[don-petry]

Closes #1152

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• New Features

  • Added opt-in stub-drift remediation to the fleet monitoring workflow.
  • Remediation defaults to dry-run mode and can only run live through an explicit manual request.
  • Added safeguards requiring approved credentials and a configured pilot repository before live actions.
  • Added limits and protections to control remediation scope and preserve customized files.

• Documentation

  • Documented remediation behavior, safeguards, and approval requirements.

• Tests

  • Added coverage for remediation gating and included it in the lint workflow.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5a3e5622-1ec9-4183-8e84-382d7108b2ef

📥 Commits

Reviewing files that changed from the base of the PR and between cf00148 and 2d30ecb.

📒 Files selected for processing (1)

• scripts/fleet_remediate_gate.sh

📝 Walkthrough

Walkthrough

Adds an opt-in remediate workflow input, a dry-run-first gate for live remediation, artifact-based remediation execution, operational documentation, and Bats coverage integrated into linting.

Changes

Fleet stub-drift remediation

Layer / File(s)	Summary
Remediation go/no-go gate scripts/fleet_remediate_gate.sh	Adds a function and CLI that permit live mode only for explicit dispatches with the required credential and pilot configuration; otherwise it returns dry-run with warnings.
Workflow remediation wiring .github/workflows/actions-fleet-monitor.yml, AGENTS.md	Adds the remediate dispatch choice and a non-blocking remediation step consuming fleet_stub_drift.json, with documented pilot, cap, allowlist, and verification controls.
Gate validation coverage tests/fleet_remediate_gate.bats, .github/workflows/lint.yml	Tests function and CLI behavior across event and prerequisite combinations, and runs the suite in the Bats lint job.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Maintainer
  participant FleetMonitor as actions-fleet-monitor.yml
  participant Gate as fleet_remediate_gate.sh
  participant Remediator as fleet_stub_remediate.sh
  Maintainer->>FleetMonitor: dispatch with remediate=dry-run or live
  FleetMonitor->>Gate: evaluate event and live prerequisites
  Gate-->>FleetMonitor: return DRY_RUN=true or false
  FleetMonitor->>Remediator: pass fleet_stub_drift.json and remediation settings
  Remediator-->>FleetMonitor: complete without blocking the monitor

Loading

Possibly related PRs

• petry-projects/.github-private#1272: Coordinates with pilot-scoped and capped remediation logic in fleet_stub_remediate.sh.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	Most acceptance criteria are implemented, but the required human go/no-go record is not verifiable from the provided context.	Add or link the issue/PR/discussion comment that records the pilot live-remediation go/no-go decision.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately describes the opt-in fleet-monitor remediation change.
Out of Scope Changes check	✅ Passed	The changes stay within the fleet-monitor remediation workflow, tests, docs, and lint update, with no obvious unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1152-20260716-0240

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[gemini-code-assist]

Code Review

This pull request introduces the Fleet stub-drift remediation loop, adding documentation in AGENTS.md, a gate script in scripts/fleet_remediate_gate.sh to control dry-run vs. live execution, and comprehensive BATS tests in tests/fleet_remediate_gate.bats. The reviewer provided constructive feedback suggesting a simplification of the source-guard check in the gate script to avoid redundant fallbacks, and a more robust assertion in the test suite by checking the entire output variable instead of a specific line index.

[Copilot]

Pull request overview

Implements issue #1152 (Phase 4) by wiring the existing stub-drift remediation mechanism into the Actions Fleet Monitor workflow in a way that is opt-in, DRY_RUN by default, and guarded by an explicit human workflow_dispatch input plus pilot + credential gates, with documentation and tests to keep the behavior safe and auditable.

Changes:

• Add a pure “go/no-go” gate (scripts/fleet_remediate_gate.sh) to decide DRY_RUN vs live remediation from (event, remediate mode, credential present, pilot present).
• Extend actions-fleet-monitor.yml with a workflow_dispatch choice input (remediate: dry-run|live) and a non-blocking remediation step that consumes fleet_stub_drift.json.
• Document the remediation loop controls in AGENTS.md and add Bats coverage + wire it into the CI bats suite.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/fleet_remediate_gate.bats	Adds unit tests covering the pure gate behavior and its CLI/source-guard usage.
scripts/fleet_remediate_gate.sh	Introduces the pure DRY_RUN/live decision gate with warning-on-degrade semantics.
AGENTS.md	Documents the opt-in remediation loop, including pilot gating, cap, allowlist, and DRY_RUN defaults.
.github/workflows/lint.yml	Adds the new gate test file to the Bats test set run in CI.
.github/workflows/actions-fleet-monitor.yml	Adds remediate input and a non-blocking remediation step that consumes fleet_stub_drift.json after drift detection/reporting.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality Gate Passed (0 new issues, 0 hotspots): No fixes needed — report only
Files changed: None
Skipped (informational): 0
```
The PR can proceed — all blocking checks are passing.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: fix-reviews)

PR: #1275
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-16T03:28:34Z

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 0 threads:
(no open threads)
Test verification: skipped — no code changes made; all CI checks already passing per provided status
Files changed: none
```

[don-petry]

Human review (Phase-4 live-remediation wiring) — approved to proceed

Reviewed as the fleet maintainer's delegate; go/no-go recorded on #1152. This PR wires the remediation loop into the monitor opt-in and fail-closed; I verified the safety-critical properties directly:

• Fail-closed gate (scripts/fleet_remediate_gate.sh): live requires ALL of workflow_dispatch + remediate=live + GH_PAT_WORKFLOWS + a configured pilot repo; any miss → dry-run + ::warning::; always exits 0. Verified: schedule live … → true (dry-run), workflow_dispatch live true true → false (live), workflow_dispatch live false true → true (missing token → dry-run).
• Scheduled/workflow_call runs are DRY_RUN unconditionally — the loop cannot go live by accident.
• continue-on-error: true — remediation can never fail the daily monitor (AC Add @claude delegation, auto-merge, and rebase handling #3).
• Pilot repo + per-run cap are repo-vars, so nothing goes live without a deliberate dispatch AND config.

One nit fixed in 2d30ecb: moved set -euo pipefail into the source-guard so bats-sourcing doesn't leak strict mode (repo standard, #1257). shellcheck clean; all 10 gate bats + wiring lint pass.

Clearing needs-human-review so the pr-review cascade can approve the current head. This merges the wiring only — it does not enable live remediation (that needs the pilot var set + an explicit remediate=live dispatch, a separate go).

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 2d30ecb406ac1a574bfefb6d5eb2ed9730dfec19
Review mode: triage-approved (single reviewer)

Summary

Phase-4 wiring of the opt-in stub-drift remediation loop into actions-fleet-monitor.yml (266 additions, 5 files, closes #1152). Adds a workflow_dispatch remediate input (dry-run|live, default dry-run), a new pure gate script (scripts/fleet_remediate_gate.sh) with 10 bats tests wired into lint.yml, a remediation step that consumes fleet_stub_drift.json after the existing report/dispatch steps, and AGENTS.md documentation of the four safety controls. Confirms the triage low-risk assessment with one adjustment: classified MEDIUM (not LOW) because the change wires a cross-repo write credential into a workflow step — however the credential (GH_PAT_WORKFLOWS) is the established org credential already used by ~15 workflows, all expression interpolations are routed through env: blocks (no script-injection surface), and the live path is quadruple-gated (workflow_dispatch-only + explicit remediate=live + credential present + pilot repo configured) with a second fail-closed pilot gate inside the pre-existing driver script itself. Inert by default; continue-on-error keeps the monitor non-blocking.

Linked issue analysis

Issue #1152 (epic #1148, Phase 4) — all six acceptance criteria substantively addressed:

1. ✅ Remediation step added to actions-fleet-monitor.yml in the same job, AFTER the report/dispatch steps, consuming fleet_stub_drift.json (skips with ::warning:: if artifact absent).
2. ✅ DRY_RUN defaults to true; live requires explicit workflow_dispatch remediate=live — schedule/workflow_call are unconditionally dry-run (gate short-circuits on event name; covered by bats tests referencing AC #2).
3. ✅ Runs under GH_PAT_WORKFLOWS; absent credential degrades to dry-run with ::warning:: and never fails (gate always returns 0; step is continue-on-error).
4. ✅ Go/no-go recording on the tracking issue/PR is documented in AGENTS.md per the repo's go/no-go pattern (process AC — enablement itself is deliberately out of scope of this PR).
5. ✅ AGENTS.md documents the remediation loop: DRY_RUN default, pilot gate, per-run cap (default 1), and never-overwrite allowlist with recorded-rationale rule.
6. ✅ actionlint/Lint/shellcheck/bats all green; actions-fleet-monitor.yml is org-private automation, not a thin-caller stub, so the no-edit constraint is not violated.

Findings

No blocking findings.

• Verified scripts/fleet_stub_remediate.sh exists at the PR head (pre-existing from Phases 1–3) and its env contract matches the new step exactly (DRY_RUN default true, REMEDIATE_PILOT_REPO, REMEDIATE_MAX_REPOS, REMEDIATE_SUMMARY_FILE); the driver additionally re-checks the pilot gate fail-closed (refuses live writes with no pilot even if DRY_RUN=false) — genuine defense in depth.
• Credential handling: GH_PAT_WORKFLOWS is the established org cross-repo credential (used by ~15 existing workflows); all ${{ }} interpolations in the new step go through env: assignments, no injection surface.
• Both prior review threads (gemini-code-assist, low priority: BASH_SOURCE fallback; bats $output assertion) are resolved, and both fixes are verified present at the reviewed head SHA.
• Secret scan: the run_secret_scanning MCP tool was not available in this session; the gitleaks CI check passed (SUCCESS). No secrets appear in the diff (only secret/var references via GitHub expressions).

CI status

All checks green at 2d30ecb: Lint, ShellCheck, shellcheck, bats (includes the new tests/fleet_remediate_gate.bats), unit-tests, actionlint, gh-aw-compile, CodeQL (actions + python), SonarCloud, Secret scan (gitleaks), Agent Security Scan, agent-shield, caller-stub-freeze, template-drift, validate-* checks, holdout-guard, guard. Conditional dependency-audit jobs skipped (no matching ecosystems). One earlier CANCELLED guard run was superseded by a passing rerun and no longer appears in current checks. mergeStateStatus BLOCKED reflects only the required-review branch protection.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud