feat: implement issue #324 — Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push - #353
Conversation
…miss_stale_reviews_on_push
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughAdds an executable Bash script that idempotently creates or updates the ChangesPR quality ruleset
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow
participant apply-repo-settings.sh
participant apply-pr-quality-ruleset.sh
participant GitHubAPI
Workflow->>apply-repo-settings.sh: Run after relevant script changes
apply-repo-settings.sh->>apply-pr-quality-ruleset.sh: Apply pr-quality ruleset
apply-pr-quality-ruleset.sh->>GitHubAPI: Discover and upsert ruleset
GitHubAPI-->>apply-pr-quality-ruleset.sh: Return API result
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a shell script to idempotently manage the pr-quality repository ruleset for the petry-projects/markets repository, along with a suite of BATS tests to verify the script's configuration. The review feedback suggests removing error-masking redirections (2>/dev/null || true) from the GitHub API call to allow the script to fail fast on errors. Additionally, the feedback recommends replacing fragile exact string matches and non-portable \s regular expressions in the BATS tests with more resilient and portable [[:space:]]* patterns to ensure compatibility across macOS and Linux environments.
There was a problem hiding this comment.
Pull request overview
Implements repo-local compliance remediation for issue #324 by adding an idempotent script to create/update the pr-quality GitHub ruleset for petry-projects/markets, and a Bats test suite to statically assert the codified parameters (including dismiss_stale_reviews_on_push: true).
Changes:
- Added
.github/scripts/apply-pr-quality-ruleset.shto apply thepr-qualityruleset viagh apiwith ajq-constructed payload matching the org standard. - Added
.github/scripts/tests/apply-pr-quality-ruleset.batsto validate key ruleset parameters without live API calls.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/scripts/apply-pr-quality-ruleset.sh | Adds an idempotent repo-local script to create/update the pr-quality ruleset (including dismiss_stale_reviews_on_push: true). |
| .github/scripts/tests/apply-pr-quality-ruleset.bats | Adds Bats tests that assert the script contains the expected ruleset settings. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/tests/apply-pr-quality-ruleset.bats:
- Around line 19-49: Update the tests targeting the repository and ruleset
settings to match executable configuration lines rather than comments: anchor
the repository assertion to the REPO assignment and each payload assertion to
its property line, including the existing checks for
dismiss_stale_reviews_on_push, required approvals, code-owner review, thread
resolution, last-push approval, and allowed merge methods. Keep the current
expected values unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1c102832-22b9-487e-83dd-368aa20244d8
📒 Files selected for processing (2)
.github/scripts/apply-pr-quality-ruleset.sh.github/scripts/tests/apply-pr-quality-ruleset.bats
Dev-Lead — review-changes (applied)Changes committed and pushed. |
🤖 CodeAnt AI — Review Status
|
codeant-ai
Bot
added
the
size:L
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #353 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — fix-reviews (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 618baaf41f2a17236ccf604ff39c5ff818763f05
Review mode: triage-approved (single reviewer)
Summary
Adds an idempotent script codifying the pr-quality ruleset for petry-projects/markets (fixing the dismiss_stale_reviews_on_push drift from issue #324), wires it into apply-repo-settings.sh and the workflow path triggers, and adds bats tests. The payload matches the org standard standards/rulesets/pr-quality.json exactly.
Linked issue analysis
Issue #324 (compliance audit) flagged that the pr-quality ruleset parameter dismiss_stale_reviews_on_push drifted to false. This PR substantively addresses it: apply-pr-quality-ruleset.sh sets dismiss_stale_reviews_on_push: true and reproduces the codified standard byte-for-byte (parameters, conditions, bypass_actors incl. OrganizationAdmin + Integration 3167543), so the repo-local fallback cannot re-introduce drift.
Findings
- Ruleset payload verified identical to the source-of-truth standard (petry-projects/.github/standards/rulesets/pr-quality.json), including bypass actors.
- Script handles the create/update race: on POST 422 conflict it re-fetches the existing ruleset ID and falls back to PUT.
- All 10 review threads (gemini, copilot, coderabbit, codeant) are resolved; prior feedback on test fragility and concurrency was addressed in later commits.
- Workflow change is a path-trigger addition only; permissions: {} unchanged. No GitHub Actions security smells.
- Secret scanning MCP tool not available in this run; the gitleaks CI check passed. No secrets in the diff (GH_TOKEN is read from the environment, never printed).
- Minor (non-blocking): bats tests assert on script text via grep rather than executing the payload; acceptable for static guardrail tests and consistent with the existing apply-repo-settings.bats pattern.
CI status
Green on head commit 618baaf: CodeQL, Secret scan (gitleaks), SonarCloud, agent-shield, CodeRabbit, Graphite AI Reviews all SUCCESS. Backend/Frontend CI and dependency audits SKIPPED (no matching paths/ecosystems). CANCELLED entries are superseded dev-lead orchestration reruns; the latest run of each is SUCCESS/SKIPPED. Branch is BEHIND main but MERGEABLE.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
codeant-ai
Bot
added
size:L
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/apply-repo-settings.yml (1)
32-32: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winDisable default checkout credential persistence.
actions/checkoutpersists the provided token by default. This workflow only runs authenticated GitHub API calls viaGH_TOKEN_ADMIN, not authenticated Git commands, so setpersist-credentials: falseto reduce credential exposure in later workspace or artifact handling.Proposed fix
- uses: Vercel/move-files-action@a32a8bca44959cdbeec29df7fa93adfa6a95a7 # [version] + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/apply-repo-settings.yml at line 32, Update the actions/checkout step in the workflow to set persist-credentials to false, while leaving the existing checkout version and GH_TOKEN_ADMIN-based API authentication unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/apply-repo-settings.yml:
- Line 32: Update the actions/checkout step in the workflow to set
persist-credentials to false, while leaving the existing checkout version and
GH_TOKEN_ADMIN-based API authentication unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e991312a-7b43-4782-a5ea-9cd748628a9d
📒 Files selected for processing (5)
.github/scripts/apply-pr-quality-ruleset.sh.github/scripts/apply-repo-settings.sh.github/scripts/tests/apply-pr-quality-ruleset.bats.github/scripts/tests/apply-repo-settings.bats.github/workflows/apply-repo-settings.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/scripts/tests/apply-pr-quality-ruleset.bats
User description
Closes #324
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
New Features
Tests
CodeAnt-AI Description
Enforce current pull request review and merge requirements for the default branch
What Changed
Impact
✅ Fewer stale approvals on changed pull requests✅ Stronger review compliance before merging✅ Consistent squash-only merges💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.