fix(code-review): respect agent execution contexts - #25
Conversation
📝 WalkthroughWalkthroughThe review workflow now checks CLI availability and authentication in the execution context. It scans the selected scope for secrets before review execution. Commands use explicit committed, uncommitted, and untracked scope flags with validated base selectors. ChangesReview workflow and scope updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
move the yaml config to its own PR; mark this PR ready for review (not draft) |
esthor
left a comment
esthor
left a comment
There was a problem hiding this comment.
address all before mergeable
|
Moved the repository CodeRabbit policy to #26 and applied every requested setting there: inheritance disabled, assertive profile, review status/fortune/poem enabled, simplify enabled, one-commit auto-pause, and the request-changes workflow as the all-comments approval gate. PR #25 is now auth-only and ready for review. |
esthor
changed the title
|
@coderabbitai full review |
✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@commands/coderabbit-review.md`:
- Around line 40-61: In commands/coderabbit-review.md at lines 40-61, add a
fail-closed secret/credential preflight over the complete selected review scope,
including untracked files when requested, before invoking coderabbit
"${args[@]}"; stop without running the review when a secret is detected. Apply
the same preflight before coderabbit review --agent in agents/code-reviewer.md
at lines 38-44, preserving each entry point’s existing scope selection and
authentication behavior.
- Around line 40-61: The review command flow must perform the fail-closed secret
preflight before invoking coderabbit with args. Update the Run Review section
around the args construction to apply the complete-scope check from
skills/code-review/SKILL.md for all review types, including untracked files, and
abort rather than running the command when secrets are detected.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2e6029b1-dd9b-4dee-9613-2382ccbd6706
📒 Files selected for processing (5)
CHANGELOG.mdREADME.mdagents/code-reviewer.mdcommands/coderabbit-review.mdskills/code-review/SKILL.md
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
coderabbitai/bitbucket(manual)
📜 Review details
🧰 Additional context used
🪛 LanguageTool
README.md
[style] ~148-~148: Consider using a different verb for a more formal wording.
Context: ...dings grouped by severity 4. Optionally fix issues and re-review Sandboxed agents ...
(FIX_RESOLVE)
🔇 Additional comments (5)
skills/code-review/SKILL.md (1)
31-74: LGTM!Also applies to: 83-100, 110-126
README.md (1)
145-154: LGTM!commands/coderabbit-review.md (2)
3-3: 🎯 Functional CorrectnessKeep the base selector consistent with the shared skill.
skills/code-review/SKILL.mddocuments--base-commit, but this command accepts only--base <branch>and forwards onlybase. A commit-based review cannot use this entry point. Add a separatebase_commitargument and forward--base-commit, or remove that mode from the shared skill.
29-30: LGTM!Also applies to: 71-72
CHANGELOG.md (1)
21-25: LGTM!
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
CHANGELOG.md (1)
9-12: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winRemove the stale policy entry or move it to PR
#26.The PR objective states that the repository-level CodeRabbit policy moved to PR
#26. This entry says that this PR added the policy, so the public release history is inaccurate. Remove this entry or record it with the PR that adds the policy.As per path instructions, public source-of-truth claims must remain accurate and mutually consistent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CHANGELOG.md` around lines 9 - 12, Remove the changelog entry describing the repository-level CodeRabbit policy, or move it to the release-history entry for PR `#26`. Ensure the CHANGELOG no longer attributes adding that policy to this PR and remains consistent with the stated source-of-truth history.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@CHANGELOG.md`:
- Around line 9-12: Remove the changelog entry describing the repository-level
CodeRabbit policy, or move it to the release-history entry for PR `#26`. Ensure
the CHANGELOG no longer attributes adding that policy to this PR and remains
consistent with the stated source-of-truth history.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 3228852e-c028-44bc-92b8-f27cf562f74f
📒 Files selected for processing (1)
CHANGELOG.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / verify: fix(code-review): respect agent execution contexts
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / 0_verify.txt: fix(code-review): respect agent execution contexts
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
📓 Path-based instructions (1)
{README.md,CHANGELOG.md,DISTRIBUTION_CHANNELS.md}
⚙️ CodeRabbit configuration file
{README.md,CHANGELOG.md,DISTRIBUTION_CHANNELS.md}: Keep public installation commands, release status, and source-of-truth claims accurate and mutually consistent.
Files:
CHANGELOG.md
🔇 Additional comments (1)
CHANGELOG.md (1)
25-30: LGTM!
1 participant
Summary
--baseand--base-commitselectorsWhy
A restricted command sandbox may not expose authentication already stored by the host CodeRabbit CLI. A sandbox-only preflight can therefore report a false unauthenticated state. Authentication must be checked in the same authoritative execution context that performs the review.
The direct command and reviewer agent now apply the portable skill's credential preflight to the complete selected scope, including untracked files when requested, before invoking CodeRabbit.
Validation
0.7.1help confirms--committed,--uncommitted,--include-untracked,--base,--base-commit, and--dirgit diff --checkcoderabbit auth status --agentreused existing authenticationc983dcfgenerated no actionable commentsThe repository-level CodeRabbit policy remains isolated in #26.
Summary by CodeRabbit
New Features
Documentation