fix(standards): pin auto-rebase stub to SHA to satisfy SonarCloud security gate#166
fix(standards): pin auto-rebase stub to SHA to satisfy SonarCloud security gate#166don-petry wants to merge 26 commits into
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughPins the reusable workflow reference used by the ChangesWorkflow Pinning
Compliance Audit & Detection
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates the canonical auto-rebase.yml thin-stub workflow to reference the reusable workflow via an immutable commit SHA (with a # v1 comment) instead of the mutable @v1 tag, to satisfy SonarCloud’s security gate.
Changes:
- Replaced
uses: ...@v1withuses: ...@<sha> # v1in theauto-rebase.ymlstandards stub.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) | ||
| pull-requests: write # post comments on PRs | ||
| uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1 | ||
| uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@126c1441ee9cf040f2ce3ef0eda85d459b82f8e9 # v1 |
There was a problem hiding this comment.
This change updates the canonical stub to a SHA-pinned uses: reference, but the compliance audit still hard-codes @v1 as the only acceptable pattern (see scripts/compliance-audit.sh check_centralized_workflow_stubs, which matches ...@v1 exactly). As-is, repos that adopt this updated stub will be flagged as non-compliant. Update the audit check to accept the SHA-pinned form (optionally with a trailing # v1 comment) or to compare against the canonical stub content instead of @v1.
| contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) | ||
| pull-requests: write # post comments on PRs | ||
| uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1 | ||
| uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@126c1441ee9cf040f2ce3ef0eda85d459b82f8e9 # v1 |
There was a problem hiding this comment.
Documentation now becomes stale: standards/ci-standards.md currently states the canonical stub delegates to .../auto-rebase-reusable.yml@v1 (around line 514), but this file now uses a SHA. Please update the doc reference to match the new canonical format so adopters and the standard remain consistent.
| uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@126c1441ee9cf040f2ce3ef0eda85d459b82f8e9 # v1 | |
| uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@126c1441ee9cf040f2ce3ef0eda85d459b82f8e9 # pinned SHA |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@claude Please address all open review comments on this PR from CodeRabbit and Copilot. |
|
Claude finished @don-petry's task in 2m 25s —— View job Addressing Copilot Review Comments
Both Copilot issues are resolved in commit 1. Updated to accept two canonical forms:
The function comment block, the compliance logic, and the 2. Updated the
|
…check The canonical auto-rebase.yml stub now uses a SHA-pinned `uses:` reference instead of the mutable `@v1` tag. Update `check_centralized_workflow_stubs` to accept both `@<40-hex-SHA>` (preferred, satisfies SonarCloud) and `@v1` (legacy, still accepted for backwards compat). Update error messages and the function docblock accordingly. Also update `standards/ci-standards.md` line 514 to document the new preferred SHA-pinned format. Addresses Copilot review comments on PR #166. Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/compliance-audit.sh`:
- Around line 711-716: The check_centralized_workflow_stubs routine currently
treats any 40-hex SHA as acceptable (the grep using ${base}@[0-9a-f]{40}), which
allows stale SHAs to pass; instead, load the canonical `uses:` reference (exact
string including the expected SHA) from standards/workflows/${wf} (or an
explicit expected-SHA map) and compare decoded lines exactly against that
canonical reference (or map entry) rather than accepting any SHA-shaped value;
update the logic around the checks that use variables decoded and base in
check_centralized_workflow_stubs to read the canonical expected value and only
continue when decoded matches that exact canonical `uses:` reference.
In `@standards/ci-standards.md`:
- Line 514: The standards text is contradictory about pinning reusable workflow
refs: update the policy so a single unambiguous rule is stated (e.g.,
"SHA-pinned refs are preferred; `@v1/`@main are allowed only for backwards
compatibility"), reconcile the paragraph for check_centralized_workflow_stubs
and the auto-rebase.yml guidance to match that rule, explicitly call out any
per-workflow exceptions (e.g., claude.yml) and where to use tag-based refs, and
update examples that reference
petry-projects/.github/.github/workflows/auto-rebase-reusable.yml and `@v1/`@main
to follow the unified wording.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2752d557-3598-4291-a2bd-9865303ded91
📒 Files selected for processing (2)
scripts/compliance-audit.shstandards/ci-standards.md
|
@claude This PR has 4 unresolved review threads. The two Copilot threads from 2026-04-28 predate the
Push the changes and resolve the threads. Generated by Claude Code |
|
Claude finished @don-petry's task in 13m 34s —— View job Addressing 4 unresolved review threads
Push failed — action neededThe push was rejected because the auto-rebase workflow fired during this run (a Dependabot bump merged to Fix: add # In .github/workflows/claude-code-reusable.yml, claude job, Run Claude Code step:
claude_args: |
--allowedTools "Bash(git pull:*)"Then re-trigger with Changes ready to apply (commit
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
…check The canonical auto-rebase.yml stub now uses a SHA-pinned `uses:` reference instead of the mutable `@v1` tag. Update `check_centralized_workflow_stubs` to accept both `@<40-hex-SHA>` (preferred, satisfies SonarCloud) and `@v1` (legacy, still accepted for backwards compat). Update error messages and the function docblock accordingly. Also update `standards/ci-standards.md` line 514 to document the new preferred SHA-pinned format. Addresses Copilot review comments on PR #166. Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
don-petry
force-pushed
the
fix/auto-rebase-stub-sha-pin
branch
from
9001e6a to
5b0640c
Compare
Superseded by automated re-review at
|
Review — fix requested (cycle 2/3)The automated review identified the following issues. Please address each one: Findings to fix[Findings would be inserted here] Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
@dev-lead - please fix this PR |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
Summary
auto-rebase.ymlstub instandards/workflows/to use SHA-pinned format with version comment instead of the mutable@v1tag@v1(mutable tag — SonarCloud Security Hotspot)@126c1441ee9cf040f2ce3ef0eda85d459b82f8e9 # v1(immutable SHA + readable version comment)v1tag resolve to the same commit — this is a reference format change onlyWhy
The previous canonical stub used
@v1. Repos adopting this stub (e.g. bmad-bgreat-suite PR #129) were passing thenon-stub-auto-rebase.ymlcompliance check but failing the SonarCloud security gate, which flags mutable tag references inuses:lines as Security Hotspots (supply-chain risk).SHA-pinned references satisfy both:
Follow-up
Once this merges, bmad-bgreat-suite PR #129's branch will be updated to
@SHA # v1to match the new canonical stub and clear its SonarCloud failure.Test plan
non-stub-auto-rebase.ymlcompliance check passes (stub matches updated template)🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Chores
Documentation