ci: request exact-head AI reviews on PR updates - #339
Conversation
|
Warning Review limit reached
Next review available in: 5 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Exact-head review request for 50952f8 (2026-08-23 16:59Z): @codex review @coderabbitai review Please review the workflow security boundary in particular: pull_request_target, no checkout or contributor-code execution, least-privilege issue-comment permission, draft skip, and exact-head concurrency/comment stamp. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Changed files:"
git diff --name-status HEAD^ HEAD
echo
echo "Workflow candidates:"
fd -t f -e yml -e yaml .github 2>/dev/null || true
echo
echo "Workflow outlines:"
while IFS= read -r f; do
ast-grep outline "$f" --items all || true
done < <(fd -t f -e yml -e yaml .github 2>/dev/null)Length of output: 786 🏁 Script executed: #!/bin/bash
set -euo pipefail
workflow=".github/workflows/request-ai-reviews.yml"
echo "Workflow outline:"
ast-grep outline "$workflow" --items all || true
echo
echo "Workflow content:"
cat -n "$workflow"
echo
echo "Added diff:"
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- "$workflow"
echo
echo "Execution-related keys in workflow:"
rg -n -i -C2 '(^|[[:space:]])(uses|run|checkout|container|services|defaults|working-directory|shell):' "$workflow" || trueLength of output: 3922
|
|
Exact-head review request for b64a338 (2026-08-23 17:02Z): @codex review @coderabbitai review This head removes the unnecessary contents permission. Please review the exact 36-line workflow security boundary; earlier review and CI state is stale. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="b64a338b0b08093ef02fba01585bfbb3e9fb5400"
actual_head="$(git rev-parse HEAD)"
printf 'Expected head: %s\nActual head: %s\n' "$expected_head" "$actual_head"
if [ "$actual_head" != "$expected_head" ]; then
echo "ERROR: sandbox is not at the requested PR head" >&2
exit 2
fi
workflow="$(fd -t f -e yml -e yaml .github/workflows | while IFS= read -r file; do
if rg -q 'coderabbitai review|`@codex` review|pull_request_target' "$file"; then
printf '%s\n' "$file"
fi
done | head -n 1)"
if [ -z "$workflow" ]; then
echo "ERROR: review-request workflow was not found" >&2
exit 3
fi
printf '\nWorkflow: %s\n\n' "$workflow"
ast-grep outline "$workflow" --items all || true
printf '\nWorkflow content:\n'
cat -n "$workflow"
printf '\nDiff from first parent:\n'
git diff --check HEAD^ HEAD
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- "$workflow"
printf '\nExecution and permission-related keys:\n'
rg -n -i -C2 '(^|[[:space:]])(permissions|uses|run|checkout|container|services|defaults|working-directory|shell):' "$workflow" || true
printf '\nRequired security-boundary fields:\n'
rg -n -C2 'pull_request_target|draft|concurrency|head\.sha|head\.ref|issues:[[:space:]]*write|gh[[:space:]]+api|comments' "$workflow" || true
printf '\nYAML parse check:\n'
python3 - "$workflow" <<'PY'
import sys
from pathlib import Path
try:
import yaml
except ImportError:
print("PyYAML is unavailable; parser check could not run.")
raise SystemExit(0)
with Path(sys.argv[1]).open() as f:
yaml.safe_load(f)
print("YAML parsed successfully.")
PYLength of output: 2400 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="b64a338b0b08093ef02fba01585bfbb3e9fb5400"
test "$(git rev-parse HEAD)" = "$expected_head"
mapfile -t workflows < <(
fd -t f -e yml -e yaml . .github/workflows 2>/dev/null |
while IFS= read -r file; do
if rg -q 'coderabbitai review|`@codex` review|pull_request_target' "$file"; then
printf '%s\n' "$file"
fi
done
)
printf 'Matching workflow files:\n'
printf '%s\n' "${workflows[@]}"
if [ "${`#workflows`[@]}" -ne 1 ]; then
echo "ERROR: expected exactly one matching workflow" >&2
exit 3
fi
workflow="${workflows[0]}"
printf '\nWorkflow outline:\n'
ast-grep outline "$workflow" --items all || true
printf '\nWorkflow content:\n'
cat -n "$workflow"
printf '\nDiff and whitespace validation:\n'
git diff --check HEAD^ HEAD
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- "$workflow"
printf '\nExecution- and permission-related keys:\n'
rg -n -i -C2 '(^|[[:space:]])(permissions|uses|run|checkout|container|services|defaults|working-directory|shell):' "$workflow" || true
printf '\nSecurity-boundary fields:\n'
rg -n -C2 'pull_request_target|draft|concurrency|head\.sha|issues:[[:space:]]*write|gh[[:space:]]+api|comments' "$workflow" || true
printf '\nYAML parse check:\n'
python3 - "$workflow" <<'PY'
import sys
from pathlib import Path
try:
import yaml
except ImportError:
print("PyYAML is unavailable; parser check could not run.")
raise SystemExit(0)
with Path(sys.argv[1]).open(encoding="utf-8") as file:
yaml.safe_load(file)
print("YAML parsed successfully.")
PYLength of output: 1919 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="b64a338b0b08093ef02fba01585bfbb3e9fb5400"
actual_head="$(git rev-parse HEAD)"
if [ "$actual_head" != "$expected_head" ]; then
echo "ERROR: expected $expected_head but found $actual_head" >&2
exit 2
fi
workflow="$(
fd -t f -e yml -e yaml . .github/workflows 2>/dev/null |
while IFS= read -r file; do
if rg -q 'coderabbitai review|`@codex` review|pull_request_target' "$file"; then
printf '%s\n' "$file"
fi
done
)"
count="$(printf '%s\n' "$workflow" | sed '/^$/d' | wc -l | tr -d ' ')"
printf 'Matching workflow files:\n%s\n' "$workflow"
if [ "$count" != "1" ]; then
echo "ERROR: expected exactly one matching workflow; found $count" >&2
exit 3
fi
printf '\nWorkflow content:\n'
cat -n "$workflow"
printf '\nDiff and whitespace validation:\n'
git diff --check HEAD^ HEAD
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- "$workflow"
printf '\nExecution- and permission-related keys:\n'
rg -n -i -C2 '(^|[[:space:]])(permissions|uses|run|checkout|container|services|defaults|working-directory|shell):' "$workflow" || true
printf '\nSecurity-boundary fields:\n'
rg -n -C2 'pull_request_target|draft|concurrency|head\.sha|issues:[[:space:]]*write|gh[[:space:]]+api|comments' "$workflow" || true
printf '\nYAML parse check:\n'
python3 - "$workflow" <<'PY'
import sys
from pathlib import Path
try:
import yaml
except ImportError:
print("PyYAML is unavailable; parser check could not run.")
raise SystemExit(0)
with Path(sys.argv[1]).open(encoding="utf-8") as file:
yaml.safe_load(file)
print("YAML parsed successfully.")
PYLength of output: 6488
|
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Pre-merge gate at exact head |
|
Post-merge live validation correction (2026-08-23): this workflow's supported scope is CodeRabbit only, not both AI reviewers. Run 32655006792 proved the combined-permission workflow can post as PR #340 both fixes the live 403 (the repository empirically requires |
|
To use Codex here, create an environment for this repo. |
1 participant
Summary
pull_request_targetworkflow for opened, reopened, ready, and synchronized PR heads@coderabbitai reviewand@codex review, stamped with the exact head SHAissues: writefor posting the review-request commentThis is the gap-closing workflow-only split assessed on #207. It intentionally leaves #207 open for its separate durable publisher-identity, retry, recovery, and shutdown work.
Validation
git diff --checkpasses