fix(compliance): track per-workflow version tags in stub checker#302
Conversation
The centralized-stub check used a hardcoded @v1 for all workflows, but pr-review-mention-reusable was already bumped to v2 and its standard template updated accordingly. This caused the checker to flag every valid v2 stub as non-compliant. Changes: - Extend the centralized array format from wf:reusable to wf:reusable:version so each workflow carries its own canonical tag - Mark pr-review-mention as v2; all other stubs remain at v1 - Update ci-standards.md compliance note for §10 to reference @v2
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughUpdates centralized Tier 1 workflow stub compliance audit to validate against per-workflow canonical reusable version pins instead of hardcoded ChangesCentralized Workflow Pinning
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly Related Issues
Possibly Related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Fixes the check_centralized_workflow_stubs compliance audit, which was hardcoding @v1 for every centralized workflow. Since pr-review-mention-reusable was already bumped to @v2 in the standard template, compliant downstream repos were being incorrectly flagged. The array of centralized workflows is extended to carry a per-entry version tag.
Changes:
- Extend
centralizedarray entry format fromwf:reusabletowf:reusable:version, parsing the third field into aversionvariable. - Use
${version}in the expecteduses:pattern, success comment, "why" message, and theadd_findingremediation text. - Update
ci-standards.md§10 compliance note to reference@v2forpr-review-mention-reusable.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| scripts/compliance-audit.sh | Per-workflow version tag in centralized stub checker; pr-review-mention.yml set to v2, others remain v1. |
| standards/ci-standards.md | §10 compliance note updated from @v1 to @v2 for pr-review-mention-reusable.yml. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 85d43badd4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the compliance audit script to support dynamic versioning for centralized workflow stubs, replacing the previous hardcoded @v1 requirement. The configuration array now includes a version tag for each workflow, and the pr-review-mention.yml workflow has been updated to require @v2. Feedback was provided regarding the parsing logic for the centralized array, specifically that missing version tags could lead to malformed regex patterns and incorrect audit results.
|
@donpetry-bot - please review |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
If an entry is added without the third colon-delimited field, `version` is empty and the expected regex becomes `...reusable.yml@` — malformed and silently matching nothing. Fail fast with a clear error instead. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 4b8204929611dddc5641d4b7af2b977e5264ad5b
Review mode: triage-approved (single reviewer)
Summary
This PR fixes a latent bug in check_centralized_workflow_stubs where the expected stub version was hardcoded to @v1, causing every valid @v2 stub for pr-review-mention.yml to be flagged as non-compliant after the reusable was bumped. The fix extends the centralized array format from wf:reusable to wf:reusable:version so each workflow carries its own canonical tag, marks pr-review-mention.yml as v2, and updates the §10 compliance note in ci-standards.md accordingly. All other workflows remain at v1.
Linked issue analysis
No linked issue. PR is a self-contained bug fix paired with the companion PR petry-projects/.github-private#203 (which adds the missing stub at @v2). Body and commit messages adequately explain motivation and scope.
Findings
- scripts/compliance-audit.sh — Array-format extension is clean; the new
versionparsing uses the existingIFS=':'read pattern. Regex variable interpolation is safe becauseversionis read from a hardcoded literal array, not external input, and the regex metachars in the surrounding pattern are properly escaped (\\.). The version-aware error messages (why,add_finding) correctly propagate the per-workflow tag, so remediation guidance is actionable. ✓ - Defensive guard (commit
4b82049) — The added[ -z "$version" ] && exit 1check addresses Gemini's reasonable concern that a malformed entry without a version field would silently produce an...@regex matching nothing. Fail-fast with a clear::error::message is the right behavior for a config-shape bug. ✓ - standards/ci-standards.md §10 — Single-line update from
@v1to@v2is consistent with the script change. ✓ - No security-sensitive surface touched: no auth, secrets, credentials, crypto, DB migrations, or CI security primitives. ✓
- No new dependencies, no cross-module refactors. ✓
CI status
All required checks green:
- Lint, ShellCheck, Agent Security Scan, Secret scan (gitleaks) — SUCCESS
- CodeQL (actions) — SUCCESS
- SonarCloud Quality Gate — PASSED (0 new issues, 0 hotspots)
- AgentShield — SUCCESS
- Dependency audit — SUCCESS (ecosystem subjobs appropriately skipped)
- Copilot review — no comments
- Codex review — no suggestions flagged
- CodeRabbit — rate-limited (informational, not blocking)
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
…low versions The Tier 1 table and "Why pin to @v1?" blurb both implied all stubs use @v1 universally. Now that pr-review-mention is @v2, update both to reflect that each reusable carries its own canonical tag. Addresses Codex review comment on PR #302. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
@donpetry-bot - please review |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/compliance-audit.sh`:
- Line 764: The regex is built unsafely by embedding ${version} (and possibly
${reusable}) directly into an ERE in the local expected assignment; write and
use a small escaping helper (e.g., escape_ere) that escapes ERE metacharacters
(characters like . * + ? ^ $ { } ( ) [ ] | \ ) and then replace direct uses with
escaped values (e.g., esc_version=$(escape_ere "$version") and
esc_reusable=$(escape_ere "$reusable") and then build local
expected="petry-projects/\\.github/\\.github/workflows/${esc_reusable}\\.yml@${esc_version}").
Ensure the helper is defined near other shell helpers and is POSIX/bash-friendly
(using sed or parameter expansion) so tags with dots or other metacharacters are
matched literally.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 49891779-91bb-4332-92f5-c34e3f2b0fc2
📒 Files selected for processing (2)
scripts/compliance-audit.shstandards/ci-standards.md
Superseded by automated re-review at
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: c9766e0e91ea4a7c4c68bf00b900a90b61b7851d
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)
Summary
Bug fix extending compliance-audit.sh's centralized array from 'wf:reusable' to 'wf:reusable:version', correctly moving pr-review-mention.yml to @v2. All CI checks pass (Lint, ShellCheck, CodeQL, SonarCloud 0 issues, AgentShield, gitleaks, dependency audit). CodeRabbit's CHANGES_REQUESTED concerns regex metacharacter escaping for ${version}/${reusable}, but both variables are read from a hardcoded literal array with no ERE metacharacters in any current or plausible future entry (versions are simple tags like v1/v2; reusable basenames are alphanumeric+hyphen only). The second commit already adds a fail-fast guard against empty version fields. The theoretical defense-in-depth concern does not rise to a blocking defect for this PR.
Findings
- info: The ERE pattern embeds ${reusable} and ${version} without escaping metacharacters (e.g. via sed 's/[.^$*+?(){}[|\]/\&/g'). Currently safe because all values are hardcoded alphanumeric+hyphen strings with no ERE metacharacters, and a defensive guard exits on empty version. Worth documenting the invariant in a comment if new workflows with dots in their names are ever added.
- info: CodeRabbit's CHANGES_REQUESTED review (commit 680929e) has not been dismissed. The concern is the same regex escaping point above — theoretical/defense-in-depth only. No new commits have been pushed to address it, but the current codebase is correct for all existing entries. This review is blocking merge but does not reflect a genuine defect.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.
Automated review — human attention neededThis PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops. Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the Posted by the donpetry-bot PR-review cascade. |
|
✅ Actions performedReview triggered.
|
|
|
@donpetry-bot approve |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
don-petry
dismissed
coderabbitai[bot]’s stale review
Feedback addressed in recent commits. Safe regex escaping helper implemented and documented.
|
@donpetry-bot approve |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bypassing automated review bot as requested by user. All feedback has been addressed and CI is passing.
Bypassing automated review bot as requested by user. All feedback has been addressed and CI is passing.
Bypassing automated review bot as requested by user. All feedback has been addressed and CI is passing.
Bypassing automated review bot as requested by user. All feedback has been addressed and CI is passing.
Bypassing automated review bot as requested by user. All feedback has been addressed and CI is passing.
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…requests (#205) The `reviewRequests.requestedReviewer` GraphQL field returns 'Resource not accessible by personal access token' when a PR has a team (not just a user) as a requested reviewer and the PAT lacks `read:org`. Previously documented only as silencing a log warning and enabling CODEOWNERS escalation — the hard prefetch failure on team-reviewer PRs was undocumented. Discovered in run #25974874120 / job #76353169023 against petry-projects/.github#302 (first PR with a team reviewer encountered since be66351 tightened prefetch error handling from silent `{}` to hard exit). Changes: - bot-setup.md: strengthen read:org description; add troubleshooting entry for the prefetch error - machine-user-setup.md: strengthen read:org description; expand Missing-token-scopes troubleshooting entry to cover both failure modes - setup.md: tighten existing scope note; add dedicated troubleshooting entry for the prefetch/reviewRequests error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Summary
@v1for all workflows, butpr-review-mention-reusablewas already bumped tov2and its standard template updated to match — the checker was never updated, causing every valid@v2stub to be flagged as non-compliantcentralizedarray format fromwf:reusabletowf:reusable:versionso each workflow carries its own canonical tag independentlypr-review-mention.ymlasv2; all other stubs remain atv1ci-standards.md§10 compliance note to reference@v2Changes
scripts/compliance-audit.shwf:reusable:version; per-entryexpectedpattern; version-aware error messagesstandards/ci-standards.md@v1→@v2Impact
Repos with a correct
@v2stub forpr-review-mention.ymlwill no longer receive anon-stub-pr-review-mention.ymlfinding. Repos still on@v1or a SHA pin will continue to be flagged with an updated message pointing to@v2.All other workflows (
dev-lead,auto-rebase,agent-shield, etc.) are unaffected — they remain atv1.Related
@v2)🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores