feat(workflows): add harden-runner and comment_summary_in_pr input for naruon - #1732
Merged
Merged
Conversation
…r naruon A peer session's org-wide workflow-duplication survey (63 repos, 255 workflow files) found naruon independently carrying its own dependency-review.yml -- missed by the original 4-repo survey this consolidation was based on. Auditing it found two real, non-cosmetic differences from the four already-migrated callers: 1. A step-security/harden-runner step (egress audit), present in none of the originals. Not a per-repo policy -- a uniformly beneficial hardening practice already standard elsewhere in this org. Added to the reusable workflow itself as its first step; the four already-migrated callers get it automatically, no caller-side change needed. 2. comment-summary-in-pr: never, an explicit opt-out that conflicts with the earlier decision to hardcode comment-summary-in-pr: on-failure uniformly (made when only scopeweave's original set the field at all). Silently applying that hardcoded value to naruon would overturn a deliberate choice its original workflow made -- the exact mistake this ADR already flagged for fail_on_severity/allow_ghsas. Fixed by making comment_summary_in_pr a proper workflow_call input (default "on-failure", no change for the four already-migrated callers). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 43 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🔍 ADR decision remains outdated
The Decision still defines three inputs and four callers. The later addendum contradicts this authoritative summary, leaving two active designs documented.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
| fail-on-severity: ${{ inputs.fail_on_severity }} | ||
| allow-ghsas: ${{ inputs.allow_ghsas }} | ||
| comment-summary-in-pr: on-failure | ||
| comment-summary-in-pr: ${{ inputs.comment_summary_in_pr }} |
Contributor
There was a problem hiding this comment.
🟡 PR failure summaries are never posted
With comment_summary_in_pr set to on-failure or always, commentPr receives a read-only token. Comment creation returns 403 and only logs a warning.
Prompt for agents
The reusable dependency-review workflow forwards comment_summary_in_pr values that enable PR comments, but its workflow-level permissions grant only pull-requests: read. actions/dependency-review-action requires pull-requests: write for on-failure or always and catches a 403 as a warning, so the job still completes without the promised comment. Update the reusable workflow permission and its contract test to allow writing when comment summaries are enabled. Also ensure every thin caller grants the reusable job sufficient pull-request permission, because a called workflow cannot elevate permissions beyond its caller. Preserve naruon's explicit never behavior and account for GitHub's reduced permissions on fork pull requests.
Was this helpful? React with 👍 or 👎 to provide feedback.
seonghobae
deleted the
feat/dependency-review-harden-runner-and-naruon
branch
September 2, 2026 12:35
seonghobae
added a commit
to ContextualWisdomLab/mightyETL
that referenced
this pull request
Sep 2, 2026
…_in_pr A peer session's org-wide survey found naruon independently carrying its own dependency-review.yml with a harden-runner egress-audit step this consolidation's original four callers lacked. That step (and the comment_summary_in_pr input naruon's explicit "never" choice required) were added to the central reusable workflow in ContextualWisdomLab/.github#1732, after this caller's original PR opened. Re-pinning to the new commit picks up harden-runner for free before this PR's first merge -- no `with:` change needed, since this repo never set comment_summary_in_pr and the new input's default ("on-failure") matches the value this reusable workflow already hardcoded before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
seonghobae
added a commit
to ContextualWisdomLab/newsdom-api
that referenced
this pull request
Sep 2, 2026
…_in_pr A peer session's org-wide survey found naruon independently carrying its own dependency-review.yml with a harden-runner egress-audit step this consolidation's original four callers lacked. That step (and the comment_summary_in_pr input naruon's explicit "never" choice required) were added to the central reusable workflow in ContextualWisdomLab/.github#1732, after this caller's original PR opened. Re-pinning to the new commit picks up harden-runner for free before this PR's first merge -- no `with:` change needed, since this repo never set comment_summary_in_pr and the new input's default ("on-failure") matches the value this reusable workflow already hardcoded before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
seonghobae
added a commit
to ContextualWisdomLab/scopeweave
that referenced
this pull request
Sep 2, 2026
…_in_pr A peer session's org-wide survey found naruon independently carrying its own dependency-review.yml with a harden-runner egress-audit step this consolidation's original four callers lacked. That step (and the comment_summary_in_pr input naruon's explicit "never" choice required) were added to the central reusable workflow in ContextualWisdomLab/.github#1732, after this caller's original PR opened. Re-pinning to the new commit picks up harden-runner for free before this PR's first merge -- no `with:` change needed, since this repo never set comment_summary_in_pr and the new input's default ("on-failure") matches the value this reusable workflow already hardcoded before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2 tasks
seonghobae
added a commit
to ContextualWisdomLab/argos
that referenced
this pull request
Sep 2, 2026
…_in_pr (#559) A peer session's org-wide survey found naruon independently carrying its own dependency-review.yml with a harden-runner egress-audit step this consolidation's original four callers lacked. That step was added to the central reusable workflow in ContextualWisdomLab/.github#1732, after this caller already merged. Re-pinning picks it up with no with: change needed. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
naruonindependently carrying its owndependency-review.yml, missed by the original 4-repo survey this consolidation was based on.step-security/harden-runner(egress audit) — absent from all four originals, added to the reusable workflow itself uniformly (a hardening practice already standard elsewhere in this org, not a per-repo policy).comment-summary-in-pr: never— an explicit opt-out that conflicts with the earlier decision to hardcodeon-failureuniformly. Fixed by makingcomment_summary_in_pra proper input (default"on-failure", no behavior change for the four already-migrated callers).Test plan
python3 -c "import yaml; yaml.safe_load(...)"on the edited workflowactionlint .github/workflows/dependency-review.ymlcoverage run -m pytest tests→ 2639 passed, 1 skipped🤖 Generated with Claude Code