fix(maintainer): authenticate fork Advisor runs - #8587
Conversation
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe gate validates association-less fork runs using head SHA, branch, and repository metadata. Tests cover matching metadata as advisory and mismatched or incomplete runs as merge-relevant. ChangesAdvisor authentication
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Independent correctness, documentation, and nine-category security review is complete for the current branch revision. Result: PASS with no actionable findings. The review covered input and trust-boundary validation, authentication and authorization, command execution, credential and data exposure, network behavior, filesystem behavior, race and concurrency handling, dependency and supply-chain impact, and fail-closed error handling. The association-less path is limited to cross-repository pull requests and still requires the run to match the current branch revision, branch name, source repository, trusted workflow and event, GitHub-hosted job URL, latest attempt, completed status, and successful conclusion. Negative tests keep mismatched revision, branch, repository, same-repository payloads, stale attempts, and untrusted evidence blocked. Documentation review concluded that no user-facing update is needed because this changes only internal maintainer evidence authentication. Verification passed: all 81 maintainer gate tests, CLI build, CLI type checking, commit and push hooks, and diff checks. |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 7a04b67 in the TypeScript / code-coverage/cliThe overall coverage in commit 7a04b67 in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/nemoclaw-maintainer-day/scripts/check-gates.ts:
- Around line 1906-1920: Require run.status === "COMPLETED" and run.conclusion
!== null in the authenticated result condition around currentPrBinding in
check-gates.ts. In test/skills/check-gates-actions-evidence.test.ts lines
171-227, add an association-less fork case with an in-progress run and null
conclusion, asserting that the CI gate fails.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ae39583d-b1a6-4041-b048-35db289a2203
📒 Files selected for processing (2)
.agents/skills/nemoclaw-maintainer-day/scripts/check-gates.tstest/skills/check-gates-actions-evidence.test.ts
PR Review Advisor — InformationalAdvisor assessment: Informational / low confidence Model lanes
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. 1 semantic terminology decisionTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite against this exact revision. Recommended E2E: None This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
Addressed the workflow-run terminal-state finding in the current branch revision. The association-less fork fallback now requires the workflow run itself to be completed with a non-null conclusion before its Advisor result can remain advisory. The ordinary PR-associated path is intentionally unchanged, so authenticated pending or failed Advisor runs retain the repository’s advisory semantics. Added independent negative cases for an in-progress run with a terminal job and a completed run without a conclusion. All 83 maintainer gate tests pass; commit/push hooks pass; the new commit is GitHub Verified. Independent review found no issues and passed all nine security categories. Documentation remains unchanged because this is internal evidence-authentication hardening. |
2 participants
Summary
The maintainer merge gate currently rejects a successful PR Review Advisor run for a fork pull request when GitHub Actions omits the run's pull-request association, even though the run otherwise identifies the current fork branch revision. This change accepts that narrow GitHub payload shape only after validating the current revision, branch, source repository, trusted workflow identity, event, job URL, latest attempt, status, and conclusion.
Changes
Type of Change
Quality Gates
Documentation Writer Review
no-docs-neededVerification
Signed-off-by:line and every commit appears asVerifiedin GitHubnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Additional verification: CLI build and type checking pass; whitespace and diff checks pass.
Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
Bug Fixes
Tests