fix(deps): route promotion PR source context - #2857
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 5 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe change adds dependency-repair promotion marker parsing to both source-context implementations. Valid markers produce explicit Dependabot context with a ChangesDependency repair source context
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest as Pull request body
participant Parser as parseDependencyRepairPromotionSource
participant Resolver as resolvePrSourceContext
PullRequest->>Parser: Read promotion marker
Parser-->>Resolver: Return validated source_pr metadata
Resolver-->>PullRequest: Set explicit Dependabot source context
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Automated Status SummaryHead SHA: 20a7a89
Coverage Overview
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/scripts/source_context.js (1)
392-405: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftDo not authorize Dependabot context from an unverified PR-body marker.
A PR author controls the marker body. The parser only validates field format. It does not verify that
source_pris bot-owned or that the recorded SHAs match the referenced PR. This code then sets explicit Dependabot context, and the documentation states that this permits keepalive dispatch before PR 46 validates merge provenance. PR 46 therefore does not protect the dispatch path.
.github/scripts/source_context.js#L392-L405: Verify the referenced PR and SHA relationships through trusted GitHub API data before assigningSOURCE_TYPES.DEPENDABOTor an explicit source context.templates/consumer-repo/.github/scripts/source_context.js#L392-L405: Apply the same trusted-provenance check in the consumer template..github/scripts/__tests__/source-context.test.js#L172-L195: Add coverage that a correctly formatted but unverified marker does not authorize dependency automation context.docs/ops/DEPENDENCY_REPAIR_PROMOTION.md#L68-L71: State that keepalive dispatch requires verified provenance, not marker structure alone.As per path instructions, “These scripts run with an elevated GITHUB_TOKEN across the fleet. Flag … missing validation of GitHub API / event payloads … and spoofable bot-actor checks.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/source_context.js around lines 392 - 405, In .github/scripts/source_context.js:392-405 and templates/consumer-repo/.github/scripts/source_context.js:392-405, update the source-context resolution around detectedSourceType/sourceType to verify the referenced PR’s trusted GitHub API provenance, bot ownership, and SHA relationships before assigning SOURCE_TYPES.DEPENDABOT or any explicit source context. Add regression coverage in .github/scripts/__tests__/source-context.test.js:172-195 proving a correctly formatted but unverified marker cannot authorize dependency automation. Update docs/ops/DEPENDENCY_REPAIR_PROMOTION.md:68-71 to require verified provenance, not marker structure alone, for keepalive dispatch.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/scripts/source_context.js:
- Around line 392-405: In .github/scripts/source_context.js:392-405 and
templates/consumer-repo/.github/scripts/source_context.js:392-405, update the
source-context resolution around detectedSourceType/sourceType to verify the
referenced PR’s trusted GitHub API provenance, bot ownership, and SHA
relationships before assigning SOURCE_TYPES.DEPENDABOT or any explicit source
context. Add regression coverage in
.github/scripts/__tests__/source-context.test.js:172-195 proving a correctly
formatted but unverified marker cannot authorize dependency automation. Update
docs/ops/DEPENDENCY_REPAIR_PROMOTION.md:68-71 to require verified provenance,
not marker structure alone, for keepalive dispatch.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3c1d90e4-cce2-40df-a5e3-eecbf2a9f2e1
📒 Files selected for processing (4)
.github/scripts/__tests__/source-context.test.js.github/scripts/source_context.jsdocs/ops/DEPENDENCY_REPAIR_PROMOTION.mdtemplates/consumer-repo/.github/scripts/source_context.js
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87abc15851
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Workflow source neededPR #2857 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
|
Closer review pass on current head |
1 participant
Summary
Review follow-up
Addresses the P1 source-context gap identified after #2853 merged. Without this fix, a marked
agent/deps-repair-*PR could still stop atmissing-source-contextunless someone manually addedworkflow:source-dependabot.Validation
node --test .github/scripts/__tests__/source-context.test.js .github/scripts/__tests__/agents-pr-meta-keepalive.test.js(56 passed)git diff --checkSummary by CodeRabbit
New Features
Bug Fixes
Documentation