chore(ci): re-pin phenoShared reusable workflow#67
Conversation
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummaryThis PR transitions the CI workflow from a local stub implementation to a reusable workflow call from the centralized Changes
Notes
RecommendationApprove with acknowledgment of behavioral impact. The PR achieves its stated objective of adopting the shared phenoShared reusable CI workflow. The stub removal is appropriate given phenoShared now exposes the workflow. The pinning strategy (main SHA → semver tag migration) is sound and documented. Action items for maintainer (post-merge):
WalkthroughThe CI workflow was simplified by replacing local stub jobs with a direct invocation of the ChangesCI Workflow Reusable Invocation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Autofix Details
Bugbot Autofix prepared fixes for both issues found in the latest run.
- ✅ Fixed: Invalid SHA for codeql-action/upload-sarif will break workflow
- Replaced the invalid SHA with @v4.36.0 tag matching other workflows in the repository
- ✅ Fixed: Trufflehog action inputs silently ignored, scan misconfigured
- Moved --only-verified flag to extra_args input and removed invalid base_depth and only_verified inputs
Or push these changes by commenting:
@cursor push 4ac90a167b
Preview (4ac90a167b)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -39,6 +39,6 @@
path: results.sarif
retention-days: 5
- - uses: github/codeql-action/upload-sarif@2f0f4c8f3d9c8f6b8ed1b1f5f1c4a7a2d0b0d1b7
+ - uses: github/codeql-action/upload-sarif@v4.36.0
with:
sarif_file: results.sarif
diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
--- a/.github/workflows/trufflehog.yml
+++ b/.github/workflows/trufflehog.yml
@@ -19,5 +19,4 @@
- uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3.95.2
with:
path: ./
- base_depth: 1
- only_verified: true
+ extra_args: "--only-verified"You can send follow-ups to the cloud agent here.
|
CodeAnt AI is running Incremental review Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:XS
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Unresolved merge conflict marker in scorecard workflow
- Removed the accidental merge conflict marker '<<<<<<< HEAD' from line 30 of scorecard.yml, making the YAML valid again.
Or push these changes by commenting:
@cursor push 201fbf4b96
Preview (201fbf4b96)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -27,7 +27,6 @@
with:
persist-credentials: false
-<<<<<<< HEAD
- uses: ossf/scorecard-action@f2ea147fec3c2f0d459703eba7405b5e9bcd8c8f # v2.4.2
with:
results_file: results.sarifYou can send follow-ups to the cloud agent here.
|
CodeAnt AI Incremental review completed. |
KooshaPari
force-pushed
the
chore/workflow-hygiene-ubuntu-24
branch
from
7d310f7 to
b83758b
Compare
|
CodeAnt AI is running Incremental review Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:XS
|
CodeAnt AI Incremental review completed. |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.
Reviewed by Cursor Bugbot for commit b83758b. Configure here.
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - run: echo "CI stub — phenoShared reusable workflow blocked by missing phenotypeActions repo" | ||
| uses: KooshaPari/phenoShared/.github/workflows/reusable/ci.yml@5ed0e3bb2279610656755d3adb5403fba94a2bd2 |
There was a problem hiding this comment.
Missing permissions restriction for external reusable workflow call
Low Severity
The workflow calls a cross-repository reusable workflow (KooshaPari/phenoShared) without declaring permissions: contents: read at the top level. Every other reusable-workflow caller in this repository (trufflehog.yml, cargo-deny.yml) explicitly restricts token permissions to least-privilege. Without this declaration, the external workflow receives a token with broader default permissions than necessary.
Reviewed by Cursor Bugbot for commit b83758b. Configure here.
User description
Summary
KooshaPari/phenoShared/.github/workflows/reusable/ci.ymlReference update
5ed0e3bb2279610656755d3adb5403fba94a2bd2(main)workflow-present+rust-ciecho)uses: KooshaPari/phenoShared/.github/workflows/reusable/ci.ymlNo semver tag exists yet for the reusable workflow; pinned to main SHA
5ed0e3b. Will re-pin to tag per phenoShared release policy.🤖 Generated with Claude Code
Note
Low Risk
Workflow-only change with no application code; risk is limited to CI behavior and dependency on an external pinned workflow SHA.
Overview
Replaces the local CI stub with the shared phenoShared reusable workflow, so push/PR runs on
mainactually execute Rust CI instead of placeholder echo jobs.The
rust-cijob nowuses: KooshaPari/phenoShared/.github/workflows/reusable/ci.ymlpinned to main SHA5ed0e3bb2279610656755d3adb5403fba94a2bd2. Comments were updated to note PR #85 is merged and that a semver tag should be used once phenoShared cuts one. Theworkflow-presentjob and the stubrust-cisteps (including the “blocked by missing phenotypeActions” message) were removed.Reviewed by Cursor Bugbot for commit b83758b. Bugbot is set up for automated code reviews on this repo. Configure here.
CodeAnt-AI Description
Run the shared Rust CI workflow in this repository
What Changed
Impact
✅ Real CI checks on pull requests✅ Fewer false-green builds✅ Clearer validation before merge💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.