Repository navigation
feat: implement issue #375 — Compliance: ruleset-drift-code-quality-required_status_checks - #379
Conversation
…equired_status_checks
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
📝 WalkthroughWalkthroughRepository settings automation now applies the code-quality required-status-checks ruleset. The workflow triggers when that ruleset script changes, and a static Bats test verifies the invocation wiring. ChangesRepository settings automation
Estimated code review effort: 2 (Simple) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:XS
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the repository settings script to apply the code-quality required-status-checks ruleset by invoking apply-code-quality-ruleset.sh. It also adds a corresponding unit test in the BATS test suite to verify this integration. There are no review comments, and the changes look correct and well-tested, so I have no feedback to provide.
PR Summary by QodoWire code-quality ruleset application into repo settings automation
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
Dev-Lead — fix-reviews (no-changes)Agent reasoning |
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require review |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 4ec9d8d865ecffdbdc55a146e7c6a947668d7373
Review mode: triage-approved (single reviewer)
Summary
Wires the existing apply-code-quality-ruleset.sh into the repo-settings automation so the code-quality required-status-checks ruleset is re-applied whenever settings are enforced, with a bats regression test and a workflow path-filter addition. Verified the invoked script exists on the head branch and the workflow supplies GH_TOKEN_ADMIN with the administration:write scope the script requires. Confirms the triage low-risk assessment.
Linked issue analysis
Closes #375 (compliance: ruleset-drift-code-quality-required_status_checks). The issue reports the code-quality ruleset drifted (missing agent-shield / AgentShield and dependency-audit / Detect ecosystems required checks). Merging this PR modifies apply-repo-settings.sh, which is in the workflow's path filter, so the Apply repo settings workflow runs on main and applies the codified ruleset — converging the drift. The new path-filter entry for apply-code-quality-ruleset.sh also re-applies on future script changes, preventing recurrence. Substantively addressed.
Findings
No blocking findings.
- apply-repo-settings.sh: adds one call to the pre-existing, idempotent apply-code-quality-ruleset.sh (set -euo pipefail; requires GH_TOKEN — provided by the workflow env). No injection surface; no new secrets handling.
- apply-repo-settings.bats: static grep assertion guards the wiring, consistent with the existing test pattern (e.g. issue #227 test).
- apply-repo-settings.yml: path-filter-only change; permissions: {} and SHA-pinned checkout unchanged.
- Secret scan: gitleaks CI check passed; the run_secret_scanning MCP tool was not available in this environment, so the MCP-based scan was skipped (no secret-like content present in the diff).
CI status
All required checks green: CodeQL (SUCCESS), SonarCloud quality gate passed (0 new issues, 0 hotspots), agent-shield / AgentShield (SUCCESS), Secret scan gitleaks (SUCCESS), dependency-audit / Detect ecosystems (SUCCESS). Remaining checks SKIPPED (not applicable to this change) or SUCCESS. No failures.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/tests/apply-repo-settings.bats:
- Around line 33-35: Update the test “script wires in code-quality ruleset
application (issue `#375`)” to assert the actual executable invocation used by
apply-repo-settings.sh, including its command context and expected arguments,
rather than only matching the apply-code-quality-ruleset.sh filename. Keep the
assertion focused on detecting whether the script truly invokes the ruleset
command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4eb1b6ea-a7b6-4404-b508-97f06377d148
📒 Files selected for processing (3)
.github/scripts/apply-repo-settings.sh.github/scripts/tests/apply-repo-settings.bats.github/workflows/apply-repo-settings.yml
| @test "script wires in code-quality ruleset application (issue #375)" { | ||
| grep -q 'apply-code-quality-ruleset.sh' "$SCRIPT" | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the actual ruleset invocation, not just the filename.
This test would pass if apply-code-quality-ruleset.sh appeared in a comment or unrelated string. Match the executable command used by .github/scripts/apply-repo-settings.sh so the test detects broken wiring.
Suggested assertion
`@test` "script wires in code-quality ruleset application (issue `#375`)" {
- grep -q 'apply-code-quality-ruleset.sh' "$SCRIPT"
+ grep -qF '"$SCRIPT_DIR/apply-code-quality-ruleset.sh"' "$SCRIPT"
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| @test "script wires in code-quality ruleset application (issue #375)" { | |
| grep -q 'apply-code-quality-ruleset.sh' "$SCRIPT" | |
| } | |
| `@test` "script wires in code-quality ruleset application (issue `#375`)" { | |
| grep -qF '"$SCRIPT_DIR/apply-code-quality-ruleset.sh"' "$SCRIPT" | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/tests/apply-repo-settings.bats around lines 33 - 35, Update
the test “script wires in code-quality ruleset application (issue `#375`)” to
assert the actual executable invocation used by apply-repo-settings.sh,
including its command context and expected arguments, rather than only matching
the apply-code-quality-ruleset.sh filename. Keep the assertion focused on
detecting whether the script truly invokes the ruleset command.
User description
Closes #375
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Apply the code-quality ruleset when repository settings are updated
What Changed
Impact
✅ Consistent code-quality checks on repo changes✅ Fewer missed required status checks✅ Safer repository settings updates💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
Chores
Tests