feat: implement issue #404 — PR Review Agent — failures detected 2026-05-28

[don-petry]

Closes #404

Implemented by dev-lead agent. Please review.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 55 minutes and 56 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ec8e1cd5-7623-4e4e-8a0e-6a2858393fe0

📥 Commits

Reviewing files that changed from the base of the PR and between 0a8a61e and 6f8fba0.

📒 Files selected for processing (6)

• .github/workflows/deploy-pr-review.yml
• .github/workflows/force-deploy-pr-review.yml
• .github/workflows/lint.yml
• .github/workflows/pr-review.yml
• scripts/verify-auth-scopes.sh
• tests/test_verify_auth_scopes.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-404-20260608-0045

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a new bash script scripts/verify-auth-scopes.sh to validate GH_TOKEN scopes for pull request reviews, along with a comprehensive suite of unit tests in tests/test_verify_auth_scopes.bats. The review feedback identifies a critical issue where the script's strict regex boundary check will fail to match scopes with permission suffixes (such as contents:read and pull_requests:write), which are standard for default GITHUB_TOKEN configurations. The reviewer suggests updating the regex to support optional suffixes and adding a corresponding unit test to prevent regressions.

[Copilot]

Pull request overview

This PR addresses issue #404 by moving the PR Review Agent’s GH_TOKEN scope validation into a dedicated script and adding unit tests, aiming to avoid false-negative failures when a fine-grained PAT is used.

Changes:

• Added scripts/verify-auth-scopes.sh to validate (or warn/skip) based on gh auth status output.
• Added Bats unit tests to cover fine-grained vs classic PAT scope-output scenarios.
• Updated pr-review.yml to call the new script and updated lint.yml to run the new test file.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
tests/test_verify_auth_scopes.bats	Adds unit coverage for the new auth-scope verification logic.
scripts/verify-auth-scopes.sh	New scope/permission verification script used by the PR review workflow.
.github/workflows/pr-review.yml	Replaces inline scope validation with a call to the new script.
.github/workflows/lint.yml	Ensures the new Bats tests run in CI linting.

[don-petry]

Dev-Lead — rate-limited (intent: fix-bot-comment)

PR: #478
Please re-trigger manually (re-mention @dev-lead) when the rate limit clears — the original request cannot be reconstructed automatically.

[don-petry]

Note

@don-petry I received your request but all AI engines are currently rate-limited. Please re-mention @dev-lead when the rate limit clears (estimated: unknown) — I cannot reconstruct the original instruction automatically.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: cfef5abfb421e10175c7bbdf53d6eaef3632b0f5
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

The P1 deployment gap is fixed — both deploy workflows now ship scripts/verify-auth-scopes.sh to target repos. However, three P2 issues remain unresolved: the scope regex accepts pull_requests:read tokens (confirmed via local test), lint.yml still replaces rather than appends test_push_protection.bats, and the deploy_file helper omits the blob SHA required by GitHub Contents API for updates.

Findings

• MAJOR: Scope regex (:[^[:space:]]*)? matches any suffix including :read, so a token with pull_requests:read passes the guard even though the workflow needs pull-requests: write to submit reviews. Locally confirmed: echo "'pull_requests:read'" | sed "s/[',]/ /g" | grep -qE '...' exits 0. Fix: change the suffix pattern to (:write)? for pull_requests, or reject any :read suffix explicitly.
• MAJOR: lint.yml REPLACES tests/test_push_protection.bats with tests/test_verify_auth_scopes.bats (line 37) instead of appending the new suite. Push-protection regression coverage is silently dropped. AGENTS.md and advisory bots (Codex P2) both explicitly flag this as a required repo-specific exception that must not be reset when adding tests.
• MAJOR: The deploy_file helper in deploy-pr-review.yml makes a PUT to the GitHub Contents API without fetching the current blob SHA. The API returns 422/409 on updates to existing files when sha is omitted. Error handling is soft (grep for '"commit"' in log, no exit non-zero), so re-runs silently report warning but do not roll out the updated files. Fix: fetch SHA with gh api .../contents/{path} --jq .sha before PUT and pass -f sha=....
• MINOR: deploy_file function does not exit non-zero on failure — it only emits a warning line. If the gh API call fails (e.g., conflict on update), the job exits 0, making silent deployment failures invisible in CI. Consider adding || { echo '::error::...'; exit 1; } after the API call.
• INFO: The P1 deployment gap identified by triage is now fixed: deploy-pr-review.yml calls deploy_file for both pr-review.yml and scripts/verify-auth-scopes.sh; force-deploy-pr-review.yml now copies both files and stages both in its commit.
• INFO: All CI checks pass (shellcheck, bats, lint, CodeQL, SonarCloud, secret scan, Agent Security Scan). One review check was CANCELLED (PR review automation), which is expected given the automation context.
• INFO: tests/test_verify_auth_scopes.bats is well-structured and includes the Gemini-suggested test for contents:read + pull_requests:write (exits 0). Coverage for fine-grained PAT, classic PAT, and insufficient scopes is comprehensive.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.