feat: implement issue #207 — [Fleet Monitor] petry-projects/TalkTerm — copilot-setup-steps.yml

[don-petry]

Closes #207

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 31 minutes and 34 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bdbb9bdf-e81c-4ebd-98c0-20457571ff63

📥 Commits

Reviewing files that changed from the base of the PR and between 40f0aae and b4131df.

📒 Files selected for processing (2)

• .github/workflows/copilot-setup-steps.yml
• scripts/test-copilot-setup-steps-workflow.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-207-20260609-2144

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[gemini-code-assist]

Code Review

This pull request introduces a new bash script, scripts/test-copilot-setup-steps-workflow.sh, designed to verify that the .github/workflows/copilot-setup-steps.yml workflow correctly uses npm ci --ignore-scripts and includes a hashFiles conditional guard. The review feedback suggests making the script's assertions more robust by using regular expressions that can handle variations in spacing, quoting, and intermediate flags in the workflow file.

[Copilot]

Pull request overview

This PR addresses issue #207 by aligning the repository’s Copilot cloud-agent setup workflow with the org-standard Node/npm installation pattern (notably using npm ci --ignore-scripts) and adding a small regression-guard script to validate key workflow invariants.

Changes:

• Update .github/workflows/copilot-setup-steps.yml to run npm ci --ignore-scripts (still gated by hashFiles('package-lock.json')).
• Add scripts/test-copilot-setup-steps-workflow.sh to sanity-check the workflow for the expected npm ci --ignore-scripts and hashFiles('package-lock.json') guard.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
scripts/test-copilot-setup-steps-workflow.sh	Adds a regression-guard script to validate key expectations in copilot-setup-steps.yml.
.github/workflows/copilot-setup-steps.yml	Updates dependency installation to npm ci --ignore-scripts under the existing package-lock guard.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 6ffc25d5d8e1ae5dc061602be128d2af7bfc5ac3
Review mode: triage-approved (single reviewer)

Summary

Hardens the copilot-setup-steps.yml install step (npm ci → npm ci --ignore-scripts, aligning with the org canonical template) and adds a regression-guard script. Confirms the triage low-risk assessment.

Linked issue analysis

Closes #207 (Fleet Monitor flagged copilot-setup-steps.yml as DEGRADED, 42.9% failure rate). The change aligns the npm install step with the org standard and adds scripts/test-copilot-setup-steps-workflow.sh as a regression guard for the expected invocation and the package-lock hashFiles condition — substantively addressing the workflow-health concern.

Findings

• npm ci --ignore-scripts under the existing hashFiles('package-lock.json') guard: a security-positive change (no lifecycle-script execution), not a smell.
• New guard script uses robust regex assertions (grep -qE), matching the suggestion from the gemini bot review; the assertion logic for the --ignore-scripts and hashFiles checks is correct.
• Bot review suggestions (gemini, copilot) were non-blocking and already addressed by the committed script; no unresolved human review threads.

CI status

All checks SUCCESS or SKIPPED — no failures or cancellations. CodeQL (actions/python), SonarCloud, AgentShield, gitleaks, copilot-setup-steps, and dependency-audit all green or appropriately skipped.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Lint/style

SonarCloud static analysis failed after the new file scripts/test-copilot-setup-steps-workflow.sh was introduced. SonarCloud scans shell scripts for code smells, complexity, and reliability issues; the new script's multi-branch conditional logic with overlapping extended-regex patterns (npm ci([[:space:]]|$) followed by a ! grep guard) likely triggered one or more rule violations, causing the quality gate to reject the changes. The workflow YAML change itself (npm ci → npm ci --ignore-scripts) is clean.

Suggested fix: Open the SonarCloud dashboard linked below, navigate to the "Issues" tab filtered to this branch, and resolve each flagged rule in scripts/test-copilot-setup-steps-workflow.sh — commonly by simplifying the overlapping grep conditions into a single authoritative check (e.g., only test for npm ci --ignore-scripts presence and fail if absent).

View run logs