feat: implement issue #833 — Migrate bare GH_PAT_WORKFLOWS refs to GH_PAT_DON_PETRY fallback (unblock secret retirement) - #834
Conversation
…_PAT_DON_PETRY fallback (unblock secret retirement)
|
Warning Review limit reached
Next review available in: 41 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe workflows now prefer ChangesPAT fallback migration
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new BATS test file reusable-secrets.bats to verify that the credential fallback wiring for the pr-review-mention-reusable.yml workflow correctly uses the canonical fallback secret across several steps. The review feedback suggests a best practice improvement to load the helper library inside a setup() function rather than at the top level of the test file to ensure a clean environment for each test case.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
There was a problem hiding this comment.
Pull request overview
This PR updates this repository’s GitHub Actions workflows to prefer the org-wide canonical PAT secret (GH_PAT_DON_PETRY) while retaining GH_PAT_WORKFLOWS as a fallback, enabling retirement of the legacy secret without changing runtime behavior.
Changes:
- Migrates bare
secrets.GH_PAT_WORKFLOWSusages to${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}across the targeted workflows. - Fixes the
auto-rebase-reusable.ymlHAS_PATboolean guard to use the combined fallback expression with required parentheses. - Adds a bats test to pin the fallback wiring for
GH_TOKENinsidepr-review-mention-reusable.yml.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
test/workflows/pr-review-mention/reusable-secrets.bats |
Adds assertions that key steps in the reusable use the canonical secret fallback for GH_TOKEN. |
.github/workflows/pr-review-mention-reusable.yml |
Updates GH_TOKEN env wiring to prefer GH_PAT_DON_PETRY with legacy fallback. |
.github/workflows/pr-auto-review.yml |
Updates the by-name secret pass-through value to use the canonical-first fallback chain (keeping the secret name GH_PAT_WORKFLOWS). |
.github/workflows/pinned-version-report.yml |
Updates GH_TOKEN to the canonical-first fallback chain for guard and report generation steps. |
.github/workflows/persona-mention-reusable.yml |
Updates GH_TOKEN to the canonical-first fallback chain. |
.github/workflows/initiative-planner-reusable.yml |
Updates GH_TOKEN to the canonical-first fallback chain in guard/trust/dispatch steps. |
.github/workflows/initiative-driver.yml |
Updates GH_TOKEN to the canonical-first fallback chain in guard and dispatch steps. |
.github/workflows/idea-triage-reusable.yml |
Updates GH_TOKEN to the canonical-first fallback chain in guard and dispatch steps. |
.github/workflows/idea-enhancer-reusable.yml |
Updates GH_TOKEN to the canonical-first fallback chain in guard and dispatch steps. |
.github/workflows/feature-ideation.yml |
Updates GH_TOKEN to the canonical-first fallback chain in redispatch steps. |
.github/workflows/daily-org-status.yml |
Updates GH_TOKEN to the canonical-first fallback chain for report generation and issue creation. |
.github/workflows/auto-rebase-reusable.yml |
Updates GH_TOKEN to prefer the canonical secret and fixes HAS_PAT to check the combined fallback expression. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #834 |
|
@coderabbitai review |
✅ Action performedReview finished.
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-rebase-reusable.yml:
- Around line 79-81: Remove the GH_PAT_DON_PETRY workflow_call.secrets
declaration from .github/workflows/auto-rebase-reusable.yml lines 79-81,
.github/workflows/idea-enhancer-reusable.yml lines 33-35,
.github/workflows/idea-triage-reusable.yml lines 30-32,
.github/workflows/initiative-planner-reusable.yml lines 36-38,
.github/workflows/persona-mention-reusable.yml lines 49-51, and
.github/workflows/pr-review-mention-reusable.yml lines 19-21; leave the existing
workflow secret usage and caller mappings unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 364ed12b-3720-4f98-bb09-e99b3d3cbbea
⛔ Files ignored due to path filters (2)
node_modules/.package-lock.jsonis excluded by!**/node_modules/**package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (12)
.github/workflows/auto-rebase-reusable.yml.github/workflows/daily-org-status.yml.github/workflows/feature-ideation.yml.github/workflows/idea-enhancer-reusable.yml.github/workflows/idea-triage-reusable.yml.github/workflows/initiative-driver.yml.github/workflows/initiative-planner-reusable.yml.github/workflows/persona-mention-reusable.yml.github/workflows/pinned-version-report.yml.github/workflows/pr-auto-review.yml.github/workflows/pr-review-mention-reusable.ymltest/workflows/pr-review-mention/reusable-secrets.bats
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
…tisfy actionlint Commit b225b70 removed these declarations in response to a CodeRabbit suggestion, but actionlint requires every secret referenced in a step env block to be declared in workflow_call.secrets — callers using secrets:inherit is not enough for static analysis. Restored as required:false in all 6 affected reusables so actionlint can resolve the type and the Lint check passes again. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #834 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
@coderabbitai resolve |
✅ Action performedComments resolved and changes approved. |
Dev-Lead — fix-reviews (no-changes)Agent reasoning |
Closes #833
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
Workflow Improvements
Tests