fix(ci): harden ingestion-autopilot workflow to avoid service-role key exposure - #1572
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 39 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe ingestion-autopilot workflow now uses repository dispatch, reads recovery authorization from the event payload, and scopes the service-role secret to two steps. New Vitest coverage validates these rules, and CI runs the test. ChangesIngestion autopilot hardening
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
CI triageCI failed on this PR. Automated classification of the 3 failed job(s):
Compared with main CI run #7797 (cancelled). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
|
@cursoragent Please review PR and fix all issues in this draft PR |
|
Reviewed and fixed PR #1572. Tip is now Findings
Fixes
Verification
Residual risk (intentional):   |
Add the new workflow-reading regression suite to test:ci-workflows so Static PR checks pass, tighten the secret-scoping assertions, and apply Prettier so autofix.ci does not need to rewrite the file.
Capture the reviewed HEAD, CI fixes, and verification after syncing the draft PR with main and registering the workflow secret contract.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ace81d8494
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/branch-review-ledger.md`:
- Line 591: Update the ledger entry for PR `#1572` to include the decisive output
lines from both check:github-actions and prettier --check, preserving the
existing gate names and recording their actual results. Regenerate the entry
through the ledger workflow rather than editing it manually.
In `@tests/ingestion-autopilot-workflow.test.ts`:
- Around line 22-37: Update the workflow assertions around the Checkout and
Preflight required secrets blocks to validate each block independently: assert
Checkout excludes SUPABASE_SERVICE_ROLE_KEY, and assert Preflight required
secrets contains the expected mapping. Do not rely on the broader
install-to-autopilot slice, which can pass if the mapping moves into Checkout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4aae4379-badc-44f1-9a1c-5335844ded55
📒 Files selected for processing (4)
.github/workflows/ingestion-autopilot.ymldocs/branch-review-ledger.mdpackage.jsontests/ingestion-autopilot-workflow.test.ts
|
Resolved both fresh review findings: Checkout and Preflight are now asserted independently in the workflow regression test (focused test passes), and the historical ledger row is superseded through |
2 participants
Motivation
SUPABASE_SERVICE_ROLE_KEYwas in job env, allowing same-repo write-capable attackers to exfiltrate or misuse the production service-role key.Description
SUPABASE_SERVICE_ROLE_KEYfrom the workflow/job-levelenvso checkout and install steps no longer inherit the production service-role secret.workflow_dispatchusage by addingif: ${{ github.event_name != 'workflow_dispatch' || github.ref_name == github.event.repository.default_branch }}and pinning the checkout toref: ${{ github.event.repository.default_branch }}so only the trusted default-branch code runs before secrets are introduced.SUPABASE_SERVICE_ROLE_KEYonly into the preflight check step and theRun autopilotstep after dependencies are installed.tests/ingestion-autopilot-workflow.test.tsthat asserts the workflow does not expose the service-role key to checkout/install steps and that the autopilot step contains the scoped secret.Testing
npm ci(using Node 24 in PATH) and dependency installation completed successfully.npm run check:github-actionsand the workflow pin checks passed.git diff --checkand found no whitespace/pin issues.npm run test -- tests/ingestion-autopilot-workflow.test.tsand it passed.npm run test; the newly added workflow test passed but an unrelated pre-existing test (tests/pdf-extraction-budget.test.ts) failed, so the full suite did not finish green in this environment.npm run check:supabase-project,npm run verify:release, etc.) were intentionally not run because they require explicit confirmation and live credentials.Codex Task
Summary by CodeRabbit
Improvements
Tests
Documentation