Repository navigation
feat: implement issue #1323 — [Fleet Monitor] petry-projects/.github-private — .github/workflows/lint.yml - #1324
Conversation
…private — .github/workflows/lint.yml
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 57 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight credential check to the verify-persona-teams.sh script, allowing the live persona team check to be skipped with a warning instead of failing when run in environments without GitHub credentials (such as Dependabot or fork PRs). It also adds corresponding unit tests to verify this behavior. The reviewer suggested refactoring a short-circuit && operator in the test stub to a standard if statement to improve readability and avoid potential issues with set -e.
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1324 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
There was a problem hiding this comment.
Pull request overview
This PR addresses issue #1323 by making the verify-persona-teams live org-team validation degrade gracefully (skip with a visible warning) when gh is not authenticated—most notably on Dependabot or fork PRs where org-scoped secrets are withheld—so .github/workflows/lint.yml stops failing due to missing credentials.
Changes:
- Add a
gh auth statuscredential preflight toscripts/verify-persona-teams.shand skip the live team check with a::warning::when unauthenticated. - Extend the hermetic Bats test suite to cover the new “no credential → skip” behavior and ensure API errors still fail closed when authenticated.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/verify-persona-teams.sh | Adds credential preflight and skip-with-warning behavior when gh is unauthenticated. |
| tests/verify_persona_teams.bats | Updates the gh stub and adds regression tests for the new credential-skip path. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #1324 |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 33c6aa7008be1db8d5d316cdcc01119dcc1cda1f
Review mode: triage-approved (single reviewer)
Summary
Adds a credential preflight to scripts/verify-persona-teams.sh so the LIVE persona-team check skips with a visible ::warning:: when gh is unauthenticated (Dependabot/fork PRs where the org-scoped token is withheld), instead of reddening the Lint workflow. The fail-closed path on API errors with a credential present is preserved and regression-tested; three new bats tests cover the skip, fail-closed, and no-address paths.
Linked issue analysis
Closes #1323 ([Fleet Monitor] lint.yml DEGRADED at 22.2% failure rate). The Lint failures trace to verify-persona-teams failing on token-less (Dependabot/fork) PRs where the live GitHub API check cannot run. Converting that case to an explicit skip-with-warning — matching the token-degradation posture used elsewhere in this repo — substantively addresses the reported degradation while keeping the check fully enforced on credential-bearing PRs and post-merge.
Findings
- No blocking findings.
- Prior bot feedback addressed: Gemini's suggestion (replace && short-circuit with nested if in the test gh stub) and Copilot's (reword/shorten the warning, avoid hard-coding a single secret name) were both fixed in follow-up commits; both review threads are resolved.
- Minor, non-blocking observation:
gh auth statusfailing due to an expired/invalid token (not just an absent one) would also trigger the skip path. The ::warning:: annotation keeps this visible in run logs, and post-merge runs would surface it, so this is acceptable. - Secret scan: run_secret_scanning MCP tool not available in this environment; gitleaks CI check is green. No secret values appear in the diff (only secret names in comments).
CI status
All checks green: Lint, shellcheck, bats (19 tests), unit-tests, CodeQL, actionlint, SonarCloud, AgentShield, gitleaks, holdout-guard, template-drift, and all validate-* checks SUCCESS. A few CANCELLED entries (dev-lead/dispatch, Dismiss, ci-relay) are superseded duplicate runs whose latest run of the same name succeeded. Skipped checks are ecosystem audits not applicable to this diff.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Closes #1323
Implemented by dev-lead agent. Please review.