docs: add lark-drive permission governance workflow#1292
Conversation
jiangguozhou
added
documentation
|
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdds comprehensive lark-drive documentation for a new permission_governance workflow: a master workflow framework, the permission_governance specification with state machine and rules, a CLI command reference, detailed user-facing output templates, and SKILL.md routing to the workflow. ChangesPermission Governance Workflow System
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
size/L
jiangguozhou
added
size/S
github-actions
Bot
added
size/L
jiangguozhou
added
size/S
Change-Id: I4d886ea68f95271a66e552839f71ab566a6a7df7
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@skills/lark-drive/references/lark-drive-workflow-permission-governance-commands.md`:
- Around line 80-121: The doc currently shows +secure-label-update without first
listing available labels, which breaks the EXEC_CONFIRM contract; add a
secure-label enumeration example (using the command symbol +secure-label-list)
immediately before +secure-label-update in the "写前确认与执行" section so users can
discover label IDs to confirm, and ensure the example matches the flag style
used elsewhere (--token/--type/--label-id, --as user, --format json) to keep
consistency with permission.members auth and +secure-label-update entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fc2d23e3-1aaa-4e91-9927-5e9cf3e6b82f
📒 Files selected for processing (5)
skills/lark-drive/SKILL.mdskills/lark-drive/references/lark-drive-workflow-permission-governance-commands.mdskills/lark-drive/references/lark-drive-workflow-permission-governance-outputs.mdskills/lark-drive/references/lark-drive-workflow-permission-governance.mdskills/lark-drive/references/lark-drive-workflow.md
| ## 写前确认与执行 | ||
|
|
||
| patch 前检查 manage-public permission： | ||
|
|
||
| ```bash | ||
| lark-cli drive permission.members auth \ | ||
| --params '{"token":"<token>","type":"<type>","action":"manage_public"}' \ | ||
| --as user --format json | ||
| ``` | ||
|
|
||
| 显式确认后 patch public permission： | ||
|
|
||
| ```bash | ||
| lark-cli drive permission.public patch \ | ||
| --params '{"token":"<token>","type":"<type>"}' \ | ||
| --data '{"link_share_entity":"closed","external_access":false}' \ | ||
| --as user --yes --format json | ||
| ``` | ||
|
|
||
| 显式确认后申请访问权限： | ||
|
|
||
| ```bash | ||
| lark-cli drive +apply-permission \ | ||
| --token '<url>' \ | ||
| --perm view --remark '<reason>' --as user --format json | ||
|
|
||
| lark-cli drive +apply-permission \ | ||
| --token '<bare-token>' --type '<type>' \ | ||
| --perm view --remark '<reason>' --as user --format json | ||
| ``` | ||
|
|
||
| 显式确认后更新 secure label： | ||
|
|
||
| ```bash | ||
| lark-cli drive +secure-label-update \ | ||
| --token '<url>' \ | ||
| --label-id '<label-id>' --as user --format json | ||
|
|
||
| lark-cli drive +secure-label-update \ | ||
| --token '<bare-token>' --type '<type>' \ | ||
| --label-id '<label-id>' --as user --format json | ||
| ``` |
There was a problem hiding this comment.
补充 secure label 写前枚举命令，避免与上游流程契约脱节。
当前“写前确认与执行”里直接给了 +secure-label-update，但缺少 drive +secure-label-list 示例；这与上游工作流在 EXEC_CONFIRM 阶段先解析可用 label ID 的要求不一致，容易导致确认阶段缺失关键校验。
Proposed doc patch
## 写前确认与执行
patch 前检查 manage-public permission：
```bash
lark-cli drive permission.members auth \
--params '{"token":"<token>","type":"<type>","action":"manage_public"}' \
--as user --format json+更新 secure label 前先枚举可用标签：
+
+```bash
+lark-cli drive +secure-label-list \
- --as user --format json
+```
显式确认后 patch public permission：
</details>
<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
@skills/lark-drive/references/lark-drive-workflow-permission-governance-commands.md
around lines 80 - 121, The doc currently shows +secure-label-update without
first listing available labels, which breaks the EXEC_CONFIRM contract; add a
secure-label enumeration example (using the command symbol +secure-label-list)
immediately before +secure-label-update in the "写前确认与执行" section so users can
discover label IDs to confirm, and ensure the example matches the flag style
used elsewhere (--token/--type/--label-id, --as user, --format json) to keep
consistency with permission.members auth and +secure-label-update entries.
</details>
<!-- fingerprinting:phantom:triton:hawk -->
<!-- This is an auto-generated comment by CodeRabbit -->
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@0873d47f475895ff74468ec3e7e38b1ed04a7cf9🧩 Skill updatenpx skills add larksuite/cli#docs/lark-drive-permission-governance -y -g |
jiangguozhou
force-pushed
the
docs/lark-drive-permission-governance
branch
from
86bdd52 to
0873d47
Compare
github-actions
Bot
added
size/L
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1292 +/- ##
=======================================
Coverage 70.33% 70.33%
=======================================
Files 672 672
Lines 65322 65322
=======================================
Hits 45941 45941
Misses 15728 15728
Partials 3653 3653 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
Summary
Add a registered
permission_governanceworkflow forlark-driveso AI agents can audit and govern Drive / Docs / Wiki permission risks with explicit safety gates. The workflow keepsSKILL.mdas a short router and moves runtime protocol, command examples, and user-facing output templates into references.Changes
lark-driveworkflow registry and shared runtime contract for registered workflows.permission_governanceworkflow with scope parsing, read-only discovery, risk classification, write confirmation, and verification rules.skills/lark-drive/SKILL.mdinto the registered workflow.Test Plan
git diff --cached --checkpassedmake unit-testpassedgo vet ./...passedgofmt -l .produced no outputgo run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/mainpassedlark-cli drive +inspect --helplark-cli wiki +node-list --helplark-cli drive +apply-permission --helplark-cli drive +secure-label-update --helplark-cli schema drive.metas.batch_querylark-cli schema drive.permission.public.getlark-cli schema drive.permission.public.patchRelated Issues
Summary by CodeRabbit
New Features
Documentation