chore: deploy Set it Free Loop (review tier, v2.0.0) - #1
Conversation
Source: HemSoft/set-it-free-loop@380fe0e Version: 2.0.0 Tier: review Components: labels, governance, sfl-pr-review Engine policy: codex-gpt-55-high See https://github.com/HemSoft/set-it-free-loop for full documentation.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds SFL deployment metadata and an automated workflow for pull requests labeled ChangesSFL review automation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant ReviewWorkflow
participant CopilotAgent
participant SafeOutputs
participant GitHub
PullRequest->>ReviewWorkflow: Apply sfl-review label
ReviewWorkflow->>ReviewWorkflow: Validate activation and access
ReviewWorkflow->>CopilotAgent: Run constrained review
CopilotAgent-->>ReviewWorkflow: Return findings and usage
ReviewWorkflow->>SafeOutputs: Submit validated outputs
SafeOutputs->>GitHub: Publish review outputs
SafeOutputs->>GitHub: Remove sfl-review label
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ApprovabilityVerdict: Needs human review Unable to check for correctness in 478a0d0. This PR introduces a new automated PR review workflow with write permissions and external service integrations. An unresolved P1 comment identifies a potential issue where the workflow could approve outdated PR revisions after new commits are pushed. New CI/CD capabilities with substantive unresolved findings warrant human review. You can customize Macroscope's approvability policy. Learn more. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitattributes:
- Line 1: Remove the merge=ours attribute from the .github/workflows/*.lock.yml
pattern in .gitattributes, retaining only linguist-generated=true. Avoid
configuring a custom merge driver; resolve lock-file conflicts by regenerating
the files with gh aw compile so they remain synchronized with the source
workflow.
In @.github/workflows/sfl-pr-review.lock.yml:
- Around line 1465-1469: The generated workflow duplicates the chroot
configuration write, but this lock file is a generator artifact rather than the
editable source. Do not modify the duplicate lines here; report the issue
upstream in gh aw and verify whether it remains after the next compile,
referencing the chroot configuration patch block.
In @.github/workflows/sfl-pr-review.md:
- Around line 51-52: Convert the deployment marker lines beginning with
“Deployed from” and “To upgrade” in the workflow prompt body to HTML comments so
they are not rendered as Markdown headings or imported into the agent prompt.
Then re-run `gh aw compile` to refresh the generated lock file and its body
hash.
In `@sfl.json`:
- Line 22: Update the sfl-pr-review entry’s requiredSecretsAnyOf configuration
to declare SFL_APP_PRIVATE_KEY as a required secret, matching the workflow’s
GitHub App token usage and lock manifest. Keep the existing configuration
unchanged apart from adding this secret requirement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 660e5a86-1217-4d0e-a5d2-4cf39deb1169
📒 Files selected for processing (6)
.gitattributes.github/aw/actions-lock.json.github/workflows/sfl-pr-review.lock.yml.github/workflows/sfl-pr-review.mdREADME.mdsfl.json
| @@ -0,0 +1 @@ | |||
| .github/workflows/*.lock.yml linguist-generated=true merge=ours No newline at end of file | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
merge=ours needs a configured merge driver and can hide lock-file drift.
Git has no built-in ours merge driver. Each clone must run git config merge.ours.driver true; otherwise Git falls back to the default merge for *.lock.yml and the attribute has no effect. Add this setup step to the contributor documentation or to the deploy script.
The behavior also carries a risk: when the driver is active, a merge keeps the local lock file and discards the incoming regenerated one. The lock file can then drift from .github/workflows/sfl-pr-review.md, and the workflow's own stale-lock-file check fails the run. Consider linguist-generated=true only, and regenerate with gh aw compile on conflict.
🛠️ Proposed alternative
-.github/workflows/*.lock.yml linguist-generated=true merge=ours
+.github/workflows/*.lock.yml linguist-generated=true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| .github/workflows/*.lock.yml linguist-generated=true merge=ours | |
| .github/workflows/*.lock.yml linguist-generated=true |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gitattributes at line 1, Remove the merge=ours attribute from the
.github/workflows/*.lock.yml pattern in .gitattributes, retaining only
linguist-generated=true. Avoid configuring a custom merge driver; resolve
lock-file conflicts by regenerating the files with gh aw compile so they remain
synchronized with the source workflow.
| if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then | ||
| _GH_AW_CHROOT_JSON=$(jq -c --arg src "${RUNNER_TEMP}/gh-aw" --arg user "$(id -un)" --argjson uid "$(id -u)" --argjson gid "$(id -g)" --arg home "${RUNNER_TEMP}/gh-aw/home" '.chroot={"binariesSourcePath":$src,"identity":{"user":$user,"uid":$uid,"gid":$gid,"home":$home}}' "${RUNNER_TEMP}/gh-aw/awf-config.json") || { echo "chroot config patch failed" >&2; exit 1; } | ||
| printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json" | ||
| printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json" | ||
| fi |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
Duplicated write of the chroot config.
Lines 1467 and 1468 write the identical JSON to the same path twice. The agent job equivalent (line 852) uses a single patch_awf_chroot_config.cjs call. This is a generator artifact, not an editable defect here. Report it upstream in gh aw if the duplication persists after the next compile.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.lock.yml around lines 1465 - 1469, The
generated workflow duplicates the chroot configuration write, but this lock file
is a generator artifact rather than the editable source. Do not modify the
duplicate lines here; report the issue upstream in gh aw and verify whether it
remains after the next compile, referencing the chroot configuration patch
block.
| # Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8 | ||
| # To upgrade: re-run deploy-workflow.ps1 at the desired SHA |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Convert the deployment markers to HTML comments.
Lines 51-52 start with #, so markdown parses them as H1 headings, not comments. The body of this file is imported into the agent prompt ({{#runtime-import .github/workflows/sfl-pr-review.md}} in the lock file), so these headings become prompt content. markdownlint also reports MD022 for both lines.
🛠️ Proposed fix
-# Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8
-# To upgrade: re-run deploy-workflow.ps1 at the desired SHA
+<!-- Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8 -->
+<!-- To upgrade: re-run deploy-workflow.ps1 at the desired SHA -->Note: this change alters the body hash, so re-run gh aw compile to refresh .github/workflows/sfl-pr-review.lock.yml.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8 | |
| # To upgrade: re-run deploy-workflow.ps1 at the desired SHA | |
| <!-- Deployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@380fe0edc7a87cfc7b31233a955b37df0223a3a8 --> | |
| <!-- To upgrade: re-run deploy-workflow.ps1 at the desired SHA --> |
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 51-51: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 52-52: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Above
(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.md around lines 51 - 52, Convert the
deployment marker lines beginning with “Deployed from” and “To upgrade” in the
workflow prompt body to HTML comments so they are not rendered as Markdown
headings or imported into the agent prompt. Then re-run `gh aw compile` to
refresh the generated lock file and its body hash.
Source: Linters/SAST tools
| "model": "gpt-5.5", | ||
| "effort": "high", | ||
| "renderedModel": "gpt-5.5?effort=high", | ||
| "requiredSecretsAnyOf": [] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Declare the App secret in requiredSecretsAnyOf.
requiredSecretsAnyOf is empty for sfl-pr-review. The generated workflow requires secrets.SFL_APP_PRIVATE_KEY and vars.SFL_APP_CLIENT_ID for the GitHub App token steps (.github/workflows/sfl-pr-review.lock.yml lines 505-506, 1084-1085, 1670-1671), and the lock manifest lists SFL_APP_PRIVATE_KEY as a used secret. An empty list lets deployment-time secret validation pass while the workflow fails at runtime when the App token cannot be minted.
🛠️ Proposed fix
- "requiredSecretsAnyOf": []
+ "requiredSecretsAnyOf": ["SFL_APP_PRIVATE_KEY"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "requiredSecretsAnyOf": [] | |
| "requiredSecretsAnyOf": ["SFL_APP_PRIVATE_KEY"] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@sfl.json` at line 22, Update the sfl-pr-review entry’s requiredSecretsAnyOf
configuration to declare SFL_APP_PRIVATE_KEY as a required secret, matching the
workflow’s GitHub App token usage and lock manifest. Keep the existing
configuration unchanged apart from adding this secret requirement.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4d04dcff34
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pull_request: | ||
| types: [labeled] | ||
| names: [sfl-review] |
There was a problem hiding this comment.
When commits are pushed after sfl-review is applied, this workflow neither receives a synchronize event nor checks that the head SHA is unchanged before publishing its review. The queued run can therefore approve the old revision while the PR now contains unreviewed changes, and GitHub approvals may remain valid unless separate branch-protection settings dismiss them. Trigger a new run for labeled PRs on synchronize, or abort output publication when the current head differs from the triggering SHA.
Useful? React with 👍 / 👎.
| @@ -0,0 +1 @@ | |||
| .github/workflows/*.lock.yml linguist-generated=true merge=ours No newline at end of file | |||
There was a problem hiding this comment.
ours merge driver
When both branches regenerate a workflow lock file, merge=ours does not by itself select the current branch's copy: ours is a custom low-level merge-driver name that requires a merge.ours.driver Git configuration, and no such setup exists anywhere in this repository. A normal clone therefore still produces a content conflict instead of resolving generated lock files as intended; provide the driver setup or use a merge strategy that works without uncommitted local configuration.
Useful? React with 👍 / 👎.
Source: HemSoft/set-it-free-loop@235a0df Version: 2.0.0 Tier: review Components: labels, governance, sfl-pr-review Engine policy: codex-gpt-55-high See https://github.com/HemSoft/set-it-free-loop for full documentation.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/sfl-pr-review.lock.yml (1)
61-75: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winThe workflow name is a provenance marker and changes on every deployment.
nameandrun-nameare set toDeployed from: HemSoft/set-it-free-loop/deployment/workflows/sfl-pr-review.md@235a0df.... The string embeds the source SHA, so it changes each time the workflow is redeployed.Consequences:
- The Actions UI lists the workflow under a SHA-bearing title instead of a stable name.
- Any branch protection required status check bound to this workflow name breaks after the next deploy.
- The same string propagates to failure issue titles through
GH_AW_WORKFLOW_NAME(lines 1248, 1287, 1302, 1317) and to the GitHub MCPuser_agent(line 776).Set a stable
namein the source frontmatter of.github/workflows/sfl-pr-review.md, for exampleSFL PR Review. Keep the deployment SHA in a separate comment marker. Re-rungh aw compileafterwards.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sfl-pr-review.lock.yml around lines 61 - 75, Update the source frontmatter in sfl-pr-review.md to use a stable workflow name such as “SFL PR Review” for both name and run-name, and move the deployment SHA into a separate comment marker. Then recompile with gh aw compile so the generated sfl-pr-review.lock.yml and downstream GH_AW_WORKFLOW_NAME/user_agent values use the stable name.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/sfl-pr-review.lock.yml:
- Around line 61-75: Update the source frontmatter in sfl-pr-review.md to use a
stable workflow name such as “SFL PR Review” for both name and run-name, and
move the deployment SHA into a separate comment marker. Then recompile with gh
aw compile so the generated sfl-pr-review.lock.yml and downstream
GH_AW_WORKFLOW_NAME/user_agent values use the stable name.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 2178ff24-ff80-4258-832f-e86daf378ccb
📒 Files selected for processing (3)
.github/workflows/sfl-pr-review.lock.yml.github/workflows/sfl-pr-review.mdsfl.json
Source: HemSoft/set-it-free-loop@78483bb Version: 2.0.0 Tier: review Components: labels, governance, sfl-pr-review Engine policy: codex-gpt-55-high See https://github.com/HemSoft/set-it-free-loop for full documentation.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/sfl-pr-review.md (1)
66-66: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAlign the embedded
versionwith the deployed version.The PR deploys Set it Free Loop version 2.0.0, and the README badge reads
$.versionfromsfl.json. Thesfl:metadata block here still declaresversion: "1.0.0". Confirm whether this field tracks the workflow version or the SFL release version. If it tracks the release, update it at the source repository and re-deploy.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sfl-pr-review.md at line 66, Update the embedded version in the sfl metadata block from 1.0.0 to the deployed Set it Free Loop release version 2.0.0, ensuring the source repository value and deployed workflow remain aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sfl-pr-review.md:
- Line 46: Reconsider the `threat-detection` setting in the workflow
configuration and enable it for runs processing untrusted pull request content.
If it must remain disabled, document the explicit security rationale and
acceptance of the bounded safe-output permissions near `threat-detection`,
including the risks of attacker-controlled review publication.
---
Outside diff comments:
In @.github/workflows/sfl-pr-review.md:
- Line 66: Update the embedded version in the sfl metadata block from 1.0.0 to
the deployed Set it Free Loop release version 2.0.0, ensuring the source
repository value and deployed workflow remain aligned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 628cf8bb-55d3-4460-b47a-dd802671edb1
📒 Files selected for processing (4)
.github/aw/actions-lock.json.github/workflows/sfl-pr-review.lock.yml.github/workflows/sfl-pr-review.mdsfl.json
| private-key: ${{ secrets.SFL_APP_PRIVATE_KEY }} | ||
|
|
||
| safe-outputs: | ||
| threat-detection: false |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Reconsider threat-detection: false for a workflow that ingests untrusted pull request content.
The agent reads the PR diff, title, and body. That content is attacker-controlled on fork pull requests, and a maintainer label can trigger the run on such a PR. With threat detection off, the only remaining barrier is the safe-outputs allowlist. That allowlist still permits up to 20 review comments, one review submission, and one check run under a GitHub App token with pull-requests: write and checks: write (lock file lines 1439-1446). Injected instructions can therefore publish attacker-authored content as an approving review.
Enable threat detection, or document why the bounded safe-output surface is accepted for this tier.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sfl-pr-review.md at line 46, Reconsider the
`threat-detection` setting in the workflow configuration and enable it for runs
processing untrusted pull request content. If it must remain disabled, document
the explicit security rationale and acceptance of the bounded safe-output
permissions near `threat-detection`, including the risks of attacker-controlled
review publication.
|
Closing this v2.0.0 SFL rollout as superseded. HemSoft now uses v2.1.0-rc.9, and hs-buddy is the only approved HemSoft SFL validation repository. This old deployment should not be merged or refreshed. |
1 participant
Set it Free Loop — Deployment
Version: 2.0.0
Tier: review
Source SHA:
380fe0edc7a87cfc7b31233a955b37df0223a3a8Engine policy:
codex-gpt-55-highComponents deployed
labelsgovernancesfl-pr-reviewWhat is the Set it Free Loop?
The Set it Free Loop is a continuous
quality improvement operating model for software repositories. See the
CATALOG
for all available workflows.
Before merging
.\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo>if labels are not yet configured.mdworkflow: verifygh aw compile .github/workflows/<name>.mdsucceedssfl.jsonmanifest in the repo rootSummary by cubic
Deploys the Set it Free Loop review tier v2.0.0 with a label-triggered full-spectrum PR review, inline findings, a consolidated review, and the “SFL Reviewer Approval” check. Switches the review model to OpenRouter
moonshotai/kimi-k3, pins action versions, and adds a manifest and badge.New Features
sfl-pr-reviewworkflow (trigger:sfl-review) that posts up to 20 inline comments, submits one consolidated review, creates the “SFL Reviewer Approval” check, and removes the trigger label for re-runs.sfl-pr-review.lock.ymland action lock.github/aw/actions-lock.json(pinsgithub/gh-aw-actions/setup@v0.84.1);.gitattributesmarks lock files as generated withmerge=ours.sfl.json(v2.0.0, tierreview) with engine policy; workflow uses OpenRoutermoonshotai/kimi-k3.Migration
OPENROUTER_API_KEY,SFL_APP_CLIENT_ID,SFL_APP_PRIVATE_KEY..\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo>.gh aw compile .github/workflows/sfl-pr-review.mdand test by applyingsfl-reviewto a PR.sfl.jsonin the repo root.Written for commit 478a0d0. Summary will update on new commits.
Note
Deploy Set it Free Loop PR review workflow at review tier v2.0.0
sfl-reviewlabel and runs a full-spectrum PR review usingmoonshotai/kimi-k3via OpenRouter.SFL Reviewer Approvalcheck run based on finding severities..gitattributesrule to treat lock files as generated withmerge=ours.Macroscope summarized 478a0d0.