Repository navigation
fix(workflows): inline add-to-project if-condition (PRs were silently skipped) - #418
Conversation
… fires for legitimate PRs
Previously the if: used a YAML folded scalar (>-) for a multi-line
${{ }} expression. On main, that resulted in the job being SKIPPED for
every pull_request_target event — including PRs from a MEMBER author
where the expression should evaluate true. Observed on PR #417 (the
docs PR): run 27094298629 skipped both jobs at 13:44:21Z despite
authorAssociation == MEMBER being in the allowlist.
The fix is to put the if: expression on a single line. Length is 197
chars (yamllint line-length cap is 200, so it fits).
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
More reviews will be available in 36 minutes and 34 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
…urrent state After the original doc was written, we: - Added a Theme field (Agentic Framework, Fleet Operations, Compliance, Tooling, Ad hoc) above Initiative for two-level taxonomy. - Expanded Initiative options with dev-lead agent, pr-review agent, GH-AW, Copilot Instructions, Daily Reports, Org Standards, Initiatives Project. - Bulk-backfilled ~280 merged PRs from .github + .github-private as Verified items, so the board now reflects 3 months of strategic work history. - Identified a workflow if: bug (PR #418) where the multi-line folded scalar made the job skip every PR; the doc now references the fix. The doc body is updated to describe: - The Theme/Initiative two-level model + the Theme→Initiative table - The Org Standards bucket scope (CI / CODEOWNERS / rulesets / org secrets / org apps) - That the dev-lead-as-gate signal is transitional; topic labels (#415) is the target Refs #387, #415, #418
There was a problem hiding this comment.
Pull request overview
This PR fixes the add-to-project.yml workflow so pull_request_target runs are no longer silently skipped due to a multi-line ${{ }} expression under a YAML folded scalar in the add-issue-or-pr job’s if: condition. This aligns with the Initiatives Project pilot requirements by restoring auto-add behavior for trusted PR authors.
Changes:
- Inlines the
add-issue-or-prjobif:expression onto a single line to ensure GitHub Actions evaluates it correctly. - Keeps the gating semantics unchanged (issues always allowed; PRs allowed only for trusted
author_associationvalues).
|
@don-petry assigned me as reviewer — starting a fresh review now. Results will appear in a few minutes. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 03eeb7df857c2dc6715522f7115d70569eadd026
Review mode: triage-approved (single reviewer)
Summary
One-line YAML fix in .github/workflows/add-to-project.yml: the add-issue-or-pr job's if: is collapsed from a folded-scalar (>-) multi-line ${{ }} expression into a single line. The expression is character-identical to the prior form, so the fork-PR security gate (issues always allowed; pull_request_target allowed only when author_association ∈ {OWNER, MEMBER, COLLABORATOR}) is preserved. The change resolves an observed bug where pull_request_target runs were silently SKIPPED even for trusted authors — consistent with known GitHub Actions evaluator quirks on multi-line folded-scalar if: expressions. Inlined length is 197 chars, under yamllint's 200-char cap.
Linked issue analysis
No Closes references; the PR body links #387 (tracking) and #415 (follow-on for multi-repo + reconciliation parity). The fix is appropriately scoped to a single-line correction and does not attempt to absorb either tracking item.
Findings
None. Diff is 1 addition / 4 deletions across a single workflow file; semantics are byte-for-byte preserved on the gating expression.
CI status
All required checks green: CodeQL, ShellCheck (bats + CI), SonarCloud (Quality Gate passed, 0 issues, 0 hotspots), AgentShield, Lint, Secret scan (gitleaks), Agent Security Scan, Dependency audit, pr-auto-review. The add-issue-or-pr / reconcile-discussion check runs on this PR show as SKIPPED — that is exactly the bug being fixed (the workflow definition that runs for pull_request_target is from main, which still carries the broken folded-scalar form; the fix only takes effect after merge). Copilot left a non-blocking review comment; CodeRabbit was rate-limited; Gemini reported unsupported file types — none indicate a blocker.
Reviewed automatically by the PR-review agent (claude-opus-4-7-single). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 03eeb7df857c2dc6715522f7115d70569eadd026
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)
Summary
The diff is a pure formatting fix: a YAML folded-scalar (>-) multi-line ${{ }} expression in a pull_request_target workflow if: condition is collapsed to a single 189-character line. The fork-PR security gate (issues always allowed; PRs gated on author_association ∈ {OWNER, MEMBER, COLLABORATOR}) is byte-for-byte identical after the change. All required CI checks pass (CodeQL, ShellCheck, SonarCloud 0 issues/0 hotspots, gitleaks, AgentShield, Lint, Agent Security Scan, Dependency audit); the SKIPPED add-issue-or-pr / reconcile-discussion runs are expected because pull_request_target evaluates the workflow from the base branch (main), which still has the broken folded-scalar form. No new permissions, secrets, or untrusted-input paths are introduced.
Findings
- INFO: Single-line expression (189 chars) is within the 200-char yamllint line-length cap declared in the PR body.
- INFO: add-issue-or-pr and reconcile-discussion jobs show SKIPPED on this PR — expected, because pull_request_target workflows execute from the base ref (main), which still carries the broken folded-scalar. The fix only takes effect post-merge.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.
Superseded by automated re-review at 03eeb7d.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 03eeb7df857c2dc6715522f7115d70569eadd026
Review mode: triage-approved (single reviewer)
Summary
Pure YAML formatting fix in .github/workflows/add-to-project.yml: the add-issue-or-pr job's if: expression is collapsed from a folded-scalar (>-) multi-line ${{ }} into a single 197-char line. The fork-PR security gate (issues always allowed; pull_request_target gated on author_association ∈ {OWNER, MEMBER, COLLABORATOR}) is character-identical after the change. This resolves an observed bug — run 27094298629 on PR #417 skipped both jobs at 13:44:21Z despite author_association == MEMBER — consistent with known GitHub Actions evaluator quirks on multi-line folded-scalar if: expressions. Triage assessment confirmed.
Linked issue analysis
No Closes references. The PR body cites #387 (tracking) and #415 (multi-repo + reconciliation parity follow-on). Scope is appropriately limited to the single-line correction and does not attempt to absorb either tracking item.
Findings
None blocking.
- INFO: Inlined expression is 197 chars, under the 200-char yamllint cap declared in the workflow.
- INFO: The
add-issue-or-prandreconcile-discussioncheck runs on this PR show SKIPPED — expected, becausepull_request_targetevaluates the workflow from the base ref (main), which still carries the broken folded-scalar form. The fix only takes effect post-merge; the PR's test plan correctly proposes a post-merge smoke test.
CI status
All required checks green: CodeQL (Analyze actions), ShellCheck (CI + Add to Project Tests bats), SonarCloud (Quality Gate passed, 0 new issues, 0 hotspots, 0% duplication), Secret scan (gitleaks), AgentShield, Lint, Agent Security Scan, Dependency audit (Detect ecosystems), pr-auto-review check-and-dispatch, CodeRabbit status. Copilot left a non-blocking COMMENTED review; CodeRabbit was rate-limited; Gemini reported unsupported file types — none indicate a blocker. A prior cascade review on this same SHA also landed at APPROVED.
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
Superseded by automated re-review at 03eeb7d.
Automated review — human attention neededThis PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops. Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the Posted by the donpetry-bot PR-review cascade. |
* docs(standards): add Initiatives Project operator guide Operator-facing documentation for the Initiatives Project pilot (#387) — covers what belongs on the board, the noise gate, the discussion state machine, the field schema, the four views, the auto-add internals, and the deferred multi-repo work tracked in #415. Lands in standards/ to match the existing governance-doc pattern (agent-standards.md, ci-standards.md, codeowners-standard.md, etc.). Refs #387, addresses the documentation acceptance criterion. * docs(standards): add Theme field + expanded Initiatives, update for current state After the original doc was written, we: - Added a Theme field (Agentic Framework, Fleet Operations, Compliance, Tooling, Ad hoc) above Initiative for two-level taxonomy. - Expanded Initiative options with dev-lead agent, pr-review agent, GH-AW, Copilot Instructions, Daily Reports, Org Standards, Initiatives Project. - Bulk-backfilled ~280 merged PRs from .github + .github-private as Verified items, so the board now reflects 3 months of strategic work history. - Identified a workflow if: bug (PR #418) where the multi-line folded scalar made the job skip every PR; the doc now references the fix. The doc body is updated to describe: - The Theme/Initiative two-level model + the Theme→Initiative table - The Org Standards bucket scope (CI / CODEOWNERS / rulesets / org secrets / org apps) - That the dev-lead-as-gate signal is transitional; topic labels (#415) is the target Refs #387, #415, #418 * docs(standards): wrap long lines, language-tag the file-tree code fence, simplify manual-add snippet Fixes 10 markdownlint errors on the previous push (78088f5): - MD013/line-length (8 lines >200) — wrap paragraphs and the noise-gate blockquote; shorten verbose table cells; format the deferred-work and Related lists with line breaks. - MD040/fenced-code-language — tag the file-tree code fence as 'text'. Addresses the 3-reviewer consensus (Gemini / Copilot / Codex on PR #417) that the manual-add snippet's GraphQL 'issue(number)' field only matches issues, not PRs. Replaced with the REST 'gh api repos/.../issues/<n>' form which returns the node_id for BOTH issues and PRs (PRs are issues in GitHub's data model) — simpler and correct. * docs(standards): use issueOrPullRequest GraphQL for the manual-add node-ID lookup Codex P2 on PR #417 da33440: REST '/issues/<n>' returns the Issue-typed node_id even for PRs, which is the wrong content type for addProjectV2ItemById — that mutation wants the PullRequest-typed node_id for PRs. issueOrPullRequest returns the correct type-specific node ID for both, with one query and one round-trip. This was the original 3-reviewer consensus (Gemini / Copilot / Codex on the first version of this PR). My da33440 cut a corner with REST that ended up being subtly wrong for PRs; this commit restores the canonically-correct GraphQL form. * docs(standards): use issueOrPullRequest GraphQL for the manual-add node-ID lookup Codex P2 on PR #417 da33440: REST '/issues/<n>' returns the Issue-typed node_id even for PRs. addProjectV2ItemById takes a ProjectV2ItemContent union (Issue OR PullRequest) and wants the content-specific node id — passing an Issue id for what is actually a PR is the wrong content type. issueOrPullRequest returns the type-correct id for both with one query. This was the original 3-reviewer consensus (Gemini / Copilot / Codex on the first version of this PR).
… skipped) (#418) fix(workflows): inline if-condition on add-issue-or-pr so it actually fires for legitimate PRs Previously the if: used a YAML folded scalar (>-) for a multi-line ${{ }} expression. On main, that resulted in the job being SKIPPED for every pull_request_target event — including PRs from a MEMBER author where the expression should evaluate true. Observed on PR #417 (the docs PR): run 27094298629 skipped both jobs at 13:44:21Z despite authorAssociation == MEMBER being in the allowlist. The fix is to put the if: expression on a single line. Length is 197 chars (yamllint line-length cap is 200, so it fits).
* docs(standards): add Initiatives Project operator guide Operator-facing documentation for the Initiatives Project pilot (#387) — covers what belongs on the board, the noise gate, the discussion state machine, the field schema, the four views, the auto-add internals, and the deferred multi-repo work tracked in #415. Lands in standards/ to match the existing governance-doc pattern (agent-standards.md, ci-standards.md, codeowners-standard.md, etc.). Refs #387, addresses the documentation acceptance criterion. * docs(standards): add Theme field + expanded Initiatives, update for current state After the original doc was written, we: - Added a Theme field (Agentic Framework, Fleet Operations, Compliance, Tooling, Ad hoc) above Initiative for two-level taxonomy. - Expanded Initiative options with dev-lead agent, pr-review agent, GH-AW, Copilot Instructions, Daily Reports, Org Standards, Initiatives Project. - Bulk-backfilled ~280 merged PRs from .github + .github-private as Verified items, so the board now reflects 3 months of strategic work history. - Identified a workflow if: bug (PR #418) where the multi-line folded scalar made the job skip every PR; the doc now references the fix. The doc body is updated to describe: - The Theme/Initiative two-level model + the Theme→Initiative table - The Org Standards bucket scope (CI / CODEOWNERS / rulesets / org secrets / org apps) - That the dev-lead-as-gate signal is transitional; topic labels (#415) is the target Refs #387, #415, #418 * docs(standards): wrap long lines, language-tag the file-tree code fence, simplify manual-add snippet Fixes 10 markdownlint errors on the previous push (78088f5): - MD013/line-length (8 lines >200) — wrap paragraphs and the noise-gate blockquote; shorten verbose table cells; format the deferred-work and Related lists with line breaks. - MD040/fenced-code-language — tag the file-tree code fence as 'text'. Addresses the 3-reviewer consensus (Gemini / Copilot / Codex on PR #417) that the manual-add snippet's GraphQL 'issue(number)' field only matches issues, not PRs. Replaced with the REST 'gh api repos/.../issues/<n>' form which returns the node_id for BOTH issues and PRs (PRs are issues in GitHub's data model) — simpler and correct. * docs(standards): use issueOrPullRequest GraphQL for the manual-add node-ID lookup Codex P2 on PR #417 da33440: REST '/issues/<n>' returns the Issue-typed node_id even for PRs, which is the wrong content type for addProjectV2ItemById — that mutation wants the PullRequest-typed node_id for PRs. issueOrPullRequest returns the correct type-specific node ID for both, with one query and one round-trip. This was the original 3-reviewer consensus (Gemini / Copilot / Codex on the first version of this PR). My da33440 cut a corner with REST that ended up being subtly wrong for PRs; this commit restores the canonically-correct GraphQL form. * docs(standards): use issueOrPullRequest GraphQL for the manual-add node-ID lookup Codex P2 on PR #417 da33440: REST '/issues/<n>' returns the Issue-typed node_id even for PRs. addProjectV2ItemById takes a ProjectV2ItemContent union (Issue OR PullRequest) and wants the content-specific node id — passing an Issue id for what is actually a PR is the wrong content type. issueOrPullRequest returns the type-correct id for both with one query. This was the original 3-reviewer consensus (Gemini / Copilot / Codex on the first version of this PR).
Summary
The
add-to-project.ymlworkflow'sif:on theadd-issue-or-prjob uses a YAML folded scalar (>-) for a multi-line${{ }}expression. On main today, this skips both jobs for everypull_request_targetevent — even when the author's association is in the allowlist.Reproduction
PR #417 (the docs PR) was opened by don-petry (author_association:
MEMBER, which is in the allowlist["OWNER","MEMBER","COLLABORATOR"]). Run 27094298629 shows bothadd-issue-or-prandreconcile-discussionjobs asskipped. The PR was not added to the Initiatives project (it had to be added manually).Fix
Inline the if-expression on a single line. The expression is now 197 characters, well under yamllint's 200-character limit.
This is the same expression, just single-line — semantics unchanged.
Test plan
dev-leadlabel → verify it appears on the Initiatives board within ~30sdev-leadlabel → verify it appears on the boardRelated