fix(security): isolate privileged review dispatch - #635
Conversation
|
Warning Review limit reached
Next review available in: 28 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughChangesOpenCode 리뷰 디스패치 분리
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant BootstrapWorkflow
participant DispatchWorkflow
participant CoverageEvidence
participant OpenCodeModelPool
participant GitHubReviewAPI
PullRequest->>BootstrapWorkflow: pull_request_target metadata 전달
BootstrapWorkflow->>DispatchWorkflow: 인증된 repository_dispatch 전송
DispatchWorkflow->>CoverageEvidence: PR merge tree 및 coverage evidence 생성
CoverageEvidence-->>DispatchWorkflow: coverage_summary 반환
DispatchWorkflow->>OpenCodeModelPool: bounded review evidence 전달
OpenCodeModelPool-->>DispatchWorkflow: structured control block 반환
DispatchWorkflow->>GitHubReviewAPI: review outcome 및 status 게시
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
tests/test_opencode_workflow_shell_syntax.py (1)
42-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win대형 셸 블록인 "Publish bounded OpenCode review comment" 스텝이
bash -n검사 대상에서 빠져 있습니다.해당 스텝(dispatch 워크플로우 3687라인 이하)은 mermaid/충돌 안내 헬퍼를 포함한 200줄 이상의 인라인 셸이며, 이번 PR에서 새로 이동해 온 코드입니다. 목록에 추가하면 YAML은 유효하지만 bash 파싱이 깨지는 회귀를 즉시 잡을 수 있습니다.
♻️ 검사 대상 스텝 추가
for step_name in ( "Materialize pull request merge tree for coverage measurement", "Prepare bounded OpenCode review evidence", "Enforce changed-file syntax gate", + "Publish bounded OpenCode review comment", "Publish OpenCode review outcome", "Run merge scheduler after approval", ):🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_opencode_workflow_shell_syntax.py` around lines 42 - 48, Update the step-name collection in the test to include “Publish bounded OpenCode review comment” so its inline shell block is included in the existing bash -n syntax validation; preserve all current step entries and validation behavior..github/workflows/opencode-review-dispatch.yml (2)
4595-4648: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win도달 불가능한 legacy 브리지이며, 호출 인자도 하나 부족합니다.
LEGACY_GITHUB_ACTIONS_REVIEW_TOKEN은 라인 4305에서github.event_name == 'pull_request_target' && github.token || ''로 정의되는데, 이 워크플로우는repository_dispatch전용이라 값이 항상 빈 문자열입니다. 따라서publish_legacy_github_actions_approval_bridge는 항상 조기 return하는 데드코드입니다. 게다가 라인 4642의 호출은post_pull_review_with_retry가 요구하는 5번째 인자(response_file)를 넘기지 않아, 만약 도달한다면set -u하에서$5: unbound variable로 죽습니다.이 dispatch 경로에서는 브리지 전체(및 관련 env)를 제거하는 편이 안전합니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-review-dispatch.yml around lines 4595 - 4648, Remove the unreachable publish_legacy_github_actions_approval_bridge function and its related LEGACY_GITHUB_ACTIONS_REVIEW_TOKEN environment/configuration and invocation from the repository_dispatch workflow. Do not retain the dead legacy bridge path or its post_pull_review_with_retry call, including the missing response_file argument issue.
3746-3859: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftMermaid/충돌 안내 헬퍼 4종이 두 스텝에 그대로 복제되어 있고 들여쓰기도 어긋나 있습니다.
emit_change_flow_mermaid_graph,append_mermaid_review_graph,ensure_review_body_has_change_graph,append_merge_conflict_guidance가 "Publish bounded OpenCode review comment"와 "Publish OpenCode review outcome" 두 스텝에 동일 내용으로 중복 정의되어 있습니다. 한쪽만 수정되는 드리프트가 생기기 쉽습니다. 또한 복제된 블록의 들여쓰기(20칸)가 주변 코드와 달라 가독성을 해칩니다.
scripts/ci/에 공용 셸 라이브러리로 추출하고 두 스텝에서source하는 방식을 권장합니다.Also applies to: 4650-4763
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-review-dispatch.yml around lines 3746 - 3859, Extract the duplicated Mermaid and merge-conflict helpers—emit_change_flow_mermaid_graph, append_mermaid_review_graph, ensure_review_body_has_change_graph, and append_merge_conflict_guidance—into a shared shell library under scripts/ci/. Source that library from both “Publish bounded OpenCode review comment” and “Publish OpenCode review outcome” steps, remove their inline duplicate definitions, and align the remaining workflow indentation with surrounding code.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/opencode-review-dispatch.yml:
- Around line 329-333: Update the trusted_ref fallback prefix in the shown
workflow-ref handling to match opencode-review-dispatch.yml rather than
opencode-review.yml, so valid workflow_ref values extract their ref instead of
defaulting to main. Apply the same correction to the duplicate logic around the
second referenced location.
---
Nitpick comments:
In @.github/workflows/opencode-review-dispatch.yml:
- Around line 4595-4648: Remove the unreachable
publish_legacy_github_actions_approval_bridge function and its related
LEGACY_GITHUB_ACTIONS_REVIEW_TOKEN environment/configuration and invocation from
the repository_dispatch workflow. Do not retain the dead legacy bridge path or
its post_pull_review_with_retry call, including the missing response_file
argument issue.
- Around line 3746-3859: Extract the duplicated Mermaid and merge-conflict
helpers—emit_change_flow_mermaid_graph, append_mermaid_review_graph,
ensure_review_body_has_change_graph, and append_merge_conflict_guidance—into a
shared shell library under scripts/ci/. Source that library from both “Publish
bounded OpenCode review comment” and “Publish OpenCode review outcome” steps,
remove their inline duplicate definitions, and align the remaining workflow
indentation with surrounding code.
In `@tests/test_opencode_workflow_shell_syntax.py`:
- Around line 42-48: Update the step-name collection in the test to include
“Publish bounded OpenCode review comment” so its inline shell block is included
in the existing bash -n syntax validation; preserve all current step entries and
validation behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4214d38d-5833-4409-9a58-6ba25f2d992a
📒 Files selected for processing (11)
.github/workflows/opencode-review-dispatch.yml.github/workflows/opencode-review.ymlPR_GOVERNANCE_AUDIT.mddocs/org-required-workflow-rollout.mdscripts/ci/strix_quick_gate.shscripts/ci/test_opencode_fact_gate_contract.shscripts/ci/test_strix_quick_gate.shtests/test_opencode_agent_contract.pytests/test_opencode_docker_evidence_contract.pytests/test_opencode_workflow_shell_syntax.pytests/test_required_workflow_queue_contract.py
1 participant
Summary
opencode-review.ymlas a metadata-onlypull_request_targetbootstraprepository_dispatchworkflowThis structurally addresses default-branch CodeQL Critical alerts #182-#185 (
actions/untrusted-checkout/critical) without dismissing them.Verification
python3 -m pytest -q(641 passed)bash scripts/ci/test_opencode_fact_gate_contract.shbash scripts/ci/test_strix_quick_gate.shactionlintpython3 -m ruff check ...bash -n ...git diff --checkSummary by CodeRabbit
새로운 기능
보안 및 안정성
문서 및 테스트