ci: add aireceipts pr-check (notice-only cost receipt)#105
ci: add aireceipts pr-check (notice-only cost receipt)#105anandgupta42 wants to merge 4 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80d6849f7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - run: npx -y aireceipts-cli@latest pr-check |
There was a problem hiding this comment.
Because this is a plain run step, any non-zero exit from npx or aireceipts-cli marks the new aireceipts job as failed. In cases like an npm registry/install failure, a CLI regression, or a GitHub API permission error on a PR, this turns the intended notice-only receipt into a red PR check; add continue-on-error: true or otherwise swallow failures if this workflow must never block builds.
Useful? React with 👍 / 👎.
| - run: npx -y aireceipts-cli@latest pr-check | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} |
There was a problem hiding this comment.
This step gives GH_TOKEN with pull-requests: write to the entire npx ...@latest process, so on same-repository PRs any newly published aireceipts-cli version or npm install/lifecycle code gets a writable PR token before this repo has reviewed that code. Pin the CLI to a vetted version and avoid exposing the token during package installation (or otherwise use a trusted, pinned action) so a bad npm release cannot immediately mutate PRs across the repo.
Useful? React with 👍 / 👎.
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - run: npx -y aireceipts-cli@latest pr-check |
There was a problem hiding this comment.
WARNING: Missing continue-on-error: true — a tool failure fails this check
The PR describes this as a "notice-only" check that "never fails a build," but this run step has no continue-on-error: true. If npx aireceipts-cli@latest pr-check exits non-zero (npm/network errors, a broken @latest release, or any CLI exception), the check job fails and appears as a red check on the PR — potentially blocking merges under branch protection. Add continue-on-error: true to this step to honor the notice-only intent.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (1 file)
Fix these issues in Kilo Cloud Previous Review Summaries (3 snapshots, latest commit ed1328e)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit ed1328e)Status: 2 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (1 file)
Fix these issues in Kilo Cloud Previous review (commit f13c3a2)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (1 file)
Fix these issues in Kilo Cloud Previous review (commit 80d6849)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (1 file)
Reviewed by glm-5.2 · Input: 33.3K · Output: 19.1K · Cached: 308.8K |
| check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - run: npx -y aireceipts-cli@0.5.0 pr-check |
There was a problem hiding this comment.
WARNING: Missing continue-on-error: true — a tool failure fails this check job
The PR describes this as a "notice-only" check that "never fails a build," but this run step still has no continue-on-error: true. If npx aireceipts-cli@0.5.0 pr-check exits non-zero (npm/network errors, a broken CLI release, or any unhandled exception), the check job fails and renders as a red check on the PR — which can block merges under branch protection. Add continue-on-error: true to this step to honor the notice-only intent.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
|
Hi @suryaiyer95 @kulvirgit — could one of you give this a quick review + approve when you get a moment? 🙏 It's a notice-only aireceipts cost-receipt check (a single |
| check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - run: npx -y aireceipts-cli@latest pr-check |
There was a problem hiding this comment.
WARNING: @latest reintroduces an unpinned supply-chain risk with a write token
This commit reverts the @0.5.0 pin (added explicitly for "supply-chain: no mutable @latest with write token") back to @latest. Since the step exposes GH_TOKEN with pull-requests: write, every run resolves and executes whatever aireceipts-cli version is @latest at run time — so a compromised or broken newly published release runs with PR-write capability before this repo has reviewed it. If the floating version is intentional, consider isolating the install step from the write token (or otherwise limiting the token's blast radius) to reduce the risk.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
|
Hi @suryaiyer95 👋 — friendly nudge as the top contributor here. This is a lightweight aireceipts dogfood PR (part of an org-wide rollout). It adds a notice-only CI is green. Could you give it a quick review + merge when you have a moment? (It needs one approving review from someone with write access — admin bypass is off here.) Happy to answer any questions. Thanks! 🙏 |
|
Thanks for the automated review — addressed:
Intentional, left as-is:
|
1 participant
Adds a notice-only aireceipts cost-receipt check (pr-check) — one self-contained workflow, no external reusable workflow, no org Actions-policy change. Never fails a build; posts an aireceipts cost receipt only once a branch carries an aireceipts receipt ref, otherwise a quiet no-op. Coexists with any existing check; remove anytime by deleting the file. Part of an org-wide aireceipts dogfood.
Note
Low Risk
Single new CI workflow with read contents and PR write only; failures are ignored and there is no application or auth logic change.
Overview
Adds a new GitHub Actions workflow
.github/workflows/aireceipts.ymlthat runs on every pull request and invokesaireceipts-cli pr-checkvianpxto post an optional AI cost receipt on the PR.The job is notice-only:
continue-on-error: trueso the check never fails the build. It usespull-requests: writeandGH_TOKENfor PR comments, with concurrency keyed by ref so overlapping runs cancel. No checkout step—behavior depends on the CLI and branch receipt refs as described in the PR.Reviewed by Cursor Bugbot for commit b427963. Bugbot is set up for automated code reviews on this repo. Configure here.