Skip to content

Add CodeAnt Quality Gates #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
akshit-speed wants to merge 1 commit into from
Closed

Add CodeAnt Quality Gates #29

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/codeant-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: CodeAnt Test Workflow

on:
pull_request:
types: [opened, synchronize]
branches:
- development
- main
Comment on lines +3 to +8

@coderabbitai coderabbitai Bot Mar 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/codeant-test.yml

Repository: TrySpeed/magento-payment-plugin

Length of output: 550

🌐 Web query:

GitHub Actions pull_request event types reopened ready_for_review

💡 Result:

In GitHub Actions, the pull_request event supports many activity types, including reopened and ready_for_review (among others). [1]

  • Default behavior: If you don’t specify types:, the workflow runs only for opened, reopened, and synchronize. [2]
  • reopened: fires when a previously closed PR is reopened. [2]
  • ready_for_review: fires when a PR is marked Ready for review (i.e., converted from draft to non-draft). [1]

Example to include both:

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

Sources:
[1] GitHub Docs – pull_request activity types list (includes ready_for_review, reopened)
[2] GitHub Docs – default pull_request triggers when no types are specified (opened/reopened/synchronize)

Cover reopened and draft-to-ready PR transitions.

With only opened and synchronize, this gate will not run when a PR is reopened or marked ready for review. This bypasses the intended CodeAnt check for valid merge paths.

Suggested change 
 on:
   pull_request:
-    types: [opened, synchronize]
+    types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - development
       - main
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on:
pull_request:
types: [opened, synchronize]
branches:
- development
- main
on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
branches:
- development
- main
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/codeant-test.yml around lines 3 - 8, The pull_request
trigger currently lists only types: [opened, synchronize], which misses PR
reopen and draft-to-ready transitions; update the workflow's
on.pull_request.types to include 'reopened' and 'ready_for_review' (i.e. types:
[opened, synchronize, reopened, ready_for_review]) so CodeAnt runs when a PR is
reopened or moved from draft to ready_for_review.


permissions:
contents: read
id-token: write

jobs:
codeAnt:
uses: TrySpeed/reusable-workflow/.github/workflows/codeant-ci.yml@latest
secrets:
CODEANT_GITHUB_TOKEN: ${{ secrets.CODEANT_GITHUB_TOKEN }}
Comment on lines +14 to +18

@coderabbitai coderabbitai Bot Mar 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

find . -name "codeant-test.yml" -type f

Repository: TrySpeed/magento-payment-plugin

Length of output: 111

🏁 Script executed:

cat -n .github/workflows/codeant-test.yml

Repository: TrySpeed/magento-payment-plugin

Length of output: 550

🌐 Web query:

GitHub Actions reusable workflows best practices pinning commit SHA @latest``

💡 Result:

Best practices: reusable workflows + “@latest” vs pinning

1) Don’t use floating refs like @latest, @main, or @v1 for anything you don’t fully control

Floating refs can move without you changing your repo, which creates both supply-chain risk and “surprise” behavior changes. GitHub recommends pinning dependencies to an immutable commit SHA. [2], [3]

2) For reusable workflows, prefer a full commit SHA in the caller

Reusable workflows are referenced like:

jobs:
  ci:
    uses: org/workflows-repo/.github/workflows/ci.yml@<ref>

GitHub explicitly notes that using a commit SHA ensures everyone reusing the workflow runs the exact same YAML. [1]

3) For actions (and third-party reusable workflows), pin to a full-length commit SHA

GitHub’s secure-use guidance calls full-length SHA pinning “the only way to use an action as an immutable release,” and recommends verifying the SHA comes from the intended upstream repo (not a fork). [2]

Example:

- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

Adding a version comment helps humans track what the SHA corresponds to. [4]

4) Enforce it with policy where possible

GitHub introduced/enhanced org/enterprise policies that can require SHA pinning (and fail runs that aren’t pinned). [3]

Pin the reusable workflow to an immutable commit SHA.

@latest lets upstream changes alter this workflow without review, and this job forwards CODEANT_GITHUB_TOKEN into that code. GitHub recommends pinning reusable workflows to a full commit SHA to prevent supply-chain risk and ensure runs remain reproducible.

Suggested change 
 jobs:
   codeAnt:
-    uses: TrySpeed/reusable-workflow/.github/workflows/codeant-ci.yml@latest
+    uses: TrySpeed/reusable-workflow/.github/workflows/codeant-ci.yml@<full-commit-sha>
     secrets:
       CODEANT_GITHUB_TOKEN: ${{ secrets.CODEANT_GITHUB_TOKEN }}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/codeant-test.yml around lines 14 - 18, The reusable
workflow reference uses a floating tag (`@latest`) which is unsafe; update the
uses entry for the codeAnt job (the string
TrySpeed/reusable-workflow/.github/workflows/codeant-ci.yml@latest) to pin it to
a specific immutable commit SHA (replace `@latest` with @<full-commit-sha>) so the
job always runs a reviewed, reproducible version of the reusable workflow.