fix(ci): make CodeRabbit review requester operational - #340
Conversation
|
Exact-head review request for 4f4b0c2 (2026-08-23 17:11Z): @codex review @coderabbitai review One-line permission hotfix after live run 32653877712 proved issues:write alone receives HTTP 403 on the PR comment endpoint. Please verify the least-privilege boundary remains comment-only. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe workflow job now has ChangesWorkflow Permissions
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This narrowly grants the workflow permission needed to post pull request comments without changing its execution scope; no actionable merge-blocking risk remains beyond normal checks and review. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f4b0c21da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Temporary GITHUB_TOKEN permission diagnostic for 2893e9a. |
|
Exact-head review request for @coderabbitai review @codex review Empirical permission proof for the sole final-diff line:
The current PR-target run still executes the workflow from base |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
commit='22110176624c0a20e54dcb5149fb26c693412b35'
git cat-file -e "${commit}^{commit}"
printf '%s\n' '--- exact commit metadata ---'
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$commit"
printf '%s\n' '--- diff: origin/main...exact commit ---'
git diff --check "origin/main...$commit"
git diff --find-renames --find-copies --unified=80 "origin/main...$commit" -- .github/workflows/request-ai-reviews.yml
printf '%s\n' '--- changed-file list ---'
git diff --name-status "origin/main...$commit"
printf '%s\n' '--- workflow contents at exact commit ---'
git show "${commit}:.github/workflows/request-ai-reviews.yml" | cat -n
printf '%s\n' '--- security-relevant workflow constructs at exact commit ---'
git show "${commit}:.github/workflows/request-ai-reviews.yml" \
| rg -n -i -C2 '^\s*permissions:|^\s*(issues|pull-requests|contents|actions|checks|deployments|id-token|packages|security-events|statuses):|checkout|pull_request_target|pull_request|workflow_run|actions/github-script|run:|uses:|github\.token|secrets\.|pulls/|issues/.*/comments' \
|| trueLength of output: 1670 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='AgentWorkforce/factory'
pr='340'
printf '%s\n' '--- pull request metadata ---'
gh api "repos/$repo/pulls/$pr" \
--jq '{number, state, head: {ref: .head.ref, sha: .head.sha, repo: .head.repo.full_name}, base: {ref: .base.ref, sha: .base.sha, repo: .base.repo.full_name}}'
printf '%s\n' '--- pull request changed files and patches ---'
gh api --paginate "repos/$repo/pulls/$pr/files?per_page=100" \
--jq '.[] | {filename, status, additions, deletions, patch}'
printf '%s\n' '--- local checkout identity and available refs ---'
git status --short --branch
git rev-parse HEAD
git remote -v
git branch -a --contains HEAD || true
git show-ref | rg -n 'pull/340|main|HEAD' || true
workflow=$(fd -a '^request-ai-reviews\.yml$' .github 2>/dev/null | head -n 1 || true)
if [ -n "$workflow" ]; then
printf '%s\n' '--- local workflow contents ---'
cat -n "$workflow"
printf '%s\n' '--- security-relevant workflow constructs ---'
rg -n -i -C2 '^\s*permissions:|^\s*(issues|pull-requests|contents|actions|checks|deployments|id-token|packages|security-events|statuses):|checkout|pull_request_target|pull_request|workflow_run|actions/github-script|run:|uses:|github\.token|secrets\.|pulls/|issues/.*/comments' "$workflow" || true
fiLength of output: 5197
No findings. The final diff changes only The workflow keeps top-level The workflow does not check out repository content. It does not execute contributor code. Its only API operation is
|
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@coderabbitai review @codex review Requested for exact head |
|
To use Codex here, create a Codex account and connect to github. |
|
|
khaliqgant
changed the title
|
Exact-head review request for @coderabbitai review @codex review The live bot-identity probe changed the contract: CodeRabbit accepts the Actions-authored request, while Codex rejects that actor. This head removes the unsupported/noisy Codex mention and accurately names/scopes the workflow while retaining the empirically required permission pair. Please review this exact head; all earlier review state is stale. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='AgentWorkforce/factory'
pr='340'
commit='d0c63d0b06ac1a7c73c0bc5854a4897ea5807896'
printf '%s\n' '--- exact commit ---'
git cat-file -e "${commit}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$commit"
printf '%s\n' '--- pull request head/base ---'
gh api "repos/$repo/pulls/$pr" \
--jq '{number, state, head_sha: .head.sha, base_sha: .base.sha, changed_files, additions, deletions}'
printf '%s\n' '--- changed files from merge-base to exact commit ---'
base=$(git merge-base origin/main "$commit")
printf 'merge_base=%s\n' "$base"
git diff --check "$base...$commit"
git diff --name-status "$base...$commit"
git diff --find-renames --find-copies --unified=100 "$base...$commit" -- .github/workflows/request-ai-reviews.yml
printf '%s\n' '--- full workflow at exact commit ---'
git show "${commit}:.github/workflows/request-ai-reviews.yml" | cat -n
printf '%s\n' '--- security-relevant constructs at exact commit ---'
git show "${commit}:.github/workflows/request-ai-reviews.yml" \
| rg -n -i -C3 '^\s*(name:|on:|permissions:|jobs:|[[:alnum:]_-]+:|issues:|pull-requests:|contents:|actions:|checks:|deployments:|id-token:|packages:|security-events:|statuses:|uses:|run:)|checkout|pull_request_target|pull_request|workflow_run|github-script|github\.token|secrets\.|curl|gh api|/issues/.*/comments|/pulls/' \
|| true
printf '%s\n' '--- PR changed-file API result ---'
gh api --paginate "repos/$repo/pulls/$pr/files?per_page=100" \
--jq '.[] | {filename, status, additions, deletions, patch}'Length of output: 8192
No findings. The final diff changes only The workflow remains comment-only:
The workflow now requests only ✏️ Learnings added
You are interacting with an AI system. |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Independent corroboration, with the failure captured live — this is worth merging promptly. I hit this from the other direction on #341 and diagnosed the same root cause before finding this PR. Run 32656894114, job So the Why this is more urgent than a red check looks. Every PR in this repo is currently missing its automated AI review request, and the failure surfaces as a single red I had a duplicate fix staged and dropped it in favour of this one. One observation on the diff, take it or leave it: dropping |
|
To use Codex here, create an environment for this repo. |
|
Merging. The red check on this PR's own head is not evidence against it — I confirmed it is the old workflow failing. The failing run (32655081021) logs this body being built: That is the pre-diff string. The trigger is The fix itself is the standard remedy: One follow-up, not a blocker. The diff also drops Verification is immediate and free: the next PR event runs the new definition from |
|
To use Codex here, create an environment for this repo. |
|
Tip For best results, initiate chat on the files or code changes.
The failing run executed the base-branch workflow. Its body proves that it did not execute this PR’s workflow definition. The HTTP 403 is therefore evidence for the permission fix, not evidence against it. The next PR event after merge is the correct verification. If The removal of ✏️ Learnings added
You are interacting with an AI system. |
1 participant
Summary
GITHUB_TOKENrequires@coderabbitai review, the integration proven to accept agithub-actions[bot]requestLive proof
Permission A/B against the same neutral
POST /issues/340/comments:issues: writeonly: HTTP 403issues: writepluspull-requests: write: successEnd-to-end bot-mention probe, run 32655006792:
github-actions[bot]2211017...The workflow therefore closes the real CodeRabbit push re-review gap without pretending it can replace the human-authored Codex gate.
Security boundary
The trusted-base
pull_request_targetworkflow does not check out or execute contributor code, exposes no repository contents permission, and can only write issue/PR metadata needed for the review-request comment.