Add auto-approver for testbot-respond environment#835
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that auto-approves pending deployments for the Changes
Sequence Diagram(s)sequenceDiagram
participant TriggeringWorkflow as Triggering Workflow
participant ApproverWorkflow as Approve Workflow
participant Script as github-script
participant ActionsAPI as GitHub Actions API
participant TeamsAPI as GitHub Teams API
TriggeringWorkflow->>ApproverWorkflow: workflow_run (requested)
ApproverWorkflow->>Script: execute with SVC_OSMO_CI_TOKEN
Script->>ActionsAPI: getWorkflowRun(run_id)
alt run already completed
ActionsAPI-->>Script: status=completed
Script-->>ApproverWorkflow: exit
else
Script->>ActionsAPI: getPendingDeploymentsForRun(run_id) [poll with backoff + jitter]
alt actor not in trusted list
Script->>TeamsAPI: getMembershipForUserInOrg(actor, org=osmo)
TeamsAPI-->>Script: membership / 404 / error
else actor trusted
Note right of Script: skip team check
end
alt pending deployments found for environment 'testbot-respond'
Script->>ActionsAPI: reviewPendingDeploymentsForRun(state=approved, env_ids, comment)
ActionsAPI-->>Script: approval result
else none found
Script-->>ApproverWorkflow: log and exit
end
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/testbot-respond-approve.yaml:
- Around line 109-114: The workflow currently treats zero pending deployments as
an error by calling core.setFailed when deployments.length === 0; change this to
a non-failing path: replace the core.setFailed invocation with a benign log
(e.g., core.info or core.warning) that includes the run.id and a short reason
(e.g., "no pending deployments — run may be cancelled/already approved/queued"),
then return; this prevents false negatives for legitimate workflow_run.requested
cases while preserving the early exit when no deployments are found.
- Around line 73-85: The catch currently treats all errors from
github.rest.teams.getMembershipForUserInOrg as "not a member"; change the error
handling in the isTrustedBot branch so you only treat err.status === 404 as a
non-member (call core.info and return), and for any other status (e.g., 403,
429, 500) call core.setFailed with the error details (include actor and
err.status) so the failure is surfaced and then rethrow or return to stop
further processing; update references in this block (isTrustedBot,
github.rest.teams.getMembershipForUserInOrg, actor, core.info, core.setFailed)
accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: eddcd036-fd53-405a-8d55-2306b6a1d78b
📒 Files selected for processing (1)
.github/workflows/testbot-respond-approve.yaml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #835 +/- ##
==========================================
+ Coverage 42.49% 42.67% +0.18%
==========================================
Files 203 203
Lines 27121 27121
Branches 7759 7759
==========================================
+ Hits 11524 11574 +50
+ Misses 15486 15434 -52
- Partials 111 113 +2
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
jiaenren
temporarily deployed
to
testbot-generate
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/testbot-respond-approve.yaml:
- Around line 76-82: The call to github.rest.teams.getMembershipForUserInOrg
(used to auto-approve in this workflow) currently treats any 200 response as
approval; update the catch-branch logic so you examine the response.body.state
(or response.data.state) from getMembershipForUserInOrg and require state ===
'active' before granting approval. If the state is not 'active', treat it as
unauthorized (log a message and do not proceed with approval), and handle cases
where the call throws (keep the existing catch behavior). Ensure the check is
performed immediately after the getMembershipForUserInOrg call and before
logging `${actor} is an NVIDIA/osmo-dev team member`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: bd22af3e-71a1-4006-a42c-213e8d30976f
📒 Files selected for processing (1)
.github/workflows/testbot-respond-approve.yaml
jiaenren
force-pushed
the
jiaenr/testbot-auto-approve
branch
from
8f0e54d to
43fdc5e
Compare
Auto-approves environment deployment for NVIDIA/osmo-dev team members and trusted bots (svc-osmo-ci, github-actions[bot], coderabbitai[bot]). Uses workflow_run trigger from main branch so PR authors cannot tamper with the approval logic. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jiaenren
force-pushed
the
jiaenr/testbot-auto-approve
branch
from
43fdc5e to
e2cdc56
Compare
cypres
approved these changes
Apr 9, 2026
elookpotts-nvidia
approved these changes
Apr 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Auto-approves the
testbot-respondenvironment deployment when the triggering actor is anNVIDIA/osmo-devteam member or a trusted bot. Runs frommainviaworkflow_run, so PR authors cannot tamper with the approval logic.svc-osmo-ci,github-actions[bot],coderabbitai[bot]) are auto-approved so their runs complete quickly —respond.pyfinds no/testbotthreads and exits. This prevents bot-triggered runs from blocking the concurrency groupIssue #760
Manual setup required after merge
svc-osmo-cias required reviewer on thetestbot-respondenvironment (the API strictly requires the PAT owner to be a listed reviewer)SVC_OSMO_CI_TOKENPAT scopes includeread:org+repoTest plan
main(workflow_runonly fires from default branch)ai-generatedlabel, post/testbotas osmo-dev member → auto-approved within seconds/testbotas non-member → stays pending, never approvedChecklist
Summary by CodeRabbit