Fix/setup api client coverage gaps by stranske · Pull Request #1189 · stranske/Workflows

stranske · 2026-02-02T04:30:28Z

No description provided.

Tracks which workflow jobs have github-script but lack setup-api-client. Identifies 10 gaps requiring fixes for complete rate limit remediation. Columns track fix status, PR number, and date for audit trail.

Systematic audit found 8 jobs with github-script that make API calls but were missing setup-api-client for rate limit mitigation. Fixed jobs: - agents-autofix-loop.yml / metrics - agents-bot-comment-handler.yml / cleanup - reusable-10-ci-python.yml / logs_summary - reusable-16-agents.yml / preflight - reusable-20-pr-meta.yml / keepalive_orchestrator - reusable-20-pr-meta.yml / keepalive_from_gate - reusable-20-pr-meta.yml / pr_body_update - reusable-bot-comment-handler.yml / dispatch Identified false positive (no fix needed): - reusable-16-agents.yml / verify_issue_summary (uses core.summary only) Audit tracked in docs/fixes/setup-api-client-coverage-audit.csv Refs: #1183

stranske-keepalive · 2026-02-02T04:30:46Z

⚠️ Action Required: Unable to determine source issue for PR #1189. The PR title, branch name, or body must contain the issue number (e.g. #123, branch: issue-123, or the hidden marker ).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 626e159283

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

.github/workflows/reusable-20-pr-meta.yml

agents-workflows-bot · 2026-02-02T04:32:48Z

Automated Status Summary

Head SHA: bb0efa1
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / Enforce agents workflow protections
Required: core tests (3.11): ⏳ pending, core tests (3.12): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

Coverage history entries: 1

Coverage Trend

Metric	Value
Current	93.12%
Baseline	85.00%
Delta	+8.12%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
`src/cli_parser.py`	81.8%	4
`src/percentile_calculator.py`	95.0%	1
`src/aggregator.py`	95.0%	2
`src/__init__.py`	100.0%	0
`src/ndjson_parser.py`	100.0%	0

Updated automatically; will refresh on subsequent CI/Docker completions.

Keepalive checklist

Scope

No scope information available

Tasks

No tasks defined

Acceptance criteria

No acceptance criteria defined

stranske-keepalive · 2026-02-02T04:33:25Z

🤖 Keepalive Loop Status

PR #1189 | Agent: Codex | Iteration 0/5

Current State

Metric	Value
Iteration progress	[----------] 0/5
Action	wait (missing-agent-label)
Disposition	skipped (transient)
Gate	success
Tasks	0/0 complete
Timeout	45 min (default)
Timeout usage	2m elapsed (6%, 43m remaining)
Keepalive	❌ disabled
Autofix	❌ disabled

🔍 Failure Classification

Review pointed out that in reusable-20-pr-meta.yml, jobs that checkout workflows-lib should use ./workflows-lib/.github/actions/setup-api-client, while jobs that checkout consumer first should use ./consumer/.github/... Corrected: - keepalive_orchestrator, keepalive_from_gate, pr_body_update: use workflows-lib (Workflows repo is checked out to workflows-lib/ with setup-api-client) - keepalive_dispatch: kept using consumer checkout (consumer repo is checked out first, workflows-lib comes later) Updated audit spreadsheet to reflect the two different patterns.

Copilot

Pull request overview

Adds setup-api-client coverage in several workflows/jobs that use actions/github-script, and records an audit of the coverage/fix status.

Changes:

Added setup-api-client + required sparse-checkout deps to multiple workflows/jobs using github-script.
Added consumer checkout + setup-api-client initialization to additional jobs in reusable-20-pr-meta.yml.
Added an audit CSV documenting coverage/fix status for targeted jobs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
docs/fixes/setup-api-client-coverage-audit.csv	Tracks which workflow jobs use `github-script` and whether `setup-api-client` coverage is present.
.github/workflows/reusable-bot-comment-handler.yml	Adds sparse-checkout deps + `setup-api-client` step for the `dispatch` job.
.github/workflows/reusable-20-pr-meta.yml	Adds consumer checkout + `setup-api-client` steps to additional jobs.
.github/workflows/reusable-16-agents.yml	Adds sparse-checkout deps + `setup-api-client` step in `preflight`.
.github/workflows/reusable-10-ci-python.yml	Adds checkout + `setup-api-client` in `logs_summary` (was missing checkout).
.github/workflows/agents-bot-comment-handler.yml	Adds sparse-checkout deps + `setup-api-client` step in `cleanup`.
.github/workflows/agents-autofix-loop.yml	Adds sparse-checkout deps + `setup-api-client` step in `metrics`; minor whitespace cleanup.

Comments suppressed due to low confidence (3)

.github/workflows/reusable-20-pr-meta.yml:289

The setup-api-client composite installs @octokit/* deps under $GITHUB_WORKSPACE/.github/scripts, but this job later loads JS helpers from $GITHUB_WORKSPACE/workflows-lib/.github/scripts. Node module resolution won’t pick up deps from .github/scripts/node_modules, so token_load_balancer’s import('@octokit/*') will still fail (token rotation won’t actually be enabled). Consider installing deps in workflows-lib/.github/scripts (or repo-root node_modules) and/or extending setup-api-client with an install_dir input. Also, service_bot_pat is lower-case in workflow_call secrets, so toJSON(secrets) won’t populate SERVICE_BOT_PAT unless you pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).


      - name: Mint GitHub App token (preferred)
        id: app_token
        continue-on-error: true
        uses: actions/create-github-app-token@v2

.github/workflows/reusable-20-pr-meta.yml:365

The setup-api-client composite installs @octokit/* deps under $GITHUB_WORKSPACE/.github/scripts, but this job loads shared scripts from $GITHUB_WORKSPACE/workflows-lib/.github/scripts. Node won’t resolve deps from .github/scripts/node_modules, so token_load_balancer’s import('@octokit/*') will still fail (no real token rotation). Consider installing deps in workflows-lib/.github/scripts (or repo-root node_modules) and/or extending setup-api-client with an install_dir input. Also, service_bot_pat is lower-case in workflow_call secrets, so toJSON(secrets) won’t populate SERVICE_BOT_PAT unless you pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

        with:
          script: |
            const scriptsPath = process.env.WORKFLOWS_SCRIPTS_PATH;
            const { evaluateKeepaliveGate } = require(`${scriptsPath}/.github/scripts/keepalive_gate.js`);
            const result = await evaluateKeepaliveGate({

.github/workflows/reusable-20-pr-meta.yml:510

The setup-api-client composite installs @octokit/* deps under $GITHUB_WORKSPACE/.github/scripts, but this job loads shared scripts from $GITHUB_WORKSPACE/workflows-lib/.github/scripts. Node won’t resolve deps from .github/scripts/node_modules, so token_load_balancer’s import('@octokit/*') will still fail (no real token rotation). Consider installing deps in workflows-lib/.github/scripts (or repo-root node_modules) and/or extending setup-api-client with an install_dir input. Also, service_bot_pat is lower-case in workflow_call secrets, so toJSON(secrets) won’t populate SERVICE_BOT_PAT unless you pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

              github, context, core,
              inputs: {
                pr_number: process.env.PR_NUMBER,
                dry_run: process.env.DRY_RUN === 'true',
              },

Copilot · 2026-02-02T04:45:33Z

.github/workflows/reusable-bot-comment-handler.yml

+        uses: ./.github/actions/setup-api-client
+        with:
+          secrets: ${{ toJSON(secrets) }}
+          github_token: ${{ github.token }}


In this reusable workflow, workflow_call secrets like service_bot_pat / gh_app_id are lower-case. setup-api-client’s JSON parsing looks for upper-case keys (e.g., SERVICE_BOT_PAT, GH_APP_ID), so passing only secrets: ${{ toJSON(secrets) }} won’t export these tokens to the environment. Pass the action’s individual inputs (service_bot_pat, gh_app_id, gh_app_private_key, etc.) or update setup-api-client to also recognize lower-case secret keys.

Suggested change

github_token: ${{ github.token }}

github_token: ${{ github.token }}

service_bot_pat: ${{ secrets.service_bot_pat }}

gh_app_id: ${{ secrets.gh_app_id }}

gh_app_private_key: ${{ secrets.gh_app_private_key }}

Copilot · 2026-02-02T04:45:34Z

.github/workflows/reusable-16-agents.yml

+        uses: ./.github/actions/setup-api-client
+        with:
+          secrets: ${{ toJSON(secrets) }}
+          github_token: ${{ github.token }}


workflow_call defines service_bot_pat as a lower-case secret name, but setup-api-client’s toJSON(secrets) parsing only extracts SERVICE_BOT_PAT (upper-case). As a result this step won’t export the service bot token unless you also pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

Suggested change

github_token: ${{ github.token }}

github_token: ${{ github.token }}

service_bot_pat: ${{ secrets.service_bot_pat }}

stranske added 2 commits February 2, 2026 04:21

docs: add setup-api-client coverage audit spreadsheet

73525e1

Tracks which workflow jobs have github-script but lack setup-api-client. Identifies 10 gaps requiring fixes for complete rate limit remediation. Columns track fix status, PR number, and date for audit trail.

Copilot AI review requested due to automatic review settings February 2, 2026 04:30

stranske temporarily deployed to agent-high-privilege February 2, 2026 04:30 — with GitHub Actions Inactive

Copilot started reviewing on behalf of stranske February 2, 2026 04:30 View session

docs: update audit spreadsheet with PR#1189

597b098

chatgpt-codex-connector bot reviewed Feb 2, 2026

View reviewed changes

.github/workflows/reusable-20-pr-meta.yml Show resolved Hide resolved

stranske temporarily deployed to agent-high-privilege February 2, 2026 04:33 — with GitHub Actions Inactive

stranske temporarily deployed to agent-high-privilege February 2, 2026 04:36 — with GitHub Actions Inactive

stranske merged commit ce87b43 into main Feb 2, 2026
38 checks passed

stranske deleted the fix/setup-api-client-coverage-gaps branch February 2, 2026 04:39

Copilot AI reviewed Feb 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix/setup api client coverage gaps#1189

Fix/setup api client coverage gaps#1189
stranske merged 4 commits intomainfrom
fix/setup-api-client-coverage-gaps

stranske commented Feb 2, 2026

Uh oh!

stranske-keepalive bot commented Feb 2, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

agents-workflows-bot bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

stranske-keepalive bot commented Feb 2, 2026 •

edited by agents-workflows-bot bot

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-          github_token: ${{ github.token }}
+          github_token: ${{ github.token }}
+          service_bot_pat: ${{ secrets.service_bot_pat }}
+          gh_app_id: ${{ secrets.gh_app_id }}
+          gh_app_private_key: ${{ secrets.gh_app_private_key }}

	github_token: ${{ github.token }}
	github_token: ${{ github.token }}
	service_bot_pat: ${{ secrets.service_bot_pat }}

Conversation

stranske commented Feb 2, 2026

Uh oh!

stranske-keepalive bot commented Feb 2, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

agents-workflows-bot bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Automated Status Summary

Coverage Overview

Coverage Trend

Top Coverage Hotspots (lowest coverage)

Keepalive checklist

Scope

Tasks

Acceptance criteria

Uh oh!

stranske-keepalive bot commented Feb 2, 2026 • edited by agents-workflows-bot bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Keepalive Loop Status

Current State

🔍 Failure Classification

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

agents-workflows-bot bot commented Feb 2, 2026 •

edited

Loading

stranske-keepalive bot commented Feb 2, 2026 •

edited by agents-workflows-bot bot

Loading