Repository navigation
feat: implement issue #399 — Compliance: ruleset-bypass-orgadmin-code-quality - #405
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe ruleset application script now configures required bypass actors, preserves other existing actors during updates, and sends the merged list in the payload. BATS tests cover ruleset creation and update payloads. ChangesRuleset bypass configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:M
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the GitHub ruleset script to include OrganizationAdmin as a bypass actor with always bypass mode, and adds a corresponding BATS test to verify the payload structure. The review feedback suggests improving the test suite by leveraging BATS's built-in $BATS_TEST_TMPDIR instead of manually managing a temporary directory in setup and teardown, defining GH_TOKEN locally, and using a single semantic jq assertion to validate the bypass_actors array.
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/scripts/tests/apply-code-quality-ruleset.bats (1)
57-74: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winCover the existing-ruleset update path.
This test forces the lookup to return no existing ruleset, so it only exercises
POST. Verify that another test covers thePUTpath. If none exists, capture the update payload and assert the bypass actor contract there too.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/tests/apply-code-quality-ruleset.bats around lines 57 - 74, The test currently covers only the create path because the mocked ruleset lookup returns no existing ruleset. Add coverage for the existing-ruleset update path in the tests around the apply-code-quality-ruleset script: mock a returned ruleset, capture the PUT payload, and assert it includes the OrganizationAdmin bypass actor with bypass_mode always, while preserving the existing POST assertions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/apply-code-quality-ruleset.sh:
- Around line 14-19: Update the ruleset payload’s bypass_actors configuration to
include both OrganizationAdmin and the Integration actor
dependabot-automerge-petry, using its required actor_id, so the PUT update
preserves both bypasses. Revise the nearby comments to document both required
actors.
---
Nitpick comments:
In @.github/scripts/tests/apply-code-quality-ruleset.bats:
- Around line 57-74: The test currently covers only the create path because the
mocked ruleset lookup returns no existing ruleset. Add coverage for the
existing-ruleset update path in the tests around the apply-code-quality-ruleset
script: mock a returned ruleset, capture the PUT payload, and assert it includes
the OrganizationAdmin bypass actor with bypass_mode always, while preserving the
existing POST assertions.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 853b4cb2-88a1-4115-82c4-e7428ce85b1d
📒 Files selected for processing (2)
.github/scripts/apply-code-quality-ruleset.sh.github/scripts/tests/apply-code-quality-ruleset.bats
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #405 |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: e3e884d538af101c73871f0c58065d2765b288c1
Review mode: triage-approved (single reviewer)
Summary
Adds the two org-mandated bypass actors (OrganizationAdmin and the dependabot-automerge-petry GitHub App, both bypass_mode: always) to the code-quality ruleset payload in .github/scripts/apply-code-quality-ruleset.sh, with a merge path that preserves any other existing bypass actors when updating an existing ruleset. Two new bats tests cover both the create (POST) and update (PUT) payloads. The change exactly matches the codified org standard (standards/github-settings.md and standards/rulesets/code-quality.json in petry-projects/.github), including the hardcoded Integration actor_id 3167543, which was verified against the canonical ruleset JSON.
Linked issue analysis
Closes #399 (Compliance: ruleset-bypass-orgadmin-code-quality). The issue requires the OrganizationAdmin bypass actor with bypass_mode: always on the code-quality ruleset; the PR adds it. It additionally adds the dependabot-automerge-petry Integration bypass actor, which the same referenced standard section explicitly requires on every ruleset targeting main — in-scope per the standard, not scope creep. The issue is substantively addressed.
Findings
- Merge logic on update filters out any pre-existing OrganizationAdmin / Integration-3167543 entries before appending the required actors, so it is idempotent and does not clobber other legitimate bypass actors — this addresses the earlier CodeAnt finding (thread resolved).
- bypass_mode: always for the Dependabot app is justified by the standard (pull_request mode does not work for PRs the actor opens; the automerge workflow verifies CI + MERGEABLE before merging).
- All 4 bot review threads (gemini-code-assist x2, codeant-ai, coderabbitai) are resolved; no human reviewer questions are outstanding.
- Secret scan MCP tool was not available in this session; the gitleaks CI check passed and the diff contains no secret-like content.
- Triage assessment confirmed: change is a focused, standards-driven config-script update with test coverage. Risk rated MEDIUM (touches branch-protection/bypass configuration) rather than LOW, but it converges the repo to the codified org standard rather than deviating from it.
CI status
All code-relevant checks green: agent-shield, CodeQL, SonarCloud (quality gate passed), Secret scan (gitleaks), dependency-audit, Graphite AI review, CodeRabbit. Remaining SKIPPED entries are ecosystem-specific audits and CI not applicable to this diff; CANCELLED entries are superseded dev-lead/review orchestration runs, not code CI failures. No failing checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
|
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-07T15:38:40Z. |
2 participants
User description
Closes #399
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Allow organization administrators to bypass the code-quality ruleset in emergencies
What Changed
Impact
✅ Emergency admin overrides for protected branches✅ Required checks remain enforced for regular changes✅ Fewer configuration regressions💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
New Features
OrganizationAdminand automated dependency-update bypass actors with always-enabled bypass access.Tests