Repository navigation
feat: implement issue #330 — Compliance: stub-surface-drift-feature-ideation.yml-permissions - #378
Conversation
…deation.yml-permissions
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
|
PR Summary by QodoBridge Discussions to workflow_dispatch in feature-ideation workflow stub
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-24T15:05:14Z. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: ec293d0536c6525fda38bce1883f84fe1ca1ec74
Review mode: triage-approved (single reviewer)
Summary
Verbatim re-sync of the feature-ideation.yml caller stub from the canonical org template (petry-projects/.github standards/workflows/feature-ideation.yml), remediating compliance finding #330 (permissions surface drift). Verified by direct diff against the canonical template: the only divergence is the repo-specific project_context block, which is the single documented per-repo edit. All CI checks green.
Linked issue analysis
Issue #330 (compliance-audit) flagged permissions-surface drift in the feature-ideation.yml stub and prescribed copying the canonical template verbatim. The PR head file was diffed against standards/workflows/feature-ideation.yml in petry-projects/.github: identical except the project_context paragraph, which the template explicitly marks as the only required per-repo customisation. The linked issue is substantively and precisely addressed.
Findings
No blocking findings.
- Template-match verification: PR file == canonical template except the sanctioned project_context edit (verified via direct diff, not trust in the PR description).
- The synced content adds a redispatch job using an org PAT; it runs with permissions: {}, a 5-minute timeout, and passes only the numeric discussion number via env (no script-injection surface). This mirrors the established initiative-planner redispatch pattern and is centrally-owned template content, not repo-local invention.
- prep job also runs with permissions: {}; ideate consumes needs.prep.outputs.* to avoid the inputs-context startup failure — sound pattern.
- Secret scan: run_secret_scanning MCP tool unavailable in this environment; gitleaks CI check passed (SUCCESS).
- Triage assessment confirmed with one adjustment: risk classed MEDIUM (workflow/token surface) rather than LOW, still within auto-approve range.
- Note: Codex/CodeRabbit advisory reviews were rate-limited, but CodeRabbit's commit status is SUCCESS and SonarCloud, CodeQL, AgentShield, Qodo, and Graphite all completed clean; the change is mechanically verifiable by template diff.
CI status
All required and completed checks passed: AgentShield ✓, CodeQL (actions) ✓, SonarCloud quality gate ✓ (0 new issues, 0 hotspots), gitleaks ✓, CI ecosystem detection ✓, CodeRabbit status ✓, Graphite AI review ✓. Remaining SKIPPED entries are conditional ecosystem jobs (npm/pnpm/cargo/pip/go audits, frontend/backend CI) not applicable to a workflow-only change.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Code Review by Qodo
Context used✅ Compliance rules (platform):
138 rules✅ Skills:
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| env: | ||
| TARGET_DISCUSSION: ${{ github.event.inputs.target_discussion }} | ||
| FOCUS_AREA: ${{ github.event.inputs.focus_area }} | ||
| RESEARCH_DEPTH: ${{ github.event.inputs.research_depth }} | ||
| DRY_RUN: ${{ github.event.inputs.dry_run }} | ||
| ENHANCE_BACKLOG: ${{ github.event.inputs.enhance_backlog }} | ||
| run: | | ||
| { | ||
| echo "target_discussion=${TARGET_DISCUSSION:-}" | ||
| echo "focus_area=${FOCUS_AREA:-}" | ||
| echo "research_depth=${RESEARCH_DEPTH:-standard}" | ||
| echo "dry_run=${DRY_RUN:-false}" | ||
| echo "enhance_backlog=${ENHANCE_BACKLOG:-false}" | ||
| } >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
1. Github_output injection risk 🐞 Bug ⛨ Security
In prep, workflow_dispatch-controlled values are appended to $GITHUB_OUTPUT using plain key=value lines, so a crafted input containing newlines can inject/override additional outputs. Those outputs are then passed into the privileged reusable-workflow with: (including booleans cast via fromJSON), enabling unintended parameter tampering (e.g., flipping dry_run/enhance_backlog).
Agent Prompt
## Issue description
The workflow writes untrusted workflow_dispatch inputs into `$GITHUB_OUTPUT` using `echo "key=${VALUE}"`, which is vulnerable to newline/output injection.
## Issue Context
The `prep` job resolves `github.event.inputs.*` and forwards them to `ideate` via `needs.prep.outputs.*`, which are then used as reusable-workflow inputs.
## Fix Focus Areas
- .github/workflows/feature-ideation.yml[135-165]
## What to change
1. Encode outputs using the multiline-safe `$GITHUB_OUTPUT` delimiter format (preferred), OR strictly validate and reject values containing `\r`/`\n` before writing outputs.
2. Apply the fix to **all** emitted outputs (`target_discussion`, `focus_area`, `research_depth`, `dry_run`, `enhance_backlog`).
## Example approach (delimiter)
In the `Resolve dispatch inputs` step, replace `echo "k=v"` with delimiter blocks, e.g.:
```bash
safe_out() {
local key="$1"; shift
local val="$1"
local delim="EOF_${RANDOM}_${RANDOM}"
{
echo "${key}<<${delim}"
printf '%s\n' "$val"
echo "${delim}"
} >> "$GITHUB_OUTPUT"
}
safe_out focus_area "${FOCUS_AREA:-}"
# ... repeat for others
```
(Any equivalent multiline-safe method is fine.)
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| target_discussion: | ||
| description: 'Internal — set by `redispatch` when bridging a `discussion:created` event to workflow_dispatch (claude-code-action does not support discussion contexts). Not for manual use.' | ||
| required: false | ||
| default: '' | ||
| type: string |
There was a problem hiding this comment.
2. Unvalidated discussion number 🐞 Bug ☼ Reliability
The new target_discussion workflow_dispatch input is documented as internal and intended to be a Discussion number, but it is forwarded without validation. A manual dispatch can supply arbitrary text, violating the workflow’s own contract and risking unpredictable downstream behavior when that value is used to target a discussion.
Agent Prompt
## Issue description
`target_discussion` is intended to be a numeric Discussion number, but the workflow forwards `github.event.inputs.target_discussion` without checking it is either empty (normal scan) or a decimal integer.
## Issue Context
The value is set by the `redispatch` job on `discussion:created`, but the same input can be set manually via `workflow_dispatch`.
## Fix Focus Areas
- .github/workflows/feature-ideation.yml[72-76]
- .github/workflows/feature-ideation.yml[147-165]
## What to change
Add a validation step (or inline guard) in `prep` before writing outputs:
- Allow empty string.
- If non-empty, require `^[0-9]+$` (and optionally a reasonable length bound).
- Fail fast with a clear `::error::` message if invalid.
## Example
```bash
if [ -n "${TARGET_DISCUSSION:-}" ] && ! [[ "$TARGET_DISCUSSION" =~ ^[0-9]+$ ]]; then
echo "::error::target_discussion must be empty or a numeric Discussion number"
exit 1
fi
```
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: ec293d0536c6525fda38bce1883f84fe1ca1ec74
Review mode: triage-approved (single reviewer)
Summary
Verbatim compliance re-sync of the feature-ideation.yml caller stub from the canonical org template (standards/workflows/feature-ideation.yml), closing compliance issue #330. Verified the PR head file is byte-identical to the canonical template except the project-description paragraph, which the template marks as the single required per-repo customization. The synced template adds a discussion→workflow_dispatch redispatch bridge, a prep job for run-time input resolution, and an enhance_backlog input — all centrally owned.
Linked issue analysis
Issue #330 (compliance audit: stub-surface-drift-feature-ideation.yml-permissions) requires re-syncing the stub's centrally-owned surface (on:/permissions:/concurrency:) verbatim from standards/workflows/feature-ideation.yml. Confirmed by direct diff against the canonical template: the only difference is the documented per-repo project-description edit. The permissions block matches the canonical exactly. Substantively addressed.
Findings
- Qodo flagged 2 advisory items: (1) workflow_dispatch inputs echoed into $GITHUB_OUTPUT without multiline-safe delimiters, (2) target_discussion forwarded without numeric validation (marked Optional/Informational). Both target centrally-owned template code — per the org compliance standard, this stub must stay verbatim with the canonical template, so remediating in this repo would recreate the drift issue #330 flagged. Neither crosses a trust boundary: workflow_dispatch inputs require write access, and the redispatch bridge passes only the numeric discussion number via env vars. Recommend filing the $GITHUB_OUTPUT delimiter hardening upstream in petry-projects/.github (standards/workflows/feature-ideation.yml). Dev-lead reviewed the feedback and posted no-changes.
- New jobs use least privilege (permissions: {}), PAT-presence guard, and preserve the Bot-author/Ideas-category gate.
- run_secret_scanning MCP tool unavailable in this environment; gitleaks CI check passed (SUCCESS) and no secret-like content appears in the diff.
CI status
All substantive checks green: Secret scan (gitleaks), CodeQL, SonarCloud Quality Gate, AgentShield, Graphite AI Reviews — SUCCESS. Backend/Frontend CI and dependency audits correctly SKIPPED (workflow-only change). A few CANCELLED entries (dev-lead/dispatch, review/review, ci-relay) are superseded/rate-limited duplicate runs of checks that otherwise show SUCCESS or SKIPPED; none represent a failing gate.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
User description
Closes #330
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Fix feature-ideation runs on new Ideas discussions and add backlog sweep controls
What Changed
Impact
✅ Fewer failed idea-enhancement runs✅ Automatic refinement for new Ideas discussions✅ Safer backlog cleanup with preview mode💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.