Repository navigation
Conversation
…uire_code_owner_review
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances scripts/apply-rulesets.sh to allow offline previewing of codified payloads during dry runs by gracefully falling back when the GitHub API fetch fails. It also adds a comprehensive test suite in tests/scripts/apply-rulesets.test.sh to assert that standard PR quality ruleset parameters are correctly codified. The review feedback suggests improving error handling in the ruleset script to distinguish between a missing gh CLI and an invalid token scope, which prevents misleading error messages.
| if ! existing=$(gh api "repos/$ORG/$REPO/rulesets" 2>/dev/null); then | ||
| # In dry-run mode the fetch is best-effort: fall back to treating the repo as | ||
| # having no existing rulesets so the codified payloads can be previewed | ||
| # offline (without an admin token). Real runs must fail hard on a failed fetch. | ||
| if [[ "$DRY_RUN" = true ]]; then | ||
| skip "Could not fetch existing rulesets — previewing payloads as new (create)" | ||
| existing='[]' | ||
| else | ||
| err "Failed to fetch existing rulesets for $ORG/$REPO — check GH_TOKEN has administration:read scope" | ||
| exit 1 | ||
| fi | ||
| fi |
There was a problem hiding this comment.
If the gh CLI is not installed or not available in the system's PATH, the command substitution gh api ... will fail with exit code 127. In non-dry-run mode, the script currently outputs a misleading error message suggesting that the GH_TOKEN lacks the administration:read scope, which can lead to confusing troubleshooting.
We can capture the exit status of the command substitution and provide a more accurate error message if gh is missing.
| if ! existing=$(gh api "repos/$ORG/$REPO/rulesets" 2>/dev/null); then | |
| # In dry-run mode the fetch is best-effort: fall back to treating the repo as | |
| # having no existing rulesets so the codified payloads can be previewed | |
| # offline (without an admin token). Real runs must fail hard on a failed fetch. | |
| if [[ "$DRY_RUN" = true ]]; then | |
| skip "Could not fetch existing rulesets — previewing payloads as new (create)" | |
| existing='[]' | |
| else | |
| err "Failed to fetch existing rulesets for $ORG/$REPO — check GH_TOKEN has administration:read scope" | |
| exit 1 | |
| fi | |
| fi | |
| if ! existing=$(gh api "repos/$ORG/$REPO/rulesets" 2>/dev/null); then | |
| gh_err=$? | |
| # In dry-run mode the fetch is best-effort: fall back to treating the repo as | |
| # having no existing rulesets so the codified payloads can be previewed | |
| # offline (without an admin token). Real runs must fail hard on a failed fetch. | |
| if [[ "$DRY_RUN" = true ]]; then | |
| skip "Could not fetch existing rulesets — previewing payloads as new (create)" | |
| existing='[]' | |
| else | |
| if [[ $gh_err -eq 127 ]]; then | |
| err "Failed to fetch existing rulesets: 'gh' CLI is not installed or not in PATH" | |
| else | |
| err "Failed to fetch existing rulesets for $ORG/$REPO — check GH_TOKEN has administration:read scope" | |
| fi | |
| exit 1 | |
| fi | |
| fi |
|
There was a problem hiding this comment.
Pull request overview
Updates the repository’s GitHub ruleset application tooling in response to compliance issue #407 by improving offline/dry-run behavior and adding a regression test to validate the codified pr-quality ruleset payload.
Changes:
- Add a shell test that asserts
scripts/apply-rulesets.sh --dry-run --forceoutputs the requiredpr-qualityreview parameters. - Adjust
scripts/apply-rulesets.shso--dry-runcan proceed even if fetching existing rulesets fails (e.g., without an admin-capable token).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| tests/scripts/apply-rulesets.test.sh | Adds a manual regression test for the pr-quality payload emitted by scripts/apply-rulesets.sh. |
| scripts/apply-rulesets.sh | Makes existing-ruleset fetch best-effort in --dry-run to enable offline payload previews. |
| info "Fetching existing rulesets for $ORG/$REPO ..." | ||
| if ! existing=$(gh api "repos/$ORG/$REPO/rulesets"); then | ||
| err "Failed to fetch existing rulesets for $ORG/$REPO — check GH_TOKEN has administration:read scope" | ||
| exit 1 | ||
| if ! existing=$(gh api "repos/$ORG/$REPO/rulesets" 2>/dev/null); then | ||
| # In dry-run mode the fetch is best-effort: fall back to treating the repo as | ||
| # having no existing rulesets so the codified payloads can be previewed | ||
| # offline (without an admin token). Real runs must fail hard on a failed fetch. | ||
| if [[ "$DRY_RUN" = true ]]; then | ||
| skip "Could not fetch existing rulesets — previewing payloads as new (create)" |
| # The compliance standard requires the pr-quality ruleset to enforce | ||
| # require_code_owner_review=true (among other review requirements). This guards | ||
| # the codified payload against silent drift in the repo. Live GitHub-state | ||
| # convergence is a separate operation that requires an admin token. | ||
| # | ||
| # Runs the script in --dry-run --force mode so no real GitHub API calls are | ||
| # made and the repo-identity safety check is skipped. Asserts the dry-run | ||
| # output codifies each required pr-quality review parameter. |
| if [[ ! -x "$SCRIPT" && ! -f "$SCRIPT" ]]; then | ||
| echo "not ok - script not found at ${SCRIPT}" | ||
| exit 1 | ||
| fi |
|
Closing as part of the 50-PR cap drain. The dev-lead fix-loop repairs #1340 (self-cancellation), #1290 (comment-inertness) and #806 (thread-resolution) have all landed, so this deadlocked PR can be regenerated cleanly through the repaired loop. The driving issue stays open and its dev-lead label is re-fired — no work is lost. |
Closes #407
Implemented by dev-lead agent. Please review.