chore: sync workflow templates - #344
Conversation
Automated sync from stranske/Workflows Template hash: c6b722d74cfd Changes synced from sync-manifest.yml
stranske
added
sync
📝 WalkthroughWalkthroughAdds a dependency-only authorization bypass to ChangesDependency-only bypass in agents-guard
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Workflow state fingerprint for Keepalive Loop Reporter. Do not edit. |
GitHub Actions
Failure
|
Workflow state fingerprint for Agents Gate Followups. Do not edit. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/agents-guard.js:
- Around line 616-620: The guard enforcement for protected files only checks for
modifications via the modifiedProtectedPaths check and the filter condition on
line 617-620 that uses file.status === 'modified'. This misses protected files
that are newly added to the PR, allowing them to bypass the approval gate. To
fix this, update the filter condition to include both modified and added files
by checking file.status === 'modified' || file.status === 'added' when
evaluating protectedChangesAreDependencyOnly. Additionally, ensure that
hasProtectedChanges accounts for both added and modified protected paths. Apply
the same fix to the similar logic mentioned at lines 633-637.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 649005c5-a5e9-4642-b7e3-3699299de700
📒 Files selected for processing (3)
.github/scripts/agents-guard.js.github/workflows/agents-guard.ymlWORKFLOW_USER_GUIDE.md
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (6)
{pyproject.toml,.github/workflows/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
{pyproject.toml,.github/workflows/*.{yml,yaml}}: For Python projects with coverage thresholds, ensure bothpyproject.toml([tool.coverage.report] fail_under) and workflow files have matchingcoverage-minsettings, or the lower one will determine the actual threshold
The Manager-Database repository has a coverage threshold of 75%
Files:
.github/workflows/agents-guard.yml
.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For GitHub Actions workflow
startup_failureerrors, check for invalid YAML syntax, invalidpermissions:block inworkflow_callreusable workflows, invalid permission scopes, or circular workflow references
Files:
.github/workflows/agents-guard.yml
.github/workflows/**/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-guard.yml
.github/workflows/agents-*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Agent workflow files (
agents-*.yml) should be fixed instranske/Workflows, not locally
Files:
.github/workflows/agents-guard.yml
**/.github/workflows/*.yml
📄 CodeRabbit inference engine (AGENTS.md)
Reference reusable workflows in first-party consumers with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason
Files:
.github/workflows/agents-guard.yml
**/.github/workflows/agents-*.yml
📄 CodeRabbit inference engine (AGENTS.md)
agents-*.ymlworkflow files should be fixed in stranske/Workflows, not in the consumer repo
Files:
.github/workflows/agents-guard.yml
🔀 Multi-repo context stranske/Workflows
Based on my exploration of the stranske/Workflows repository, I've identified the cross-repository context relevant to this PR sync.
Linked repositories findings
stranske/Workflows [::stranske/Workflows::]
API Changes in agents-guard.js:
-
Function signature update [::stranske/Workflows::]
evaluateGuard()now accepts a new optional parameterauthorAssociation(default:'')- Location:
.github/scripts/agents-guard.js:478-489 - The parameter is normalized and used to check against
TRUSTED_DEPENDENCY_AUTHOR_ASSOCIATIONS
-
New module exports [::stranske/Workflows::]
patchChangesOnlyActionReferencesis now exported frommodule.exports- Location:
.github/scripts/agents-guard.js(end of file) - This helper function parses
uses:action references from diff lines
-
New return value fields [::stranske/Workflows::]
evaluateGuard()return object now includes:hasDependencyUpgradeBypass(boolean)protectedChangesAreDependencyOnly(boolean)isDependencyUpdateBot(boolean)authorCanUseDependencyBypass(boolean)
- Location:
.github/scripts/agents-guard.js:709-733
-
New authorization constants [::stranske/Workflows::]
DEPENDENCY_UPDATE_BOT_LOGINS = new Set(['dependabot[bot]', 'renovate[bot]'])TRUSTED_DEPENDENCY_AUTHOR_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR'])- Location:
.github/scripts/agents-guard.js(early in file)
Workflow Integration:
The agents-guard.yml workflow now [::stranske/Workflows::]
- Extracts
author_associationfromcontext.payload.pull_request.author_association - Passes it as
authorAssociationtoevaluateGuard() - Location:
.github/workflows/agents-guard.yml:203-204, 417
Test Coverage: [::stranske/Workflows::]
The repository includes comprehensive tests in tests/workflows/test_agents_guard.py:
test_dependency_bot_action_version_update_with_label_passes()(line 378)test_owner_action_version_update_with_label_passes_without_personal_codeowner()(line 400)- Tests verify that dependency-bot PRs and OWNER-associated PRs can bypass CODEOWNER approval when
agents:allow-changelabel is present and changes are dependency-only
Documentation Updates: [::stranske/Workflows::]
templates/consumer-repo/WORKFLOW_USER_GUIDE.md:168clarifies thatagents:allow-changebypasses CODEOWNER approval only for dependency-onlyuses:reference updates from Dependabot/Renovate or owner/member/collaborator PRstemplates/consumer-repo/docs/LABELS.md:605-622documents the label behavior- Reference to
maint-auto-label-dep-prs.ymlwhich auto-applies the label to dependency-bot PRs
Impact Assessment:
The changes are backward-compatible because:
- The new
authorAssociationparameter has a default empty string value - Existing callers of
evaluateGuard()will continue to work without modification - The new return fields are additive and don't break existing consumers
Consumers of this template need to verify:
- Workflow evaluation logic correctly passes
author_associationfrom the GitHub context - Any custom bypass logic is compatible with the new dependency-only bypass mechanism
- CODEOWNER configuration matches the protected paths expectations
🔇 Additional comments (2)
.github/workflows/agents-guard.yml (1)
211-212: LGTM!Also applies to: 425-425
WORKFLOW_USER_GUIDE.md (1)
168-168: LGTM!Also applies to: 853-853
| const hasProtectedChanges = modifiedProtectedPaths.size > 0; | ||
| // Security note: Allow `agents:allow-change` label to bypass CODEOWNER approval | ||
| // ONLY for automated dependency PRs from known bots (dependabot, renovate). | ||
| // Human PRs or other bot PRs still require CODEOWNER approval even with label. | ||
| const isAutomatedPR = normalizedAuthor && (normalizedAuthor === 'dependabot[bot]' || normalizedAuthor === 'renovate[bot]'); | ||
| const needsApproval = hasProtectedChanges && !hasCodeownerApproval && !(hasAllowLabel && isAutomatedPR); | ||
| const protectedChangesAreDependencyOnly = hasProtectedChanges && relevantFiles | ||
| .filter((file) => file.status === 'modified' && matchProtectedPath(file.filename || '')) | ||
| .every((file) => patchChangesOnlyActionReferences(file.patch || '')); | ||
| const isDependencyUpdateBot = Boolean( |
There was a problem hiding this comment.
Protected workflow file additions are not guarded by the new bypass gate
Line 616 keys guard enforcement off modifiedProtectedPaths, and Line 617-620 only inspects modified protected files for dependency-only diffs. A protected file added in the PR is excluded from both checks, so it can pass without CODEOWNER approval (and can be bundled with dependency-only edits without breaking the bypass lane).
Suggested fix
- if (status === 'modified') {
+ if (status === 'modified' || status === 'added') {
modifiedProtectedPaths.add(protectedPath);
}
- const hasProtectedChanges = modifiedProtectedPaths.size > 0;
- const protectedChangesAreDependencyOnly = hasProtectedChanges && relevantFiles
- .filter((file) => file.status === 'modified' && matchProtectedPath(file.filename || ''))
- .every((file) => patchChangesOnlyActionReferences(file.patch || ''));
+ const protectedChangedFiles = relevantFiles.filter((file) =>
+ (file.status === 'modified' || file.status === 'added') &&
+ matchProtectedPath(file.filename || '')
+ );
+ const hasProtectedChanges = protectedChangedFiles.length > 0;
+ const protectedChangesAreDependencyOnly = hasProtectedChanges &&
+ protectedChangedFiles.every((file) =>
+ file.status === 'modified' && patchChangesOnlyActionReferences(file.patch || '')
+ );Also applies to: 633-637
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/agents-guard.js around lines 616 - 620, The guard
enforcement for protected files only checks for modifications via the
modifiedProtectedPaths check and the filter condition on line 617-620 that uses
file.status === 'modified'. This misses protected files that are newly added to
the PR, allowing them to bypass the approval gate. To fix this, update the
filter condition to include both modified and added files by checking
file.status === 'modified' || file.status === 'added' when evaluating
protectedChangesAreDependencyOnly. Additionally, ensure that hasProtectedChanges
accounts for both added and modified protected paths. Apply the same fix to the
similar logic mentioned at lines 633-637.
1 participant
Sync Summary
Files Updated
Files Skipped
Review Checklist
Source: stranske/Workflows
Source SHA:
5d306dbf622f81baba35684f8f03fdad013da942Template hash:
c6b722d74cfdSync branch:
sync/workflows-c6b722d74cfdConsumer repo:
stranske/ReadyManifest:
.github/sync-manifest.ymlSummary by CodeRabbit
Documentation
agents:allow-changelabel now bypasses code owner approval requirements specifically for dependency-only updates sourced from recognized automation tools and services.Chores