feat(ci): add common factory guardrails#480
Conversation
dosubot
Bot
added
size:L
|
Warning Review limit reached
More reviews will be available in 52 minutes and 24 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
📝 WalkthroughWalkthroughRefactors CI to centralize the external testsuite into a repo-local reusable wrapper, updates E2E jobs to call that wrapper, adds a promotion-candidate E2E workflow and a skill-drift PR gate, replaces the image-ref guard with a Python validator, and updates documentation to reflect the new three-layer model. ChangesCI Workflow Refactoring and Testing Gates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/validate.yml (1)
58-98:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winCritical: Validation script scans itself and fails.
The Python validator scans all
.github/workflows/*.ymlfiles, includingvalidate.ymlitself. The regex pattern matches the hardcoded testing-tag strings in the allowlist definition (lines 69-70) and the error message (line 95). Since those matches are not frompromotion-candidate-e2e.yml, they fail the allowlist check and trigger violations.This is causing the pipeline failure.
🐛 Proposed fix: exclude validate.yml from scanning
pattern = re.compile(r"ghcr\.io/projectbluefin/(bluefin|aurora|bazzite)(?::[A-Za-z0-9._-]+)?") candidates = list(Path(".github/workflows").rglob("*.yml")) candidates += list(Path(".github/workflows").rglob("*.yaml")) +candidates = [p for p in candidates if p.name != "validate.yml"] candidates.append(Path("system_files/bluefin/usr/bin/ublue-rollback-helper"))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/validate.yml around lines 58 - 98, The validator is currently scanning its own workflow file and matching the allowlist strings; update the candidate collection/filtering so Path(".github/workflows/validate.yml") is excluded (or generally skip the running script file) before iterating lines. In the inline script that builds candidates (the code around candidates = list(Path(".github/workflows").rglob("*.yml")) / candidates += list(Path(".github/workflows").rglob("*.yaml")) and the loop that checks allowed_refs and pattern), filter out the validate.yml path (or any file equal to the script's path) so the allowlist strings and error text in validate.yml won't be treated as violations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/validate.yml:
- Around line 58-98: The validator is currently scanning its own workflow file
and matching the allowlist strings; update the candidate collection/filtering so
Path(".github/workflows/validate.yml") is excluded (or generally skip the
running script file) before iterating lines. In the inline script that builds
candidates (the code around candidates =
list(Path(".github/workflows").rglob("*.yml")) / candidates +=
list(Path(".github/workflows").rglob("*.yaml")) and the loop that checks
allowed_refs and pattern), filter out the validate.yml path (or any file equal
to the script's path) so the allowlist strings and error text in validate.yml
won't be treated as violations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b3f5c873-4bf5-4a2d-b7f5-a632d9baca83
📒 Files selected for processing (14)
.github/workflows/e2e.yml.github/workflows/pr-e2e.yml.github/workflows/promotion-candidate-e2e.yml.github/workflows/run-testsuite.yml.github/workflows/skill-drift.yml.github/workflows/validate.ymlAGENTS.mdREADME.mddocs/factory/README.mddocs/skills/INDEX.mddocs/skills/acmm-audit-level1.mddocs/skills/ci-tooling.mddocs/skills/e2e-ci.mddocs/skills/image-registry.md
castrojo
force-pushed
the
feat/acmm-common-guardrails
branch
from
a7533e5 to
894f86a
Compare
Assisted-by: GPT-5.4 via Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: GPT-5.4 via Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: GPT-5.4 via GitHub Copilot CLI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
castrojo
force-pushed
the
feat/acmm-common-guardrails
branch
from
894f86a to
3da0061
Compare
1 participant
What changed
Validation
Summary by CodeRabbit
New Features
Improvements