Conversation
…eate, add standards-conformance prompt rules
…re, document administration:write
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 8 minutes and 27 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughUpdated the Claude Code reusable workflow to expand administration token handling, enlarge the Changes
Sequence Diagram(s)sequenceDiagram
participant Repo as Repository (GitHub)
participant Workflow as GH Actions Workflow (claude-issue)
participant Claude as anthropics/claude-code-action
participant GHAPI as GitHub API / gh CLI
Workflow->>Claude: invoke standards check with claude_args
Claude->>GHAPI: call `gh` ops (e.g., `gh api:*`, `gh label create:*`, resolve refs)
GHAPI-->>Claude: return template contents / label results / commit SHAs
Claude-->>Workflow: produce findings and remediation actions
alt missing template or labels / fixes required
Workflow->>GHAPI: create labels / fetch templates / apply changes (uses GH_PAT_WORKFLOWS admin token)
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Encodes lessons learned from org-wide compliance automation into the org standards docs and the reusable Claude workflow prompt, aiming to prevent workflow/template drift and to avoid incorrect GitHub Action SHA pinning.
Changes:
- Add a “template-first” policy and SHA lookup recipes to
standards/ci-standards.md, plus update the Claude Code permissions guidance. - Add an “Organization Standards” cross-reference section to
AGENTS.md. - Extend the reusable Claude workflow (
claude-code-reusable.yml) withadministration: write, expanded--allowedTools, and additional prompt rules.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
standards/ci-standards.md |
Adds template-first guidance + SHA lookup section; updates Claude permissions table and adds explanatory note. |
AGENTS.md |
Adds a top-level “Organization Standards” section with canonical links to standards. |
.github/workflows/claude-code-reusable.yml |
Adds admin permission, expands tool allowlist, and strengthens the automation prompt rules. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| scratch. Available templates: `agent-shield.yml`, `claude.yml`, | ||
| `dependabot-automerge.yml`, `dependabot-rebase.yml`, | ||
| `dependency-audit.yml`, `feature-ideation.yml`. Fetch via: | ||
| `gh api repos/petry-projects/.github/contents/standards/workflows/<file>.yml --jq '.content' | base64 -d` |
There was a problem hiding this comment.
The new prompt suggests fetching workflow templates via the contents API and piping through base64 -d, but base64 isn't included in --allowedTools (only gh api is). Either allow Bash(base64:*) (and likely redirection) or change the suggested fetch command to use gh api -H "Accept: application/vnd.github.raw" ... > .github/workflows/<file>.yml so it works with the current tool allowlist.
| `gh api repos/petry-projects/.github/contents/standards/workflows/<file>.yml --jq '.content' | base64 -d` | |
| `gh api -H "Accept: application/vnd.github.raw" repos/petry-projects/.github/contents/standards/workflows/<file>.yml > .github/workflows/<file>.yml` |
standards/ci-standards.md
Outdated
| > labels) require manual human action. The grant only takes effect on the | ||
| > `claude-issue` job in the reusable workflow — repo-level callers don't | ||
| > need to set it themselves because they use `secrets: inherit` and inherit | ||
| > the called workflow's permission shape via the intersection rule. |
There was a problem hiding this comment.
This note describes the reusable-workflow permissions model incorrectly. For workflow_call, the called workflow’s GITHUB_TOKEN permissions are the intersection of (a) the caller job’s permissions and (b) the called workflow job’s permissions — so adding administration: write only in the reusable workflow will NOT take effect unless caller workflows also grant administration: write on the uses: job. secrets: inherit does not impact token permissions. Recommend updating the note and ensuring the standards/workflows/claude.yml template (and this repo’s .github/workflows/claude.yml) include administration: write when the automation job needs it.
| > labels) require manual human action. The grant only takes effect on the | |
| > `claude-issue` job in the reusable workflow — repo-level callers don't | |
| > need to set it themselves because they use `secrets: inherit` and inherit | |
| > the called workflow's permission shape via the intersection rule. | |
| > labels) require manual human action. For reusable workflows invoked via | |
| > `workflow_call`, the effective `GITHUB_TOKEN` permissions are the | |
| > intersection of the caller job's `permissions` and the called workflow | |
| > job's `permissions`, so adding `administration: write` only in the reusable | |
| > workflow is not sufficient. Caller workflows must also grant | |
| > `administration: write` on the `uses:` job when this automation needs | |
| > repo-level administration access. `secrets: inherit` passes secrets only | |
| > and does not affect token permissions. |
| | Template | Purpose | | ||
| |----------|---------| | ||
| | [`agent-shield.yml`](workflows/agent-shield.yml) | Deep agent-config security scan via `ecc-agentshield` | | ||
| | [`claude.yml`](workflows/claude.yml) | Thin caller delegating to the org-level reusable Claude Code workflow | | ||
| | [`dependabot-automerge.yml`](workflows/dependabot-automerge.yml) | Auto-approve and squash-merge eligible Dependabot PRs | | ||
| | [`dependabot-rebase.yml`](workflows/dependabot-rebase.yml) | Rebase Dependabot PRs on demand | | ||
| | [`dependency-audit.yml`](workflows/dependency-audit.yml) | Multi-ecosystem audit (npm, pnpm, gomod, cargo, pip) | | ||
| | [`feature-ideation.yml`](workflows/feature-ideation.yml) | BMAD Method ideation pipeline (BMAD-enabled repos only) | |
There was a problem hiding this comment.
claude.yml is described here as a “thin caller delegating to the org-level reusable Claude Code workflow”, but the actual standards/workflows/claude.yml file currently contains the full workflow (it runs anthropics/claude-code-action directly rather than uses: .../claude-code-reusable.yml). This mismatch will confuse consumers and undermines the new “copy templates verbatim” rule; either update the template to match the thin-caller model or adjust this description to match reality.
| you're adding, **copy it verbatim** rather than writing from | ||
| scratch. Available templates: `agent-shield.yml`, `claude.yml`, | ||
| `dependabot-automerge.yml`, `dependabot-rebase.yml`, | ||
| `dependency-audit.yml`, `feature-ideation.yml`. Fetch via: | ||
| `gh api repos/petry-projects/.github/contents/standards/workflows/<file>.yml --jq '.content' | base64 -d` | ||
| Adapt only when the file genuinely needs repo-specific content. |
There was a problem hiding this comment.
Similarly, this prompt lists claude.yml as one of the standards/workflows/ templates to copy verbatim, but standards/workflows/claude.yml is not currently a thin caller (it runs the Claude action directly). That makes the instruction ambiguous for repos trying to follow the new “template-first” rule; align the prompt with the actual template, or update the template to match the reusable-workflow delegation model.
| you're adding, **copy it verbatim** rather than writing from | |
| scratch. Available templates: `agent-shield.yml`, `claude.yml`, | |
| `dependabot-automerge.yml`, `dependabot-rebase.yml`, | |
| `dependency-audit.yml`, `feature-ideation.yml`. Fetch via: | |
| `gh api repos/petry-projects/.github/contents/standards/workflows/<file>.yml --jq '.content' | base64 -d` | |
| Adapt only when the file genuinely needs repo-specific content. | |
| you're adding, use that template instead of writing from scratch. | |
| Available templates: `agent-shield.yml`, `claude.yml`, | |
| `dependabot-automerge.yml`, `dependabot-rebase.yml`, | |
| `dependency-audit.yml`, `feature-ideation.yml`. Fetch via: | |
| `gh api repos/petry-projects/.github/contents/standards/workflows/<file>.yml --jq '.content' | base64 -d` | |
| For `claude.yml`, copy the standard thin caller template and keep | |
| it delegating to the reusable Claude workflow rather than running | |
| the Claude action inline. Adapt templates only when the file | |
| genuinely needs repo-specific content. |
| issues: write | ||
| actions: read | ||
| checks: read | ||
| administration: write | ||
| steps: |
There was a problem hiding this comment.
Adding administration: write here will only affect the job-scoped GITHUB_TOKEN. In this job the action later receives github_token: ${{ secrets.GH_PAT_WORKFLOWS }} (a separate PAT), so unless that PAT is guaranteed to be present and to have equivalent admin capabilities, the new permission may not actually enable label/ruleset/discussions changes. Consider having the action default to ${{ secrets.GH_PAT_WORKFLOWS || github.token }} (or documenting that the PAT must include admin-level scopes) so the permission grant is effective.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/claude-code-reusable.yml:
- Line 69: The reusable workflow requests administration: write but the caller
job doesn't grant it; update the caller workflow (.github/workflows/claude.yml)
to add administration: write to the permissions block for the claude-code job so
the intersection of permissions includes admin scope; locate the claude-code job
in claude.yml and add the administration: write permission alongside the
existing contents: write and id-token: write entries to ensure admin-scoped
operations in claude-code can execute.
In `@AGENTS.md`:
- Line 24: The AGENTS.md line violating MD013 exceeds the configured max line
length; edit AGENTS.md and reflow/wrap the long sentence on Line 24 into shorter
lines (preserving the exact wording and punctuation) so each line is within the
repo's markdown max-length limit to satisfy MD013 — do not rewrite content or
change the template semantics, only insert line breaks to wrap the existing
sentence.
In `@standards/ci-standards.md`:
- Around line 641-648: Update the note to correctly state GitHub Actions
permission behavior: clarify that the reusable workflow's job (e.g., the
claude-issue job) requesting administration: write is necessary but not
sufficient — the calling job must also explicitly grant administration: write on
its GITHUB_TOKEN (callers cannot be elevated by the callee). Replace the
assertion about "secrets: inherit" and the "intersection rule" granting the
scope with guidance that both the reusable workflow and any caller must declare
administration: write on their respective jobs to allow repo-level changes
(labels, rulesets, Discussions).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4fcee896-7f9c-4fcc-8960-a15b4743307f
📒 Files selected for processing (3)
.github/workflows/claude-code-reusable.ymlAGENTS.mdstandards/ci-standards.md
| issues: write | ||
| actions: read | ||
| checks: read | ||
| administration: write |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking Claude workflow permission scopes..."
for f in .github/workflows/claude-code-reusable.yml .github/workflows/claude.yml standards/workflows/claude.yml; do
if [ -f "$f" ]; then
echo
echo "=== $f ==="
rg -n -C2 "permissions:|administration:" "$f" || true
fi
done
echo
echo "Expected:"
echo "- administration: write present in reusable workflow job"
echo "- administration: write ALSO present in caller/template workflow job permissions"Repository: petry-projects/.github
Length of output: 2068
administration: write on line 69 will not be effective unless the caller workflow also grants it.
The reusable workflow declares administration: write, but the caller (.github/workflows/claude.yml) still only grants contents: write, id-token: write, and related scopes. GitHub Actions enforces the intersection of caller-granted and callee-requested permissions, so any admin-scoped operations in claude-code will be constrained.
Update .github/workflows/claude.yml to include administration: write in the permissions section of the claude-code job.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-reusable.yml at line 69, The reusable workflow
requests administration: write but the caller job doesn't grant it; update the
caller workflow (.github/workflows/claude.yml) to add administration: write to
the permissions block for the claude-code job so the intersection of permissions
includes admin scope; locate the claude-code job in claude.yml and add the
administration: write permission alongside the existing contents: write and
id-token: write entries to ensure admin-scoped operations in claude-code can
execute.
… document GH_PAT_WORKFLOWS as the actual mechanism
…xplanation of how admin ops actually work via GH_PAT_WORKFLOWS
|
Why
After running the bulk compliance-issue automation across all 7 repos, a careful review of the resulting 12 PRs surfaced systemic problems in how Claude was approaching standards-conformance fixes:
Cargo.tomlin the repo) so the bad SHA was never executed.stable.standards/workflows/templatesecc-agentshieldscan) and a 25-linedependency-review-action(vs the 218-line multi-ecosystem audit standard)..github/workflows/*.ymlto scan theactionsecosystem; Claude only configuredjavascript-typescript.administration: writenot granted to claude-issue jobWhat this PR changes
1.
.github/workflows/claude-code-reusable.ymladministration: writeto theclaude-issuejob permissions so Claude can autonomously create labels, rulesets, and enable DiscussionsBash(gh api:*)andBash(gh label create:*)to--allowedToolsso Claude can fetch templates and look up SHAs2.
standards/ci-standards.mdstandards/workflows/" establishing the rule and listing all available templatesgh apirecipes for tags, branches, and SHA verificationadministration: writeto the Claude Code row, with an explanatory note about how it propagates from the reusable workflow3.
AGENTS.mdpetry-projects/.githubonce in passing (line 694), failing the spirit of the AgentShield cross-reference checkTest plan
claudelabel on one closed compliance issue (e.g. TalkTerm#74 agent-shield) as a canarystandards/workflows/agent-shield.ymlviagh apiinstead of generating from scratch, (b) produces a PR matching the template byte-for-byteSummary by CodeRabbit
Documentation
Chores