck-backed shell linting) on all changed files. This PR rewrites scripts/apply-repo-settings.sh into ~120 lines of new bash and adds scripts/apply-repo-settings.test.sh. SonarCloud likely flagged code-smell or reliability issues in the new shell code — common triggers include unquoted variables, unreachable branches, or a new-code coverage percentage falling below the configured quality gate threshold.

Suggested fix: Check the SonarCloud dashboard for the exact findings, then either resolve the flagged issues in the shell scripts (e.g., fix ShellCheck warnings surfaced as code smells) or, if it is a coverage gate failure, ensure the test script output is captured and uploaded as a coverage report in the CI workflow.

View run logs