feat: implement issue #984 — Standardize branch-policy compliance self-heal: vendor apply-repo-settings as a canary-ringed reusable - #985
Conversation
…f-heal: vendor apply-repo-settings as a canary-ringed reusable
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Warning Review limit reached
Next review available in: 39 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the apply-repo-settings workflow as a weekly self-heal mechanism for branch-policy compliance, updating the canary rings registry, CI standards, and ruleset remediation documentation, and adding contract tests in BATS. The reviewer provided valuable feedback to improve robustness: evaluating the dry_run boolean input with an explicit == true check to prevent truthy-string coercion, using the optional/try operator ? in yq commands to avoid fatal parsing errors, and refining the Bash line-reading loop in the test script to handle missing trailing newlines and carriage returns.
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| # ── the reusable is a well-formed pure reusable ─────────────────────────────── | ||
| @test "reusable exists and declares workflow_call" { | ||
| [ -f "$REUSABLE" ] | ||
| run yq '.on | has("workflow_call")' "$REUSABLE" |
There was a problem hiding this comment.
Suggestion: The CI workflow installs bats, shellcheck, and jq, but not yq; on a clean ubuntu-latest runner this first yq invocation fails with command-not-found and causes the wholesale Bats suite to fail. Install yq in the workflow or replace these queries with an available dependency. [import error]
Severity Level: Major ⚠️
- ❌ Apply-repo-settings CI suite fails before assertions.
- ❌ Contract regressions cannot pass the required workflow.
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** test/scripts/apply-repo-settings/reusable-contract.bats
**Line:** 28:28
**Comment:**
*Import Error: The CI workflow installs `bats`, `shellcheck`, and `jq`, but not `yq`; on a clean `ubuntu-latest` runner this first `yq` invocation fails with command-not-found and causes the wholesale Bats suite to fail. Install `yq` in the workflow or replace these queries with an available dependency.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fixThere was a problem hiding this comment.
Fixed in .github/workflows/apply-repo-settings-tests.yml: renamed the install step to "Install bats, shellcheck, jq, and yq" and added a pinned mikefarah/yq v4.44.3 install with SHA-256 verification, matching the pattern already used in pr-review-mention-tests.yml. The bats suite can now resolve yq on a clean ubuntu-latest runner.
There was a problem hiding this comment.
Verified: the fix is correctly in place. .github/workflows/apply-repo-settings-tests.yml line 46 installs yq as a pinned mikefarah/yq v4.44.3 binary with SHA-256 checksum verification — matching the pattern from pr-review-mention-tests.yml. The Lint and bats CI check passes, confirming the bats suite can now resolve yq on a clean ubuntu-latest runner.
There was a problem hiding this comment.
Dev-lead verification: confirmed. .github/workflows/apply-repo-settings-tests.yml line 46 installs yq v4.44.3 as a pinned mikefarah/yq binary with HTTPS enforcement and SHA-256 checksum verification — the bats suite can resolve yq on a clean ubuntu-latest runner. The Lint and bats CI check passes. No further changes needed.
| run yq -oy '[.agents["apply-repo-settings"].rings[].channel] | sort | join(",")' "$REGISTRY" | ||
| [ "$output" = "next,ring0,ring1,stable" ] |
There was a problem hiding this comment.
Suggestion: This assertion checks only that four channel names exist, so it passes if the registry assigns incorrect order values, members, or a mismatched reusable path. Those fields drive canary-rollout.sh's promotion and target resolution, making such corruption operationally significant. Validate the expected path and each channel's order and membership, not just the sorted channel-name set. [incomplete implementation]
Severity Level: Major ⚠️
- ⚠️ Canary promotion can target incorrect repositories.
- ❌ Rollout may use the wrong reusable workflow path.
- ⚠️ Ring ordering can bypass intended soak stages.Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** test/scripts/apply-repo-settings/reusable-contract.bats
**Line:** 132:133
**Comment:**
*Incomplete Implementation: This assertion checks only that four channel names exist, so it passes if the registry assigns incorrect `order` values, members, or a mismatched reusable path. Those fields drive `canary-rollout.sh`'s promotion and target resolution, making such corruption operationally significant. Validate the expected path and each channel's order and membership, not just the sorted channel-name set.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fixThere was a problem hiding this comment.
Fixed in test/scripts/apply-repo-settings/reusable-contract.bats: added a new test "registry entry has correct reusable path, ring order, and membership" immediately after the existing channel-name test. It asserts the reusable path (.github/workflows/apply-repo-settings-reusable.yml), the monotone order value for each ring (next=0, ring0=1, ring1=2, stable=3), and the membership anchors for next (petry-projects/.github-private), ring0 (petry-projects/.github), and stable (*). Corruption of any of these fields now causes a test failure before the canary promotion runs.
There was a problem hiding this comment.
Verified: the fix is correctly in place. test/scripts/apply-repo-settings/reusable-contract.bats lines 137–156 contain the new test registry entry has correct reusable path, ring order, and membership, which asserts: the reusable path (.github/workflows/apply-repo-settings-reusable.yml), monotone ring orders (next=0, ring0=1, ring1=2, stable=3), and membership anchors for next (petry-projects/.github-private), ring0 (petry-projects/.github), and stable (*). All assertions match standards/canary-rings.json and the Lint and bats CI check passes.
There was a problem hiding this comment.
Dev-lead verification: confirmed. test/scripts/apply-repo-settings/reusable-contract.bats lines 137–156 contain the new test registry entry has correct reusable path, ring order, and membership, which asserts the reusable path (.github/workflows/apply-repo-settings-reusable.yml), monotone ring orders (next=0, ring0=1, ring1=2, stable=3), and membership anchors for next, ring0, and stable rings. Corruption of any of these fields now causes a test failure. The Lint and bats CI check passes. No further changes needed.
|
Reviewed against the plan in #984 — the shape is right and matches the org conventions (same-commit registry entry, stub source-of-truth under Must fix before merge
Worth doing Post-merge ordering constraint (do not skip) Follow-ups to file now (so fleet delivery doesn't stall after this merges): the cross-repo work lives outside this repo — (a) |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
|
@donpetry-bot CI is green (bats ×2, ShellCheck, Sonar quality gate) — please run the fresh review. Also, the branch is BEHIND main — auto-rebase should pick it up, or rebase on next dev-lead touch. Reminder from the earlier review (not yet done): please file the cross-repo follow-up issues so fleet delivery continues after this merges — (a) |
|
@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
No description provided. |
|
No description provided. |
|
No description provided. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #985 |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:L
|
2 participants
User description
Closes #984
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Standardize weekly repository settings and branch-policy self-healing
What Changed
Apply repo settingsworkflow that weekly applies standard repository settings plus thepr-qualityandcode-qualitybranch-policy rulesets.nextthroughstable.Impact
✅ Weekly branch-policy drift correction✅ Fewer repositories with outdated rulesets✅ Clearer credential failure messages💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.