feat: implement issue #948 — [Fleet Monitor] petry-projects/.github — .github/workflows/compliance-retrigger.yml - #949
Conversation
… .github/workflows/compliance-retrigger.yml
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Warning Review limit reached
Next review available in: 37 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe compliance retrigger script now retries GitHub issue searches with configurable attempts and linear backoff. Both search sweeps use the shared helper. Tests cover transient recovery and persistent failure. ChangesCompliance search retries
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant compliance_retrigger as compliance-retrigger.sh
participant gh_api_search
participant gh as GitHub CLI
participant GitHub_API as GitHub API
compliance_retrigger->>gh_api_search: Submit search/issues query
gh_api_search->>gh: Execute API request
gh->>GitHub_API: Request issue search
GitHub_API-->>gh: Response and status
alt Request fails
gh_api_search->>gh: Retry after linear backoff
end
gh-->>gh_api_search: Raw output and final status
gh_api_search-->>compliance_retrigger: Search result or failure
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #949 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a retry mechanism with linear backoff for GitHub API search calls in compliance-retrigger.sh to handle transient failures, along with corresponding test coverage and stub updates. The review feedback suggests two key improvements: optimizing the retry loop in gh_api_search by using a native Bash arithmetic loop instead of seq while resetting the global output variable to prevent stale data, and hardening the path resolution in the test stub to avoid write errors when GH_STUB_LOG lacks a directory path.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/compliance-retrigger.sh`:
- Around line 79-80: Validate GH_SEARCH_ATTEMPTS and GH_API_RETRY_BASE_DELAY
immediately after their default assignments and before the first gh_api_search
attempt: require GH_SEARCH_ATTEMPTS to be an integer of at least 1 and
GH_API_RETRY_BASE_DELAY to be a non-negative integer, rejecting invalid values
before entering the retry loop or performing sleep arithmetic.
- Around line 82-97: Update gh_api_search and both search sweeps so the helper
always captures and validates the raw API response before considering a zero
exit code successful; do not pass --jq through gh_api_search. Apply the jq
filter only in the legacy sweep after raw-page validation, preserving normal
output behavior, and add coverage for a zero-exit error response from the search
endpoint.
In `@test/scripts/compliance-retrigger/transient-retry.bats`:
- Around line 29-43: Extend the test around the transient search retry to set
different LEGACY_TRIGGER_LABEL and TRIGGER_LABEL values, configure the stub so
the second search/issues call fails once before succeeding, and assert both
paths retry successfully. Add a separate zero-exit error-JSON scenario where the
stub returns legacy item data alongside the error response, covering raw output
before --jq filtering rather than only exit code 1 failures.
- Around line 45-55: Update the test “still fails when every search/issues
attempt fails” to set GH_SEARCH_ATTEMPTS explicitly, then assert the search log
contains exactly that configured number of attempts before checking that status
is non-zero. Use the existing log output and preserve the test’s
persistent-failure setup.
- Around line 12-23: Add test/scripts/compliance-retrigger/transient-retry.bats
to the relevant GitHub Actions workflow’s Bats test invocation, and configure
the step to propagate a nonzero Bats exit status so CI fails when this test
fails.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0b94018d-8897-4866-9fac-450f457c3b83
📒 Files selected for processing (3)
scripts/compliance-retrigger.shtest/scripts/compliance-retrigger/stubs/ghtest/scripts/compliance-retrigger/transient-retry.bats
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 33690183ff2b09f3a0ad8a5930a85367cc995188
Review mode: triage-approved (single reviewer)
Summary
Adds bounded retry-with-linear-backoff (gh_api_search, default 3 attempts) around the two org-wide search/issues calls in scripts/compliance-retrigger.sh, addressing the ~11% scheduled-workflow failure rate from transient rate-limit/5xx errors (issue #948). Includes env-var validation (GH_SEARCH_ATTEMPTS, GH_API_RETRY_BASE_DELAY), zero-exit error-JSON detection for the legacy sweep, an enhanced gh test stub, 4 new bats tests, and a new minimal-permission CI workflow gating the script. Triage assessment confirmed correct.
Linked issue analysis
Closes #948 (Fleet Monitor WARNING: compliance-retrigger.yml at 11.1% failure rate). The root cause — a single transient search/issues failure aborting the whole run under set -euo pipefail — is directly and substantively addressed: transient failures are retried with backoff, persistent outages still fail the run after the retry budget (verified by the 'still fails when every attempt fails' test asserting exactly GH_SEARCH_ATTEMPTS calls). Legacy sweep degrades gracefully with a clear warning.
Findings
No blocking findings.
- Correctness: retry loop is sound — args forwarded via "$@", GH_API_SEARCH_OUT reset at function start, last exit code propagated, linear backoff via arithmetic (no injection surface). Both env knobs validated as integers before use.
- Security: new workflow compliance-retrigger-tests.yml uses permissions: contents: read only, triggers on pull_request (not pull_request_target), no secrets, concurrency guard, and actions/checkout pinned to 3d3c42e5aac5ba805825da76410c181273ba90b1 — verified via GitHub API to be exactly the v7.0.1 tag commit. No Actions security smells.
- Zero-exit error-JSON detection for the legacy sweep (jq -se guard) mirrors the primary sweep and is test-covered.
- Prior bot reviews: all 7 review threads (gemini-code-assist, CodeRabbit incl. one Major on the legacy --jq/raw-response issue) are resolved with fixes confirmed by CodeRabbit, which subsequently approved. CodeRabbit's earlier CHANGES_REQUESTED is superseded by its APPROVED review.
- Secret scan: run_secret_scanning MCP tool unavailable in this environment; gitleaks CI check passed (SUCCESS). No credentials in the diff (test tokens are the literal 'fake').
- Minor (non-blocking): the test stub's call/fail/zero-exit counter files persist per tmpdir; tests correctly isolate via tt_make_tmpdir, so no cross-test bleed.
CI status
All required checks green: ShellCheck, Lint, bats (new suite passing), CodeQL, Agent Security Scan, agent-shield, gitleaks secret scan, SonarCloud, CodeRabbit, Graphite AI Reviews — all SUCCESS. Remaining entries are expected SKIPPED ecosystem audits (npm/pnpm/pip/cargo/govulncheck) and dependabot-automerge.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 33690183ff2b09f3a0ad8a5930a85367cc995188
Review mode: triage-approved (single reviewer)
Summary
Adds bounded retry-with-linear-backoff (gh_api_search, 3 attempts, env-overridable) around the two org-wide search/issues calls in scripts/compliance-retrigger.sh, so transient GitHub API failures (rate limits / 5xx) no longer abort the hourly scheduled run. Persistent outages still fail after the retry budget. Also adds zero-exit error-JSON detection for the legacy sweep, a bats test suite covering recovery/persistent-failure/zero-exit-error paths, matching gh-stub failure-injection support, and a path-filtered CI workflow gating the script and its tests.
Linked issue analysis
Closes #948 (Fleet Monitor: compliance-retrigger.yml at 11.1% failure rate, WARNING threshold >10%). Root cause was a single transient search/issues failure propagating through set -euo pipefail and failing the whole workflow. The retry wrapper directly and substantively addresses this; the persistent-outage test proves real failures still surface. Issue is substantively addressed.
Findings
No blocking findings.
- New workflow follows org standards: action pinned to 3d3c42e5aac5ba805825da76410c181273ba90b1 — verified via GitHub API to be the exact commit for actions/checkout v7.0.1 — with permissions: contents: read, timeout-minutes, and concurrency cancel-in-progress.
- Env-var inputs (GH_SEARCH_ATTEMPTS, GH_API_RETRY_BASE_DELAY) are validated as integers before use; retry loop and backoff arithmetic are correct.
- Legacy sweep now detects zero-exit error-JSON pages and skips cleanly instead of mis-parsing them; total count taken from total_count rather than line-counting.
- Minor (non-blocking): gh_api_search retries every non-zero exit, including non-transient errors like HTTP 422, costing a few seconds of pointless backoff before the same failure surfaces. Harmless given the small budget.
- All 7 prior review threads (gemini-code-assist, coderabbitai) are resolved; CodeRabbit's earlier changes-requested review was superseded by its approval.
- Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed (no secrets in the diff — only stubs and test fixtures with fake tokens).
CI status
All checks green: ShellCheck, bats (new suite ran and passed), CodeQL (actions), Agent Security Scan, Secret scan (gitleaks), SonarCloud quality gate, agent-shield, Lint, CodeRabbit, Graphite AI Reviews — all SUCCESS. Remaining entries are expected SKIPPED ecosystem audits (npm/pnpm/go/cargo/pip) and dev-lead relays.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
User description
Closes #948
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Retry transient GitHub API failures during compliance checks
What Changed
Impact
✅ Fewer scheduled compliance workflow failures✅ Automatic recovery from transient rate limits and server errors✅ Clearer reporting for persistent GitHub API outages💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit