fix(ci): harden comment-driven review workflows - #1255
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThe PR replaces issue-comment gate triggers with successful CodeRabbit status events and selected label events. It resolves status commits to one current open PR, uses default-branch automation, adds label-based screenshot waivers, and filters issue-comment translation. ChangesWorkflow hardening
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CodeRabbit
participant EnforcePRTarget
participant GitHubAPI
participant PullRequest
CodeRabbit->>EnforcePRTarget: emit successful status for commit SHA
EnforcePRTarget->>GitHubAPI: resolve associated open pull requests
GitHubAPI-->>EnforcePRTarget: return PR association
EnforcePRTarget->>PullRequest: validate current head and review data
EnforcePRTarget->>EnforcePRTarget: update enforcement state
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Wibias
added
the
gui-screenshot-waived
ChatGPT Codex Connector
Collaborator
Author
|
No GUI changes. This PR only changes GitHub Actions workflow orchestration, tests, and contributor documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/enforce-pr-target.yml (1)
963-970: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winReport the waiver after it clears the last failure.
Lines 967-970 add the waiver message only to
failureNotices. Ifmissing_ui_screenshotis the only failure, Lines 525-528 remove it and this failure branch does not run. The gate then updates the PR without reporting whether the label or a legacy maintainer comment waived the screenshot.Create one
screenshotWaiverNoticevalue and include it in the no-quality-failure draft and ready comment paths as well asfailureNotices.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/enforce-pr-target.yml around lines 963 - 970, Define a shared screenshotWaiverNotice value near failureNotices, preserving the label-versus-maintainer wording, and include it in the no-quality-failure draft and ready comment paths as well as failureNotices. Ensure the waiver is reported when missing_ui_screenshot is the only failure and clears successfully.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@devlog/_plan/260808_workflow_comment_spam_hardening/000_plan.md`:
- Line 54: Update Task 3’s plan statement to require the label as the immediate
GUI screenshot waiver trigger while explicitly preserving legacy
maintainer-comment recognition on later PR events. Ensure it reflects the
existing guiOverrideComments and hasGuiOverride({ comments }) compatibility
contract rather than stating that the label is the only waiver signal.
---
Outside diff comments:
In @.github/workflows/enforce-pr-target.yml:
- Around line 963-970: Define a shared screenshotWaiverNotice value near
failureNotices, preserving the label-versus-maintainer wording, and include it
in the no-quality-failure draft and ready comment paths as well as
failureNotices. Ensure the waiver is reported when missing_ui_screenshot is the
only failure and clears successfully.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 87210e1f-5a25-4500-b0d7-17146dc3fe12
📒 Files selected for processing (9)
.github/scripts/enforce-pr-target.test.cjs.github/workflows/ci.yml.github/workflows/enforce-issue-quality.yml.github/workflows/enforce-pr-target.yml.github/workflows/pr-review-signal.ymldevlog/_plan/260808_workflow_comment_spam_hardening/000_plan.mddocs-site/src/content/docs/contributing/pr-quality.mdtests/ci-workflows.test.tstests/zz-pr-coderabbit-readiness-revalidation.test.ts
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e44fc7cdb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Wibias
force-pushed
the
fix/workflow-comment-spam-hardening-clean
branch
from
August 8, 2026 05:11
461aea2 to
c10a759
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/enforce-pr-target.yml (1)
498-512: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winTie
gui-screenshot-waivedwaivers to verified maintainer authorization. The workflow removesmissing_ui_screenshotfor any presence of the label, but GitHub Triage members can apply repository labels without write access. Keep the maintainer-only waiver boundary by:
.github/workflows/enforce-pr-target.yml#L498-L512: only clear the screenshot failure when the label event is approved by a trusted maintainer, and persist that authorization in the bot-owned gate state.tests/ci-workflows.test.ts#L2657-L2676: add a case wheregui-screenshot-waivedis added by a non-maintainer/low-privilege label actor andmissing_ui_screenshotremains.docs-site/src/content/docs/contributing/pr-quality.md#L43-L48: keep the “maintainer can waive…” claim only after the workflow enforces it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/enforce-pr-target.yml around lines 498 - 512, Update the workflow’s screenshot-waiver handling around screenshotWaivedByLabel and hasGuiOverride so the gui-screenshot-waived label only clears missing_ui_screenshot when its addition is authorized by a trusted maintainer, and persist that authorization in the bot-owned gate state. In tests/ci-workflows.test.ts lines 2657-2676, add coverage for a non-maintainer or low-privilege label actor confirming the failure remains. In docs-site/src/content/docs/contributing/pr-quality.md lines 43-48, retain the maintainer-waiver claim after the workflow enforces this authorization boundary.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/enforce-pr-target.yml:
- Line 33: The concurrency group in
.github/workflows/enforce-pr-target.yml:33-33 must use the pull request head
SHA, falling back to the event SHA and run ID, so all events for one live PR
head serialize together. Update the related assertions in
tests/ci-workflows.test.ts:879-883 to require the shared SHA-based key and
verify serialization across event types.
- Around line 153-159: The associated-PR lookup in the workflow must traverse
every paginated response before deciding uniqueness. In
.github/workflows/enforce-pr-target.yml:153-159, replace the single-page
listPullRequestsAssociatedWithCommit call with github.paginate; in
tests/helpers/enforce-pr-target-harness.ts:86-98, add page-based associated-PR
fixtures; in tests/helpers/enforce-pr-target-harness.ts:716-721, return the
requested associated-PR page; and in tests/ci-workflows.test.ts:2678-2697, add a
page-two matching candidate case that asserts zero mutations.
In `@tests/zz-pr-coderabbit-readiness-revalidation.test.ts`:
- Around line 45-67: Strengthen the readiness revalidation test around the
workflow job, checkoutStep, and gateStep assertions to validate behavior rather
than token presence. Add fixtures or exact normalized-expression checks proving
only successful CodeRabbit status events run, status events check out
github.event.repository.default_branch, and zero, multiple, or mismatched
current-head PRs fail closed before any write; ensure computed checks are
actually enforced.
---
Outside diff comments:
In @.github/workflows/enforce-pr-target.yml:
- Around line 498-512: Update the workflow’s screenshot-waiver handling around
screenshotWaivedByLabel and hasGuiOverride so the gui-screenshot-waived label
only clears missing_ui_screenshot when its addition is authorized by a trusted
maintainer, and persist that authorization in the bot-owned gate state. In
tests/ci-workflows.test.ts lines 2657-2676, add coverage for a non-maintainer or
low-privilege label actor confirming the failure remains. In
docs-site/src/content/docs/contributing/pr-quality.md lines 43-48, retain the
maintainer-waiver claim after the workflow enforces this authorization boundary.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0edad601-a80d-4b8b-8bfa-f2e6e95c62a5
📒 Files selected for processing (8)
.github/scripts/enforce-pr-target.test.cjs.github/workflows/enforce-pr-target.ymldevlog/_plan/260808_workflow_comment_spam_hardening/000_plan.mddocs-site/src/content/docs/contributing/pr-quality.mdstructure/06_docs-and-release.mdtests/ci-workflows.test.tstests/helpers/enforce-pr-target-harness.tstests/zz-pr-coderabbit-readiness-revalidation.test.ts
Wibias
force-pushed
the
fix/workflow-comment-spam-hardening-clean
branch
from
August 8, 2026 05:18
c10a759 to
b73f6a4
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/ci-workflows.test.ts`:
- Around line 2679-2740: Add a focused positive status-resolution test alongside
the existing CodeRabbit status tests, using exactly one open PR whose head SHA
matches statusSha and whose PR number differs from the harness default. Assert
the resolved PR number is passed to the downstream pulls.get/read calls using
the harness’s raw callsTo argument shape, and verify the gate proceeds rather
than failing closed.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a4b5e76a-626d-40eb-b9bd-f80db12d101f
📒 Files selected for processing (5)
.github/workflows/enforce-pr-target.yml.github/workflows/pr-hygiene.ymltests/ci-workflows.test.tstests/helpers/enforce-pr-target-harness.tstests/zz-pr-coderabbit-readiness-revalidation.test.ts
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/_agent_fix_1255_followup.yml:
- Around line 52-58: Make the branch-writing automation idempotent and
serialized: in .github/workflows/_agent_fix_1255_followup.yml lines 52-58, exit
successfully when git diff --cached --quiet shows no staged test changes; in
.github/scripts/_agent_patch_1255_followup.py lines 27-29, check for each test
before inserting it; and in .github/workflows/_agent_fix_1255_followup.yml lines
3-6, add concurrency keyed by github.ref with cancel-in-progress: false.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0d599cde-78dc-4dcb-92b4-cd7166b8d912
📒 Files selected for processing (3)
.github/scripts/_agent_patch_1255_followup.py.github/workflows/_agent_fix_1255_followup.ymltests/ci-workflows.test.ts
Wibias
force-pushed
the
fix/workflow-comment-spam-hardening-clean
branch
from
August 8, 2026 05:45
9c17091 to
0993c53
Compare
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
issue_commentreruns from the write-capable PR quality gateCodeRabbitcommit status on the trusted default branchgui-screenshot-waived; legacy maintainer comments remain compatibility evidence on later PR eventsTest plan
bun test tests/zz-pr-coderabbit-readiness-revalidation.test.ts tests/ci-workflows.test.ts— 129 pass, 0 failnode --test .github/scripts/*.test.cjs— 451 pass, 0 failbun run typecheck— passbun run privacy:scan— passgit diff --check— passNotes
enforce-targetandpr-hygieneshare the same current-head concurrency lockdevand zero commits behindmainSummary by CodeRabbit
New Features
gui-screenshot-waivedlabel for approved screenshot-check waivers.Bug Fixes
Documentation
Tests