From 4f4b0c21da8d117181fb15f136e9c06abf587cb6 Mon Sep 17 00:00:00 2001 From: Khaliq Date: Sun, 23 Aug 2026 19:09:50 +0200 Subject: [PATCH 1/5] fix(ci): grant PR comment permission to review requester --- .github/workflows/request-ai-reviews.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml index d26d4aa0..9f56880f 100644 --- a/.github/workflows/request-ai-reviews.yml +++ b/.github/workflows/request-ai-reviews.yml @@ -22,6 +22,7 @@ jobs: runs-on: ubuntu-latest permissions: issues: write + pull-requests: write steps: - name: Request exact-head reviews env: From 93687ad3a237339ccc6c1fc1d1a1fda69ecb8fac Mon Sep 17 00:00:00 2001 From: Khaliq Date: Sun, 23 Aug 2026 19:14:50 +0200 Subject: [PATCH 2/5] test(ci): probe review-token comment permission --- .github/workflows/request-ai-reviews.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml index 9f56880f..12d2449c 100644 --- a/.github/workflows/request-ai-reviews.yml +++ b/.github/workflows/request-ai-reviews.yml @@ -1,6 +1,9 @@ name: Request AI reviews on: + push: + branches: + - fix/ai-review-request-permission pull_request_target: types: - opened @@ -18,18 +21,25 @@ concurrency: jobs: request: - if: ${{ !github.event.pull_request.draft }} + if: ${{ github.event_name == 'push' || !github.event.pull_request.draft }} runs-on: ubuntu-latest permissions: issues: write - pull-requests: write steps: - name: Request exact-head reviews env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - HEAD_SHA: ${{ github.event.pull_request.head.sha }} - PR_NUMBER: ${{ github.event.pull_request.number }} + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + PR_NUMBER: ${{ github.event.pull_request.number || '340' }} run: | + if [ "${GITHUB_EVENT_NAME}" = "push" ]; then + gh api \ + --include \ + --method POST \ + "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \ + --raw-field body="Temporary GITHUB_TOKEN permission diagnostic for ${HEAD_SHA}." + exit 0 + fi body=$(printf '@coderabbitai review\n\n@codex review\n\nRequested for exact head `%s`.\n' "$HEAD_SHA" "$HEAD_SHA") gh api \ --method POST \ From 2893e9af5a733b0dc9497df48e8057c9bfcb7579 Mon Sep 17 00:00:00 2001 From: Khaliq Date: Sun, 23 Aug 2026 19:15:22 +0200 Subject: [PATCH 3/5] test(ci): probe combined comment permissions --- .github/workflows/request-ai-reviews.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml index 12d2449c..159d8447 100644 --- a/.github/workflows/request-ai-reviews.yml +++ b/.github/workflows/request-ai-reviews.yml @@ -25,6 +25,7 @@ jobs: runs-on: ubuntu-latest permissions: issues: write + pull-requests: write steps: - name: Request exact-head reviews env: From 2211017e7b54ba596d3664f4e7c71e539ff73bad Mon Sep 17 00:00:00 2001 From: Khaliq Date: Sun, 23 Aug 2026 19:16:08 +0200 Subject: [PATCH 4/5] test(ci): remove temporary permission probe --- .github/workflows/request-ai-reviews.yml | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml index 159d8447..9f56880f 100644 --- a/.github/workflows/request-ai-reviews.yml +++ b/.github/workflows/request-ai-reviews.yml @@ -1,9 +1,6 @@ name: Request AI reviews on: - push: - branches: - - fix/ai-review-request-permission pull_request_target: types: - opened @@ -21,7 +18,7 @@ concurrency: jobs: request: - if: ${{ github.event_name == 'push' || !github.event.pull_request.draft }} + if: ${{ !github.event.pull_request.draft }} runs-on: ubuntu-latest permissions: issues: write @@ -30,17 +27,9 @@ jobs: - name: Request exact-head reviews env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} - PR_NUMBER: ${{ github.event.pull_request.number || '340' }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + PR_NUMBER: ${{ github.event.pull_request.number }} run: | - if [ "${GITHUB_EVENT_NAME}" = "push" ]; then - gh api \ - --include \ - --method POST \ - "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \ - --raw-field body="Temporary GITHUB_TOKEN permission diagnostic for ${HEAD_SHA}." - exit 0 - fi body=$(printf '@coderabbitai review\n\n@codex review\n\nRequested for exact head `%s`.\n' "$HEAD_SHA" "$HEAD_SHA") gh api \ --method POST \ From d0c63d0b06ac1a7c73c0bc5854a4897ea5807896 Mon Sep 17 00:00:00 2001 From: Khaliq Date: Sun, 23 Aug 2026 19:30:49 +0200 Subject: [PATCH 5/5] fix(ci): request only supported CodeRabbit review --- .github/workflows/request-ai-reviews.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml index 9f56880f..18971431 100644 --- a/.github/workflows/request-ai-reviews.yml +++ b/.github/workflows/request-ai-reviews.yml @@ -1,4 +1,4 @@ -name: Request AI reviews +name: Request CodeRabbit review on: pull_request_target: @@ -13,7 +13,7 @@ on: permissions: {} concurrency: - group: ai-review-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }} + group: coderabbit-review-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }} cancel-in-progress: true jobs: @@ -30,7 +30,7 @@ jobs: HEAD_SHA: ${{ github.event.pull_request.head.sha }} PR_NUMBER: ${{ github.event.pull_request.number }} run: | - body=$(printf '@coderabbitai review\n\n@codex review\n\nRequested for exact head `%s`.\n' "$HEAD_SHA" "$HEAD_SHA") + body=$(printf '@coderabbitai review\n\nRequested for exact head `%s`.\n' "$HEAD_SHA" "$HEAD_SHA") gh api \ --method POST \ "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \