Repository navigation
ci: inline NOSONAR(S7635) markers on secrets:inherit caller stubs - #321
Conversation
Append the org-canonical `# NOSONAR(githubactions:S7635)` inline marker to unmarked `secrets: inherit` lines in first-party caller-stub workflows. No behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
Next review available in: 36 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
There was a problem hiding this comment.
Pull request overview
This PR suppresses SonarCloud rule githubactions:S7635 false positives by adding org-standard inline # NOSONAR(githubactions:S7635) markers to secrets: inherit lines in first-party GitHub Actions caller-stub workflows, without changing workflow behavior.
Changes:
- Added inline
# NOSONAR(githubactions:S7635)markers tosecrets: inheritin affected caller workflows. - Kept existing workflow structure,
uses:targets, and permissions unchanged.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/auto-rebase.yml | Adds inline S7635 NOSONAR marker to secrets: inherit for the reusable caller job. |
| .github/workflows/dependabot-automerge.yml | Adds inline S7635 NOSONAR marker to secrets: inherit for the reusable caller job. |
| .github/workflows/dev-lead.yml | Adds inline S7635 NOSONAR marker to secrets: inherit for the reusable caller job. |
| .github/workflows/pr-review-mention.yml | Adds inline S7635 NOSONAR marker to secrets: inherit for the reusable caller job. |
| .github/workflows/pr-review.yml | Adds inline S7635 NOSONAR marker to secrets: inherit for the reusable caller job. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: b5ad07d2a1c884d46684bc556495828537dd9ce3
Review mode: triage-approved (single reviewer)
Summary
Comment-only PR appending the org-canonical inline NOSONAR(githubactions:S7635) marker to the unmarked 'secrets: inherit' line in 5 first-party caller-stub workflows (auto-rebase, dependabot-automerge, dev-lead, pr-review-mention, pr-review). No behavior change: secrets flow, permissions, and 'uses:' targets are untouched. Suppression is sanctioned by issue #313 (inline NOSONAR allowed for confirmed false positives, noted inline) and matches existing precedent — every touched file already carries an inline NOSONAR(S7637) marker on its 'uses:' line. Risk rated MEDIUM rather than LOW because it silences a security-class scanner rule on secrets handling, but each marker carries a per-line rationale ('first-party trusted reusable') and all reusables are petry-projects first-party refs.
Linked issue analysis
Closes #313 (SonarCloud: S7635 secrets-inherit caller stubs — 5 MAJOR findings). The PR addresses exactly the 5 files/lines the issue lists. Acceptance criteria: (1) findings to zero — SonarCloud Quality Gate passed on this PR with 0 new/accepted issues; the idempotent audit issue auto-closes when the count reaches zero on the next run; (2) no behavior change, CI green — confirmed, marker-only diff and all checks pass; (3) real fixes / no blanket NOSONAR unless confirmed false positive noted inline — satisfied: per-line markers with inline rationale, and the FP justification (secrets: inherit to trusted first-party reusables is the org-intended pattern) is documented in the PR body.
Findings
No blocking findings.
- Verified the diff is strictly comment-appends on the 5 'secrets: inherit' lines; no workflow logic, permissions, refs, or inputs changed.
- All 5 'uses:' targets are first-party (petry-projects/.github and petry-projects/.github-private) on org channel refs, consistent with the false-positive rationale.
- Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed, and the diff introduces no secret-like content (comments only).
- Nit (pre-existing, non-blocking): .github/workflows/pr-review.yml still lacks a trailing newline.
CI status
All required checks green: CI (Detect ecosystems, Secret scan/gitleaks) SUCCESS; CodeQL (actions) SUCCESS; SonarCloud Analysis + Quality Gate SUCCESS (0 new issues, 0 hotspots); AgentShield SUCCESS; dependency-audit SUCCESS (language audits skipped — no matching ecosystems); remaining skips are conditional jobs not applicable to this PR. Copilot review generated no comments; no unresolved threads or unanswered human questions.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: b5ad07d2a1c884d46684bc556495828537dd9ce3
Review mode: triage-approved (single reviewer)
Summary
Comment-only PR appending the org-canonical inline NOSONAR(githubactions:S7635) marker to the unmarked 'secrets: inherit' line in 5 first-party caller-stub workflows (auto-rebase, dependabot-automerge, dev-lead, pr-review-mention, pr-review). No behavior change: secrets flow, permissions, inputs, and 'uses:' targets are untouched. Confirms the triage assessment: the suppression is sanctioned by issue #313's acceptance criteria (inline NOSONAR allowed for confirmed false positives, noted inline) and matches existing precedent — every touched file already carries an inline NOSONAR(S7637) marker on its 'uses:' line. Risk MEDIUM rather than LOW because it silences a security-class scanner rule on secrets handling, but each marker carries a per-line rationale and all reusables are first-party petry-projects channel refs.
Linked issue analysis
Closes #313 (SonarCloud: S7635 secrets-inherit caller stubs — 5 MAJOR findings; issue is now CLOSED). The PR addresses exactly the 5 files/lines the issue lists. Acceptance criteria: (1) findings to zero — SonarCloud Quality Gate passed on this PR with 0 new/accepted issues and the idempotent audit issue has auto-closed; (2) no behavior change, CI green — confirmed, marker-only diff and all checks pass; (3) real fixes / no blanket NOSONAR unless confirmed false positive noted inline — satisfied: per-line markers with inline rationale ('first-party trusted reusable'), FP justification documented in the PR body.
Findings
No blocking findings.
- Verified the diff is strictly comment-appends on the 5 'secrets: inherit' lines; no workflow logic, permissions, refs, or inputs changed.
- All 5 'uses:' targets are first-party (petry-projects/.github and petry-projects/.github-private) on org channel refs, consistent with the false-positive rationale.
- Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed, and the diff introduces no secret-like content (comments only).
- Nit (pre-existing, non-blocking): .github/workflows/pr-review.yml still lacks a trailing newline.
CI status
All required checks green: CI (Detect ecosystems, Secret scan/gitleaks) SUCCESS; CodeQL (actions) SUCCESS; SonarCloud Analysis + Quality Gate SUCCESS (0 new issues, 0 hotspots); AgentShield SUCCESS; dependency-audit SUCCESS (language audits skipped — no matching ecosystems); remaining skips are conditional jobs not applicable to this PR. Copilot review generated no comments; no unresolved threads or unanswered human questions.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Closes #313
Appends the org-canonical inline
# NOSONAR(githubactions:S7635)marker to every unmarkedsecrets: inheritline in this repo's first-party caller-stub workflows (thin callers thatuses:apetry-projects/...reusable and forward org secrets viasecrets: inherit).Per the org standard,
secrets: inheritto a trusted first-party reusable is the intended pattern here, so S7635 ("only pass required secrets") is a confirmed false positive on these stubs. The inline NOSONAR marker is the canonical, per-line suppression the org uses (matching the existing markers onidea-triage.yml/initiative-planner.ymlwhere present).No behavior change — marker-only edits; all workflow YAML validated. This drives the S7635 finding count to zero on the next audit run.