feat: post check runs on PRs with Amber session link#1201
Conversation
When Amber works on a PR (via @ambient-code comment or batch fixer), post a GitHub check run with: - Status: success/failure/neutral based on session phase - Details URL: link directly to the Amber session in the UI This makes sessions visible in the PR checks tab. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughWorkflow permissions now include Changes
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/amber-issue-handler.yml (1)
27-31:⚠️ Potential issue | 🟠 MajorScope
checks: writeto the jobs that post checks.Line 31 grants
checks: writeworkflow-wide, but onlyhandle-commentandbatch-pr-fixercreate check runs. Move that grant to job-levelpermissionson those two jobs so the issue-label path keeps the narrower token it already had. As per coding guidelines,.github/workflows/**/*.{yml,yaml}: "Verify secrets are not exposed and permissions are scoped."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/amber-issue-handler.yml around lines 27 - 31, Top-level workflow permissions currently include "checks: write"; remove that entry from the global permissions block and instead add "checks: write" to the job-level permissions for the two jobs that create check runs: the "handle-comment" job and the "batch-pr-fixer" job. Keep other top-level permissions (contents: read, issues: write, pull-requests: write) intact and ensure the two job definitions each include a permissions map that adds checks: write while inheriting the necessary narrower tokens for the issue-label path.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/amber-issue-handler.yml:
- Around line 304-312: The gh api call that creates the check-run (gh api
"repos/${{ github.repository }}/check-runs" -f ... output[summary]=...)
currently swallows all errors via "|| true"; remove that blanket suppression and
replace it with explicit error handling so failures are not hidden — capture the
gh api exit status and stderr, and if it fails emit a visible warning that
includes the API error/response (and contextual fields like $HEAD_SHA,
$SESSION_NAME, $SESSION_PHASE, $SESSION_URL) while still allowing the step to
continue if you truly want non-blocking behavior.
- Around line 408-425: post_check_run currently posts a check-run to the PR
using the head_sha captured once and hardcodes status=completed; update it to
use the passed status parameter (e.g., replace the "-f", "status=completed" arg
with "-f", f"status={status}") and only include the conclusion field when status
== "completed" (compute conclusion as you already do, but don't force status to
completed). Also ensure the check-run for the final result is posted after Amber
finishes: in create_session_api, continue to queue the session but do not rely
on the earlier-captured head_sha for the final check-run—when the session
completes, call post_check_run again (or re-call gh api within post_check_run)
and re-fetch head_sha with gh("pr","view",...,"headRefOid") so the completion
check-run is attached to the updated commit SHA and uses the proper
status/conclusion derived from the Amber session phase.
---
Outside diff comments:
In @.github/workflows/amber-issue-handler.yml:
- Around line 27-31: Top-level workflow permissions currently include "checks:
write"; remove that entry from the global permissions block and instead add
"checks: write" to the job-level permissions for the two jobs that create check
runs: the "handle-comment" job and the "batch-pr-fixer" job. Keep other
top-level permissions (contents: read, issues: write, pull-requests: write)
intact and ensure the two job definitions each include a permissions map that
adds checks: write while inheriting the necessary narrower tokens for the
issue-label path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6cf682bb-9140-48a7-922a-f713bfeffa7b
📒 Files selected for processing (1)
.github/workflows/amber-issue-handler.yml
| def post_check_run(pr_number, session_name, status="in_progress"): | ||
| """Post a check run on the PR linking to the Amber session.""" | ||
| head_sha = gh("pr", "view", str(pr_number), "--repo", REPO, "--json", "headRefOid", "--jq", ".headRefOid") | ||
| if not head_sha: | ||
| return | ||
| api_url_base = API_URL.rstrip("/").replace("/api", "") | ||
| session_url = f"{api_url_base}/projects/{PROJECT}/sessions/{session_name}" | ||
| conclusion = "success" if status == "completed" else "neutral" | ||
| gh("api", f"repos/{REPO}/check-runs", | ||
| "-X", "POST", | ||
| "-f", "name=Amber Session", | ||
| "-f", f"head_sha={head_sha}", | ||
| "-f", "status=completed", | ||
| "-f", f"conclusion={conclusion}", | ||
| "-f", f"details_url={session_url}", | ||
| "-f", "output[title]=Amber — batch fix", | ||
| "-f", f"output[summary]=Session `{session_name}` triggered for PR #{pr_number}") | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -type f -name "amber-issue-handler.yml" | head -20Repository: ambient-code/platform
Length of output: 108
🏁 Script executed:
wc -l ./.github/workflows/amber-issue-handler.ymlRepository: ambient-code/platform
Length of output: 112
🏁 Script executed:
sed -n '400,440p' ./.github/workflows/amber-issue-handler.ymlRepository: ambient-code/platform
Length of output: 2246
🏁 Script executed:
sed -n '440,480p' ./.github/workflows/amber-issue-handler.ymlRepository: ambient-code/platform
Length of output: 2365
🏁 Script executed:
sed -n '480,530p' ./.github/workflows/amber-issue-handler.ymlRepository: ambient-code/platform
Length of output: 2471
🏁 Script executed:
sed -n '530,558p' ./.github/workflows/amber-issue-handler.ymlRepository: ambient-code/platform
Length of output: 1552
Check runs posted to wrong commit; status hardcoded and parameter ignored.
create_session_api() returns immediately after queueing the session—it does not wait for Amber to process or push fixes. post_check_run() is then called on line 535 with the current headRefOid (line 410), posting a check run to the pre-fix commit. When Amber later pushes fixes, the check run remains pinned to the old SHA.
Additionally, line 420 hardcodes status=completed regardless of the status parameter (which defaults to in_progress), breaking the intended status reporting. The check run should be reposted after the session completes, with status/conclusion derived from the actual Amber session phase.
Applies to lines 408–425 and the call site at 533–535.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/amber-issue-handler.yml around lines 408 - 425,
post_check_run currently posts a check-run to the PR using the head_sha captured
once and hardcodes status=completed; update it to use the passed status
parameter (e.g., replace the "-f", "status=completed" arg with "-f",
f"status={status}") and only include the conclusion field when status ==
"completed" (compute conclusion as you already do, but don't force status to
completed). Also ensure the check-run for the final result is posted after Amber
finishes: in create_session_api, continue to queue the session but do not rely
on the earlier-captured head_sha for the final check-run—when the session
completes, call post_check_run again (or re-call gh api within post_check_run)
and re-fetch head_sha with gh("pr","view",...,"headRefOid") so the completion
check-run is attached to the updated commit SHA and uses the proper
status/conclusion derived from the Amber session phase.
Automated Review Fix — Blocked on PermissionsI attempted to address all three CodeRabbit review comments:
However, the push was rejected because this PR modifies The fix commit is ready locally: |
|
@ambient-code please just make the changes as inline code suggestions |
![ambient-code[bot]](https://avatars.githubusercontent.com/u/231559327?s=60&v=4){kind=small}
There was a problem hiding this comment.
Addressing all CodeRabbit review comments.
Note on permissions scoping: The checks: write at line 31 should be removed from workflow-level and added as job-level permissions on handle-comment (after line 134) and batch-pr-fixer (after line 332). These lines are outside the diff so I can't post inline suggestions — the change would be:
On handle-comment (after line 134), add:
permissions:
contents: read
issues: write
pull-requests: write
checks: writeOn batch-pr-fixer (after line 332), add:
permissions:
contents: read
pull-requests: write
checks: writeAnd remove checks: write from the workflow-level permissions block (line 31).
| gh api "repos/${{ github.repository }}/check-runs" \ | ||
| -X POST \ | ||
| -f "name=Amber Session" \ | ||
| -f "head_sha=$HEAD_SHA" \ | ||
| -f "status=completed" \ | ||
| -f "conclusion=$CONCLUSION" \ | ||
| -f "details_url=$SESSION_URL" \ | ||
| -f "output[title]=Amber — ${{ steps.context.outputs.prompt_type }} prompt" \ | ||
| -f "output[summary]=Session \`$SESSION_NAME\` (phase: $SESSION_PHASE)" || true |
There was a problem hiding this comment.
Don't swallow check-run creation errors.
Replace || true with captured output + ::warning:: so failures are visible in the Actions log while keeping the step non-blocking.
| gh api "repos/${{ github.repository }}/check-runs" \ | |
| -X POST \ | |
| -f "name=Amber Session" \ | |
| -f "head_sha=$HEAD_SHA" \ | |
| -f "status=completed" \ | |
| -f "conclusion=$CONCLUSION" \ | |
| -f "details_url=$SESSION_URL" \ | |
| -f "output[title]=Amber — ${{ steps.context.outputs.prompt_type }} prompt" \ | |
| -f "output[summary]=Session \`$SESSION_NAME\` (phase: $SESSION_PHASE)" || true | |
| if ! CHECK_OUTPUT=$(gh api "repos/${{ github.repository }}/check-runs" \ | |
| -X POST \ | |
| -f "name=Amber Session" \ | |
| -f "head_sha=$HEAD_SHA" \ | |
| -f "status=completed" \ | |
| -f "conclusion=$CONCLUSION" \ | |
| -f "details_url=$SESSION_URL" \ | |
| -f "output[title]=Amber — ${{ steps.context.outputs.prompt_type }} prompt" \ | |
| -f "output[summary]=Session \`$SESSION_NAME\` (phase: $SESSION_PHASE)" 2>&1); then | |
| echo "::warning::Failed to post check run (HEAD_SHA=$HEAD_SHA, SESSION=$SESSION_NAME, PHASE=$SESSION_PHASE, URL=$SESSION_URL): $CHECK_OUTPUT" | |
| fi |
| def post_check_run(pr_number, session_name, status="in_progress"): | ||
| """Post a check run on the PR linking to the Amber session.""" | ||
| head_sha = gh("pr", "view", str(pr_number), "--repo", REPO, "--json", "headRefOid", "--jq", ".headRefOid") | ||
| if not head_sha: | ||
| return | ||
| api_url_base = API_URL.rstrip("/").replace("/api", "") | ||
| session_url = f"{api_url_base}/projects/{PROJECT}/sessions/{session_name}" | ||
| conclusion = "success" if status == "completed" else "neutral" | ||
| gh("api", f"repos/{REPO}/check-runs", | ||
| "-X", "POST", | ||
| "-f", "name=Amber Session", | ||
| "-f", f"head_sha={head_sha}", | ||
| "-f", "status=completed", | ||
| "-f", f"conclusion={conclusion}", | ||
| "-f", f"details_url={session_url}", | ||
| "-f", "output[title]=Amber — batch fix", | ||
| "-f", f"output[summary]=Session `{session_name}` triggered for PR #{pr_number}") | ||
|
|
There was a problem hiding this comment.
Fix post_check_run: honor the status parameter and only include conclusion when completed.
The current code hardcodes status=completed (line 420) and ignores the status parameter. This fix passes through the actual status and only adds conclusion for completed runs.
| def post_check_run(pr_number, session_name, status="in_progress"): | |
| """Post a check run on the PR linking to the Amber session.""" | |
| head_sha = gh("pr", "view", str(pr_number), "--repo", REPO, "--json", "headRefOid", "--jq", ".headRefOid") | |
| if not head_sha: | |
| return | |
| api_url_base = API_URL.rstrip("/").replace("/api", "") | |
| session_url = f"{api_url_base}/projects/{PROJECT}/sessions/{session_name}" | |
| conclusion = "success" if status == "completed" else "neutral" | |
| gh("api", f"repos/{REPO}/check-runs", | |
| "-X", "POST", | |
| "-f", "name=Amber Session", | |
| "-f", f"head_sha={head_sha}", | |
| "-f", "status=completed", | |
| "-f", f"conclusion={conclusion}", | |
| "-f", f"details_url={session_url}", | |
| "-f", "output[title]=Amber — batch fix", | |
| "-f", f"output[summary]=Session `{session_name}` triggered for PR #{pr_number}") | |
| def post_check_run(pr_number, session_name, status="in_progress"): | |
| """Post a check run on the PR linking to the Amber session.""" | |
| head_sha = gh("pr", "view", str(pr_number), "--repo", REPO, "--json", "headRefOid", "--jq", ".headRefOid") | |
| if not head_sha: | |
| return | |
| api_url_base = API_URL.rstrip("/").replace("/api", "") | |
| session_url = f"{api_url_base}/projects/{PROJECT}/sessions/{session_name}" | |
| args = [ | |
| "api", f"repos/{REPO}/check-runs", | |
| "-X", "POST", | |
| "-f", "name=Amber Session", | |
| "-f", f"head_sha={head_sha}", | |
| "-f", f"status={status}", | |
| "-f", f"details_url={session_url}", | |
| "-f", "output[title]=Amber — batch fix", | |
| "-f", f"output[summary]=Session `{session_name}` triggered for PR #{pr_number}", | |
| ] | |
| if status == "completed": | |
| args.extend(["-f", "conclusion=success"]) | |
| gh(*args) |
Status Update — Push Blocked by GitHub PermissionsAll 3 CodeRabbit review comments have been addressed in a local commit ( Changes ready (commit
|
Move circuit breaker logic from GHA shell to agent prompts: - Agent reads/increments retry_count in frontmatter - Agent adds ambient-code:needs-human and removes ambient-code:managed - Agent sends Slack notification when human attention needed Slack notifications sent when: - Circuit breaker fires (3+ retries) - Agent is stuck and can't proceed - AskUserQuestion tool is used Also: - Add log_correction instruction to fix prompts - Pass SLACK_WEBHOOK_URL and PLATFORM_HOST as env vars to sessions - Remove GHA-side frontmatter/circuit-breaker management from batch Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/amber-issue-handler.yml (1)
72-72:⚠️ Potential issue | 🟠 MajorPin actions to commit SHA instead of tag.
ambient-code/ambient-actionis used at lines 72, 195, 247, and 285 with tagv0.0.4. Per coding guidelines, action versions must be pinned to SHA. Tags are mutable and can be overwritten.Replace with commit SHA
1204c23cd7f193bd056c11d13634b3c5a08d142a(v0.0.4):Diff (applies to all four occurrences)
- uses: ambient-code/ambient-action@v0.0.4 + uses: ambient-code/ambient-action@1204c23cd7f193bd056c11d13634b3c5a08d142a🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/amber-issue-handler.yml at line 72, Replace the mutable tag usage ambient-code/ambient-action@v0.0.4 with the pinned commit SHA ambient-code/ambient-action@1204c23cd7f193bd056c11d13634b3c5a08d142a at every occurrence (the four places that currently reference ambient-code/ambient-action@v0.0.4) so the workflow uses the exact commit instead of a mutable tag.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/amber-issue-handler.yml:
- Around line 324-328: The case block incorrectly maps SESSION_PHASE "Running"
to a completed "success" CONCLUSION; change the logic to set a separate STATUS
(e.g., STATUS variable) and only set CONCLUSION when the session is finished:
for "Running" set STATUS="in_progress" and leave CONCLUSION empty/unset, for
"Completed" set STATUS="completed" and CONCLUSION="success", and for "Error" or
"Failed" set STATUS="completed" and CONCLUSION="failure"; update references to
SESSION_PHASE, CONCLUSION and any downstream use that posts the check to use
STATUS for posting status and CONCLUSION only when present.
---
Outside diff comments:
In @.github/workflows/amber-issue-handler.yml:
- Line 72: Replace the mutable tag usage ambient-code/ambient-action@v0.0.4 with
the pinned commit SHA
ambient-code/ambient-action@1204c23cd7f193bd056c11d13634b3c5a08d142a at every
occurrence (the four places that currently reference
ambient-code/ambient-action@v0.0.4) so the workflow uses the exact commit
instead of a mutable tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5ca5b1f1-69e4-4453-90b5-34e6e9ed5d2d
📒 Files selected for processing (1)
.github/workflows/amber-issue-handler.yml
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
API URL (e.g. https://api.ambient.ai/api) is not the frontend host. Use a separate PLATFORM_HOST secret for session links in Slack messages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Running session → in_progress check (was incorrectly success) - Only set conclusion when status is completed - Emit ::warning:: on check-run creation failure instead of || true - Batch post_check_run uses in_progress and PLATFORM_HOST for URL Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/amber-issue-handler.yml (1)
72-72: Pin first-party action to SHA for reproducibility.
ambient-code/ambient-action@v0.0.4uses a tag. While this is a first-party action, SHA pinning prevents drift if the tag is moved.- uses: ambient-code/ambient-action@v0.0.4 + uses: ambient-code/ambient-action@<full-sha-here> # v0.0.4Applies to all four uses (lines 72, 195, 247, 285). As per coding guidelines: "Pin action versions to SHA."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/amber-issue-handler.yml at line 72, Replace the tag-based action reference "ambient-code/ambient-action@v0.0.4" with the corresponding commit SHA to pin the action for reproducibility; update all occurrences of the string (the four uses of ambient-code/ambient-action) to the specific SHA form "ambient-code/ambient-action@<commit-sha>" so the workflow uses an immutable reference.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/amber-issue-handler.yml:
- Around line 460-462: The current check around the gh() call never triggers
because the boolean expression is malformed and also ignores stderr; change the
logic to detect failure by treating an empty result OR any "error" substring in
result.lower() as a failure and print the warning for that PR (i.e., replace the
condition with something like: if not result or "error" in result.lower()), and
update the gh invocation to capture stderr (or use the underlying subprocess
call with capture_output/stderr redirected into the captured output) so API
errors emitted to stderr are available in result for the string check;
reference: the gh() call, the result variable, and pr_number for the warning.
---
Nitpick comments:
In @.github/workflows/amber-issue-handler.yml:
- Line 72: Replace the tag-based action reference
"ambient-code/ambient-action@v0.0.4" with the corresponding commit SHA to pin
the action for reproducibility; update all occurrences of the string (the four
uses of ambient-code/ambient-action) to the specific SHA form
"ambient-code/ambient-action@<commit-sha>" so the workflow uses an immutable
reference.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 23666f18-3fad-4611-b4b4-e4e5e0b5e120
📒 Files selected for processing (1)
.github/workflows/amber-issue-handler.yml
Co-authored-by: ambient-code[bot] <235912155+ambient-code[bot]@users.noreply.github.com>
1 participant
[git remote -v]
[git config --get-regexp ^remote..*.gh-resolved$]
[git remote -v]
[git config --get-regexp ^remote..*.gh-resolved$]
[git remote -v]
[git config --get-regexp ^remote..*.gh-resolved$]
Summary
When Amber works on a PR, post a GitHub check run so the session shows up in the PR checks tab with a direct link to the session UI.
Where it posts
handle-commenton PR: After any@ambient-codecomment triggers a fix/custom sessionbatch-pr-fixer: After each PR is processed in the 30 min cronWhat it shows
Permissions
Added
checks: writeto workflow permissions.Test plan
@ambient-codeon a PR — verify check appears in PR checks tab🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Behavior Changes