Repository navigation
fix: use explicit secrets and write permissions in dependabot-rebase workflow - #148
Conversation
…workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs.
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 22 minutes and 15 seconds.Comment |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the Dependabot rebase caller workflow to avoid reusable-workflow startup failures by explicitly passing required secrets, broadening job permissions for branch updates/approvals, and enabling manual runs.
Changes:
- Replace
secrets: inheritwith explicitAPP_ID/APP_PRIVATE_KEYsecret passing - Upgrade job
permissionstocontents: writeandpull-requests: write - Add
workflow_dispatchtrigger for manual queue flushing
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # • You MUST NOT change: trigger event, the concurrency group name, | ||
| # the `uses:` line, `secrets: inherit`, or the job-level `permissions:` | ||
| # block — reusable workflows can be granted no more permissions than the | ||
| # calling job has, so removing the stanza breaks the reusable's gh API | ||
| # calls. | ||
| # the explicit secrets block, or the job-level `permissions:` block — | ||
| # reusable workflows can be granted no more permissions than the calling | ||
| # job has, so removing the stanza breaks | ||
| # the reusable's gh API calls. |
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: # allow manual trigger to flush Dependabot PR queue |
| # • You MAY change: the SHA in the `uses:` line when upgrading the reusable | ||
| # workflow version (bump SHA to latest main of petry-projects/.github). |
| pull-requests: read | ||
| contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) | ||
| pull-requests: write # re-approve PRs after branch update | ||
| uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@v1 |
Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets
|
…workflow (#148) * fix: use explicit secrets and write permissions in dependabot-rebase workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs. * fix: pin reusable SHA, update header guidance, fix secrets comment Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets * fix: apply prettier formatting (single space before inline comments)
Summary
secrets: inheritwith explicitAPP_ID/APP_PRIVATE_KEYsecretsreadtowrite(required for branch updates and PR approvals)workflow_dispatchtrigger so the queue can be flushed manuallyRoot cause
secrets: inheriton a reusable workflow called withpermissions: readcauses astartup_failure— the reusable needscontents: writeandpull-requests: writeto update branches and approve PRs. GitHub only grants the calling job's permission level to the reusable, so read-only permissions silently prevent all API calls.Test plan