Repository navigation
fix(dev-lead): never SHA-pin first-party channel refs when applying feedback (#871) - #880
Conversation
…eedback (#871) The agent, while applying a reviewer/scanner "pin this action to a SHA" finding (fix-reviews / fix-bot-comment / on-mention / review-changes), rewrote a caller stub's moving channel ref `@dev-lead/ring1` → `@<sha>` (TalkTerm #306 commit a27accce). That freezes the caller, defeating the ring/canary model (#499/#500/#501) and contradicting check_dev_lead_stub's channel-only rule (#503). Add a guardrail to the four feedback-applying prompts: first-party reusable refs on `@(dev-lead|pr-review)/(stable|next|ring<N>)` are intentional mutable channel tags (AGENTS.md mutable-ref exception) and must NEVER be SHA-pinned, even when a reviewer asks. Plus a regression test (tests/dev-lead/unit/test_channel_ref_guardrail.bats). Note: takes effect for live agents once promoted to dev-lead/stable; the open re-pin PRs (TalkTerm #308, bmad-bgreat-suite #334) carry dev-lead:hands-off until then. Closes #871. Refs #499, #500, #503. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughAdds a two-line "Guardrail" directive to four dev-lead agent prompt files ( ChangesDev-lead channel ref SHA-pin guardrail
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related issues
Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a guardrail instruction across several dev-lead prompt files to prevent SHA-pinning first-party channel references, ensuring the release/rollback mechanism is preserved. It also adds a BATS unit test suite to verify the presence and correct format of this guardrail. The reviewer suggests using the built-in BATS_TEST_DIRNAME variable in the test script to avoid an unnecessary subshell call.
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T14:11:09Z. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #880 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — fix-reviews (no-changes)Agent reasoning |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T14:20:08Z. |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T16:05:50Z. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: f0f111301ef9fa38af96281d56d9d9a9988de85d
Review mode: triage-approved (single reviewer)
Summary
Adds an identical 'never SHA-pin a first-party channel ref' guardrail blockquote to the four dev-lead feedback-applying prompts (fix-reviews, review-changes, fix-bot-comment, on-mention) plus a bats regression test for #871. +35/-0 across 5 files; no executable logic, auth, secrets, or migrations. Verified the cited AGENTS.md section 'Release channel tags & the mutable-ref exception' (line 158) exists and the channel-tag refs (e.g. dev-lead-reusable.yml@dev-lead/stable) are real in the workflows, so the guardrail text is accurate.
Linked issue analysis
Closes #871. The PR directly addresses the root cause: feedback-applying prompts had no exception for first-party moving channel tags, so the agent would SHA-pin them when a scanner/reviewer asked, freezing the caller and breaking the ring/canary model. The guardrail instructs the agent to skip such pin requests with a one-line note, and the regression test asserts the guardrail (and the channel pattern + AGENTS.md citation) is present in all four prompts. Defense-in-depth via check_dev_lead_stub (#503) remains as a backstop.
Findings
No blocking findings. Prompt-text + test only; the guardrail wording matches the real channel-tag pattern and the AGENTS.md mutable-ref exception it cites. CodeRabbit approved; gemini and don-petry left non-blocking comments with no unresolved threads. Secret scanning MCP tool not invoked (gitleaks CI check passed); no secrets present in a docs/test diff.
CI status
All required checks green (Lint, shellcheck/ShellCheck, bats, unit-tests/unit, CodeQL Analyze actions+python, SonarCloud, agent-shield, Agent Security Scan, validate-agent-profiles, prompt-coverage, Secret scan gitleaks, holdout-guard, etc.). dependency-audit ecosystem jobs and ci-relay SKIPPED as expected. mergeStateStatus is BLOCKED only because reviewDecision=REVIEW_REQUIRED — this approving review satisfies that gate.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #880 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T17:47:55Z. |
2 participants
Fixes the systemic conflict found during the v1.4.0 canary: the dev-lead agent SHA-pins first-party channel refs while applying a reviewer/scanner "pin this action" finding, freezing the caller and breaking the ring/canary model.
Root cause:
dev-lead-fix-reviews.sh:627("apply manual instructions" — on-mention/review-changes) and the feedback prompts had no exception for first-party channel tags. On TalkTerm #306 (commita27accce) the agent rewrote@dev-lead/ring1→@<sha> # dev-lead/ring1, contradicting both the ring model (#499/#500/#501) andcheck_dev_lead_stub's channel-only rule (#503).Fix: add a guardrail to the four feedback-applying prompts (
fix-reviews,review-changes,fix-bot-comment,on-mention): refs on@(dev-lead|pr-review)/(stable|next|ring<N>)are intentional mutable channel tags (AGENTS.md mutable-ref exception) and must never be SHA-pinned, even when a reviewer asks — skip that finding with a one-line note. Plus a regression test.Defense in depth:
check_dev_lead_stub(#503) already rejects a SHA-pinned stub, so a slip is caught; this prevents it at the source.Rollout note: takes effect for live agents once promoted to
dev-lead/stable. The open re-pin PRs (TalkTerm #308, bmad-bgreat-suite #334) carrydev-lead:hands-offas the stopgap until then.Closes #871. Refs #499, #500, #503.
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Tests