Conversation
fix: restore Guardrails before PR Sync
|
Warning Review limit reached
Next review available in: 57 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
📝 WalkthroughWalkthroughPR metadata validation now runs directly on trusted pull request events. Autofill runs before validation. PR Sync handles selected lifecycle events and successful validation completions, then synchronizes live pull request context. ChangesPR governance workflows
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant PRMetadata
participant PRSync
participant GitHubAPI
PullRequest->>PRMetadata: trigger pull_request_target
PRMetadata->>PRMetadata: autofill and validate metadata
PRMetadata-->>PRSync: report successful validation
PRSync->>GitHubAPI: fetch live pull request context
PRSync->>PRSync: synchronize live pull request context
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-metadata.yml:
- Around line 12-15: Update the qa-live caller workflow to pass
github.event.pull_request.head.sha as checkout_ref, remove secrets: inherit, and
restrict the caller job permissions to contents: read. Add contract assertions
verifying the checkout_ref value, absence of inherited secrets, and the caller
permissions.
In `@docs/repo/pr-governance-architecture.md`:
- Around line 17-21: The Mermaid Guardrails flow currently places PR metadata
validation before Autofill; reorder the sequence so Autofill precedes live PR
state validation and the branch/body validity decision. Apply the same
correction in docs/repo/pr-governance-architecture.md lines 17-21 and
docs/repo/pr-governance-architecture.pt-BR.md lines 17-21, keeping both
architecture diagrams consistent.
In `@docs/repo/pr-governance-architecture.pt-BR.md`:
- Line 44: Adicione uma vírgula após “Por isso” na frase sobre o GPA não usar o
body do evento original, preservando o restante do texto.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cce4cde6-568e-4ad4-9926-8e90e79bfa75
📒 Files selected for processing (7)
.github/workflows/pr-metadata.yml.github/workflows/pr-sync.ymldocs/repo/pr-governance-architecture.mddocs/repo/pr-governance-architecture.pt-BR.mdtests/test_pr_sync.pytests/test_pr_sync_autofill.pytests/test_qa_workflows.py
| permissions: | ||
| contents: read | ||
| issues: write | ||
| pull-requests: read | ||
| pull-requests: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify the reusable workflow's declared secret inputs and checkout use.
rg -n -C 4 'workflow_call:|secrets:|permissions:|checkout_ref|actions/checkout' \
.github/workflows/pr-metadata.yml \
.github/workflows/qa-live.yml \
tests/test_qa_workflows.pyRepository: v-Kaefer/Github-Project-Automation
Length of output: 7133
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- pr-metadata.yml ---'
cat -n .github/workflows/pr-metadata.yml
printf '%s\n' '--- qa-live.yml ---'
cat -n .github/workflows/qa-live.yml
printf '%s\n' '--- related workflow tests ---'
cat -n tests/test_qa_workflows.py
printf '%s\n' '--- secret and token usage in the relevant workflows ---'
rg -n -C 3 '\bsecrets\b|GITHUB_TOKEN|github\.token|token:|pull_request_target|validate-pr|checkout_ref' \
.github/workflows testsRepository: v-Kaefer/Github-Project-Automation
Length of output: 35037
🌐 Web query:
GitHub Actions reusable workflow permissions caller called workflow workflow-level permissions secrets inherit environment secrets official documentation
💡 Result:
In GitHub Actions, reusable workflows interact with permissions and secrets in specific, well-defined ways to ensure security and flexibility. Permissions Inheritance Reusable workflows do not have their own independent permissions for the GITHUB_TOKEN; instead, they operate based on the permissions granted by the calling workflow [1][2]. - If you do not specify explicit permissions in the calling job (using jobs.<job_id>.permissions), the called workflow uses the default GITHUB_TOKEN permissions [1][3]. - Permissions can only be maintained or downgraded (made more restrictive) by the called workflow; they cannot be elevated [1][2][3]. - In nested workflow chains (e.g., A calls B, which calls C), this rule applies throughout the entire chain [4][5]. - It is a security best practice to explicitly define permissions in the calling job to ensure the called workflow does not receive broader access than intended [6]. Secrets Inheritance To provide secrets to a reusable workflow, you can either pass them explicitly or use the inheritance keyword [4][7]. - secrets: inherit: By adding secrets: inherit to the job configuration in the calling workflow, all secrets available to the calling workflow are automatically passed to the called reusable workflow [4][8][7]. - Explicit Passing: Alternatively, you can use the secrets key to pass specific, named secrets to the reusable workflow [4][5]. - Reference: Once secrets are inherited or passed, they can be referenced within the reusable workflow as secrets.NAME [7][9]. - Chain Behavior: When using chained reusable workflows, secrets are only passed to the directly called workflow [4][5]. For example, in a chain A > B > C, workflow B must explicitly pass the secrets to C, even if A passed them to B [4][5]. Environment Secrets Environment secrets are associated with specific environments [9]. For a reusable workflow to access environment secrets, the job within the reusable workflow must explicitly declare the environment using the environment keyword [9]. The workflow job will then have access to the secrets defined for that environment [9]. Top_results: [1][4][8][7][9][6]
Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
- 2: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/reusing-workflow-configurations.md
- 3: https://docs.github.com/en/enterprise-cloud@latest/actions/reference/workflows-and-actions/reusing-workflow-configurations
- 4: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 5: https://github.com/github/docs/blob/main/content/actions/how-tos/reuse-automations/reuse-workflows.md
- 6: Calling workflow: Workflow does not contain permissions github/codeql#20504
- 7: https://latchkey.dev/learn/github-actions/github-actions-reusable-workflow-secret-not-inherited
- 8: https://github.blog/changelog/2022-05-03-github-actions-simplify-using-secrets-with-reusable-workflows/
- 9: https://stackoverflow.com/questions/71524542/how-to-use-reusable-github-workflows-and-keep-secrets-in-a-single-place
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
metadata = Path(".github/workflows/pr-metadata.yml").read_text(encoding="utf-8")
live = Path(".github/workflows/qa-live.yml").read_text(encoding="utf-8")
tests = Path("tests/test_qa_workflows.py").read_text(encoding="utf-8")
checks = {
"caller uses mutable QA branch ref": "checkout_ref: refs/heads/Q.A" in metadata,
"caller inherits all secrets": "secrets: inherit" in metadata,
"called workflow uses QA project secret": "secrets.QA_PROJECT_SETUP_PAT" in live,
"called workflow declares workflow_call secrets": bool(
re.search(r"workflow_call:.*?secrets:", live, re.S)
),
"called workflow restricts token to contents read": bool(
re.search(r"permissions:\s*\n\s+contents:\s+read", live)
),
"caller passes event head SHA": "github.event.pull_request.head.sha" in metadata,
"existing test checks only reusable input wiring": (
"ref: ${{ inputs.checkout_ref }}" in tests
and "github.event.pull_request.head.sha" not in tests
),
}
for name, value in checks.items():
print(f"{name}: {value}")
PYRepository: v-Kaefer/Github-Project-Automation
Length of output: 490
Check out the pull request commit and remove inherited secrets.
Pass ${{ github.event.pull_request.head.sha }} as checkout_ref so qa-live cannot run code from a later Q.A push. Remove secrets: inherit; qa-live reads QA_PROJECT_SETUP_PAT from its protected qa environment. Set permissions: contents: read on the qa-live caller job and add contract assertions for both changes.
🧰 Tools
🪛 zizmor (1.29.0)
[error] 14-14: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[error] 15-15: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-metadata.yml around lines 12 - 15, Update the qa-live
caller workflow to pass github.event.pull_request.head.sha as checkout_ref,
remove secrets: inherit, and restrict the caller job permissions to contents:
read. Add contract assertions verifying the checkout_ref value, absence of
inherited secrets, and the caller permissions.
Source: Linters/SAST tools
|
|
||
| Payloads de `pull_request_target` são snapshots. Se o Autofill altera o body de um PR e uma etapa de sincronização logo depois usa o payload original do evento, essa etapa pode consumir metadata antiga. | ||
|
|
||
| Por isso o GPA não usa o body do evento original como mecanismo de passagem de estado entre Autofill e PR Sync. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Adicione uma vírgula após Por isso.
Altere a frase para Por isso, o GPA não usa....
The supplied LanguageTool hint reports this punctuation issue.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~44-~44: Encontrada possível ausência de vírgula.
Context: ...apa pode consumir metadata antiga. Por isso o GPA não usa o body do evento original...
(AI_PT_HYDRA_LEO_MISSING_COMMA)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/repo/pr-governance-architecture.pt-BR.md` at line 44, Adicione uma
vírgula após “Por isso” na frase sobre o GPA não usar o body do evento original,
preservando o restante do texto.
Source: Linters/SAST tools
feat: add configurable Related PR promotion detection
fix: make QA deployment cleanup import reliably
fix: promote reliable QA cleanup to Q.A
1 participant
Linked Issue
Milestone
Summary
How to test
Evidence
Known risks
DoD checklist
Summary by CodeRabbit
New Features
Bug Fixes
Tests