[WRONG BRANCH] Require trusted GitHub Actions ci check before marking contributor PRs ready - #270
[WRONG BRANCH] Require trusted GitHub Actions ci check before marking contributor PRs ready#270luvs01 wants to merge 1 commit into
ci check before marking contributor PRs ready#270Conversation
|
Warning Review limit reached
Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
Comment |
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
changed the title
ci check before marking contributor PRs readyci check before marking contributor PRs ready
⏳ DRAFT
What to do
Its title has been prefixed with |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 700ab5660c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // any installed app can publish a check called `ci`. | ||
| const githubActionsAppId = 15368; | ||
| const { data: checksData } = | ||
| await github.rest.checks.listForRef({ |
There was a problem hiding this comment.
The enforce-target job declares only contents: write and pull-requests: write at lines 143–146; because job-level permissions set every omitted scope to none, this new checks.listForRef request lacks the required checks: read permission. On every completed contributor checklist the request therefore fails, ciGreen remains false, and the fail-closed path permanently unticks the CI box instead of ever marking the PR ready. Add checks: read to this job's permissions.
AGENTS.md reference: AGENTS.md:L218-L224
Useful? React with 👍 / 👎.
| const ciChecks = checkRuns.filter( | ||
| check => | ||
| check.name === "ci" && | ||
| check.app?.id === githubActionsAppId |
There was a problem hiding this comment.
For a contributor PR that changes .github/workflows/ci.yml, filtering by the GitHub Actions App ID proves only which app published the check, not that trusted CI logic ran. This repository explicitly records at .github/workflows/ci.yml:61-67 that the pull_request workflow is loaded from the PR head, so an author can replace the aggregate ci job with a trivial success and satisfy this test without running the real gates. Reject readiness when the CI workflow differs from the trusted base, or consume evidence produced from a workflow definition outside contributor control.
AGENTS.md reference: AGENTS.md:L218-L224
Useful? React with 👍 / 👎.
1 participant
Motivation
ciaggregate so a contributor cannot self-attest CI and have the gate mark a PR ready when the trustedcicheck is missing, pending, failing, truncated, or produced by an untrusted app.Description
checks.listForRefevidence path andciGreenhandling so the readiness gate only treats the local-CI box as verified when the trusted GitHub Actions App (id 15368) reports a completedcicheck with conclusionsuccess, and treat missing/pending/foreign/truncated evidence as a fail-closed condition.ci_greeninto the claim/indexing paths and updated message builders so the gate unticks the CI checklist box and resets/drafts the PR when CI fails or is unverifiable..github/workflows/enforce-pr-target.yml,.github/scripts/pr-quality-state.cjs,.github/scripts/pr-quality.cjs,.github/scripts/pr-quality-messages.cjsplus tests undertests/and docs indocs-site/,AGENTS.md, andMAINTAINERS.md.Testing
node --test .github/scripts/pr-quality*.test.cjsand the updated script tests passed.bun run typecheckand the typecheck completed without error.tests/ci-workflows.test.ts), which validated the new CI-evidence branches; the harness and updated unit tests passed for the changed readiness paths.bun run prepush/ GUI build), but unrelated CI environment issues (GUI integration npm registry fetches returning HTTP 403 and a few long-suite timeouts) prevented a complete green run of the entire repository test matrix in this environment.Codex Task