Rename repo workflows - #33
Conversation
|
Warning Review limit reached
Next review available in: 30 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughThe pull request adds repository-specific GitHub Actions workflows for CI, CodeQL, release, Scorecard, and Zizmor. It also adds CI contract checks and updates workflow tests for the ChangesRepository workflow integration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant repo-ci.yml
participant shared-ci.yml
participant ghaScripts
PullRequest->>repo-ci.yml: Trigger pull-request CI
repo-ci.yml->>shared-ci.yml: Invoke shared CI with Playwright filter
repo-ci.yml->>ghaScripts: Build and compare committed output
ghaScripts-->>repo-ci.yml: Return generated diff or clean result
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/repo-ci.yml:
- Around line 69-90: Update the shared contract check in the workflow step to
inspect only changeset files added or modified in the BASE_SHA...HEAD_SHA diff,
then search those files for the "`@zemd/gha`" intent. Preserve the existing
failure message and changed-file reporting when no matching pull-request
changeset is found.
In @.github/workflows/repo-release.yml:
- Line 1: Rename the workflow file currently defining the Release workflow from
repo-release.yml to release.yml so npm trusted publishing recognizes the caller.
Update the workflow naming test to allow this required release.yml exception
while preserving all other filename validation rules.
In `@internal/gha/src/workflows.test.ts`:
- Around line 21-29: Update yamlFiles() to collect workflow files with both .yml
and .yaml extensions, while preserving its existing directory-scanning behavior
so the filename contract in “workflow filenames distinguish repository callers
from shared workflows” validates both formats.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b1af4bdb-7901-4ddd-a636-24946fe4a9a5
📒 Files selected for processing (6)
.github/workflows/repo-ci.yml.github/workflows/repo-codeql.yml.github/workflows/repo-release.yml.github/workflows/repo-scorecard.yml.github/workflows/repo-zizmor.ymlinternal/gha/src/workflows.test.ts
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/repo-ci.yml:
- Around line 69-90: Update the shared contract check in the workflow step to
inspect only changeset files added or modified in the BASE_SHA...HEAD_SHA diff,
then search those files for the "`@zemd/gha`" intent. Preserve the existing
failure message and changed-file reporting when no matching pull-request
changeset is found.
In @.github/workflows/repo-release.yml:
- Line 1: Rename the workflow file currently defining the Release workflow from
repo-release.yml to release.yml so npm trusted publishing recognizes the caller.
Update the workflow naming test to allow this required release.yml exception
while preserving all other filename validation rules.
In `@internal/gha/src/workflows.test.ts`:
- Around line 21-29: Update yamlFiles() to collect workflow files with both .yml
and .yaml extensions, while preserving its existing directory-scanning behavior
so the filename contract in “workflow filenames distinguish repository callers
from shared workflows” validates both formats.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b1af4bdb-7901-4ddd-a636-24946fe4a9a5
📒 Files selected for processing (6)
.github/workflows/repo-ci.yml.github/workflows/repo-codeql.yml.github/workflows/repo-release.yml.github/workflows/repo-scorecard.yml.github/workflows/repo-zizmor.ymlinternal/gha/src/workflows.test.ts
🛑 Comments failed to post (2)
.github/workflows/repo-ci.yml (1)
69-90: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Require a changeset from the pull request.
Line 84 searches every file in
.changeset. An existing@zemd/ghachangeset from the base branch can pass this check. The pull request can then changeshared-*.ymlor.github/scriptswithout its own release intent.Inspect only added or modified changeset files in
"$BASE_SHA...$HEAD_SHA".Proposed fix
- if ! grep -rlF '"`@zemd/gha`"' .changeset >/dev/null 2>&1; then + release_intent=false + while IFS= read -r -d '' changeset; do + if grep -qF '"`@zemd/gha`"' "$changeset"; then + release_intent=true + break + fi + done < <( + git diff --name-only -z --diff-filter=AM \ + "$BASE_SHA...$HEAD_SHA" -- .changeset + ) + if [ "$release_intent" != true ]; then📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.- name: Require a release intent when the shared contract changes env: BASE_SHA: ${{ github.event.pull_request.base.sha }} HEAD_SHA: ${{ github.event.pull_request.head.sha }} run: | if [ -z "$BASE_SHA" ] || [ -z "$HEAD_SHA" ]; then echo "pull request SHAs unavailable; skipping shared contract check" exit 0 fi changed="$(git diff --name-only "$BASE_SHA...$HEAD_SHA" -- \ '.github/workflows/shared-*.yml' .github/scripts)" if [ -z "$changed" ]; then echo "shared contract untouched" exit 0 fi release_intent=false while IFS= read -r -d '' changeset; do if grep -qF '"`@zemd/gha`"' "$changeset"; then release_intent=true break fi done < <( git diff --name-only -z --diff-filter=AM \ "$BASE_SHA...$HEAD_SHA" -- .changeset ) if [ "$release_intent" != true ]; then echo "::error::Add a change intent for `@zemd/gha`, these shared files changed:" printf '%s\n' "$changed" exit 1 fi echo "release intent recorded alongside:" printf '%s\n' "$changed"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/repo-ci.yml around lines 69 - 90, Update the shared contract check in the workflow step to inspect only changeset files added or modified in the BASE_SHA...HEAD_SHA diff, then search those files for the "`@zemd/gha`" intent. Preserve the existing failure message and changed-file reporting when no matching pull-request changeset is found..github/workflows/repo-release.yml (1)
1-1: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Keep the npm publishing caller named
release.yml.npm trusted publishing validates the calling workflow filename. This workflow is named
repo-release.yml, so npm will reject OIDC publication whenNPM_TOKENis not available after initial package publication.Rename this caller to
.github/workflows/release.yml. Update the workflow naming test to allow this required exception.Proposed fix
- .github/workflows/repo-release.yml + .github/workflows/release.yml📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.name: Release🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/repo-release.yml at line 1, Rename the workflow file currently defining the Release workflow from repo-release.yml to release.yml so npm trusted publishing recognizes the caller. Update the workflow naming test to allow this required release.yml exception while preserving all other filename validation rules.
1 participant
No description provided.