fix(ci): port workflow hardening follow-ups to dev by Wibias · Pull Request #1271 · lidge-jun/opencodex

Wibias · 2026-08-08T07:39:15Z

Summary

port the follow-up workflow hardening fixes discovered while promoting merged PR fix(ci): harden comment-driven review workflows #1255 to main in PR fix(ci): promote workflow comment-spam hardening to main - Hotfix #1265 back onto current dev
prevent a future dev -> main merge from restoring the older fix(ci): harden comment-driven review workflows #1255 behavior over the hardened main implementation
keep this sync intentionally limited to the five files whose final fix(ci): promote workflow comment-spam hardening to main - Hotfix #1265 blobs differ from the versions already merged by fix(ci): harden comment-driven review workflows #1255

Follow-up fixes carried back to dev

authenticate the CodeRabbit status producer before allowing privileged revalidation
keep the shared gate/hygiene concurrency lock PR-stable across head changes
make resolve-pr the single PR-resolution authority and pass its output into the write-capable job
authorize gui-screenshot-waived from durable label-event provenance instead of the current wake-up event sender, failing closed when provenance cannot be established
explicitly scope the write job permissions and update the workflow harness/regressions to cover the hardened contracts without brittle full-expression matching

Scope

Exactly five files differ from current dev:

.github/workflows/enforce-pr-target.yml
.github/workflows/pr-hygiene.yml
tests/ci-workflows.test.ts
tests/helpers/enforce-pr-target-harness.ts
tests/zz-pr-coderabbit-readiness-revalidation.test.ts

The other five files originally promoted from #1255 are unchanged between #1255-final and #1265-final and are deliberately not included here.

Validation

The exact final versions being ported are the versions validated on #1265:

focused workflow suite: 128/128 pass
workflow helper suite: 451/451 pass
typecheck: pass
privacy scan: pass
git diff --check: pass

This branch is built directly on the current dev head and is exactly one commit ahead / zero commits behind.

Summary by CodeRabbit

Bug Fixes
- Improved pull request validation to reliably identify the correct open pull request across revisions.
- Added safeguards to reject unverified status events and unauthorized screenshot waiver labels.
- Prevented stale or incomplete status information from incorrectly marking checks as ready.
- Improved workflow coordination so updates for the same pull request are processed consistently.
Tests
- Expanded coverage for event validation, maintainer authorization, pull request resolution, and fail-closed behavior.

coderabbitai · 2026-08-08T07:39:21Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a8b91a02-3289-41e3-8820-565485c291f7

📥 Commits

Reviewing files that changed from the base of the PR and between fdc47db and f7448e7.

📒 Files selected for processing (5)

.github/workflows/enforce-pr-target.yml
.github/workflows/pr-hygiene.yml
tests/ci-workflows.test.ts
tests/helpers/enforce-pr-target-harness.ts
tests/zz-pr-coderabbit-readiness-revalidation.test.ts

📝 Walkthrough

Walkthrough

The PR separates trusted PR resolution from write-capable enforcement, changes concurrency keys to PR numbers, verifies maintainer-applied screenshot waivers, and updates workflow tests and harness fixtures for resolver outputs and status events.

Changes

Pull request enforcement

Layer / File(s)	Summary
Resolve PR identity before enforcement `.github/workflows/enforce-pr-target.yml:28-220`, `tests/ci-workflows.test.ts:830-1133`, `tests/zz-pr-coderabbit-readiness-revalidation.test.ts:45-78`	A read-only `resolve-pr` job validates CodeRabbit status events and resolves one open PR by current head. `enforce-target` consumes `RESOLVED_PULL_NUMBER` and fails closed when the identity is invalid or absent.
Authorize waivers and serialize PR state `.github/workflows/enforce-pr-target.yml:543-654`, `.github/workflows/pr-hygiene.yml:14-17`, `tests/ci-workflows.test.ts:2678-2785`	Screenshot waivers require a label event from a listed maintainer. Checklist staleness handling excludes status events without a head SHA. Hygiene concurrency uses the PR number.
Model resolver inputs and validate workflows `tests/helpers/enforce-pr-target-harness.ts:66-1110`, `tests/zz-pr-coderabbit-readiness-revalidation.test.ts:10-78`	The harness supports issue-event fixtures, sender identity, pagination, resolved PR numbers, and step environments. Tests cover resolver guards, authorized and unauthorized waivers, and status-event enforcement.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant StatusEvent
  participant resolve-pr
  participant GitHubAPI
  participant enforce-target
  StatusEvent->>resolve-pr: trusted status metadata and SHA
  resolve-pr->>GitHubAPI: resolve one open PR at the current head
  GitHubAPI-->>resolve-pr: pull request number
  resolve-pr->>enforce-target: RESOLVED_PULL_NUMBER
  enforce-target->>GitHubAPI: perform PR enforcement

Possibly related PRs

lidge-jun/opencodex#1255: Introduced related workflow, concurrency, test, and harness changes.
lidge-jun/opencodex#1265: Modified the same enforcement workflow and related resolver and waiver behavior.
lidge-jun/opencodex#1175: Added the related CodeRabbit status-event revalidation flow.

Suggested labels: chore

Suggested reviewers: lidge-jun, ingwannu

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/workflow-hardening-followups-dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-08T07:39:24Z

✅ Deterministic PR hygiene checks passed.

github-actions · 2026-08-08T07:52:58Z

⏳ DRAFT

UI screenshot required.

What to do

Add a screenshot of the UI change to the PR description.

Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.

fix(ci): port workflow hardening follow-ups to dev

f7448e7

github-actions Bot added the bug Something isn't working label Aug 8, 2026

Wibias marked this pull request as ready for review August 8, 2026 07:51

Wibias requested review from Ingwannu and lidge-jun as code owners August 8, 2026 07:51

Wibias merged commit 517f446 into dev Aug 8, 2026
21 of 22 checks passed

Wibias deleted the fix/workflow-hardening-followups-dev branch August 8, 2026 07:51

Navigation Menu

fix(ci): port workflow hardening follow-ups to dev - #1271

fix(ci): port workflow hardening follow-ups to dev#1271
Wibias merged 1 commit into
devfrom
fix/workflow-hardening-followups-dev

Wibias commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Aug 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Wibias commented Aug 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Follow-up fixes carried back to dev

Scope

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Aug 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ DRAFT

What to do

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Wibias commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

github-actions Bot commented Aug 8, 2026 •

edited

Loading