feat: implement issue #253 — Compliance: non-stub-agent-shield.yml#268
feat: implement issue #253 — Compliance: non-stub-agent-shield.yml#268don-petry wants to merge 4 commits into
Conversation
|
Warning Review limit reached
More reviews will be available in 59 minutes and 37 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
| .dev-lead/ | ||
| .dev-lead/ | ||
| .dev-lead/ | ||
| .dev-lead/ |
There was a problem hiding this comment.
The entry .dev-lead/ is already defined multiple times in this file. Adding another duplicate entry is redundant. Please remove this line.
There was a problem hiding this comment.
Pull request overview
Implements compliance remediation for issue #253 by updating the repository’s AgentShield centralized workflow to use the canonical reusable workflow reference pinned to @v1.
Changes:
- Updated
.github/workflows/agent-shield.ymlto call the org reusable workflow at@v1and addedwith:inputs. - Added another
.dev-lead/entry to.gitignore(already duplicated in the file).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .gitignore | Adds an additional .dev-lead/ ignore entry (introduces further duplication). |
| .github/workflows/agent-shield.yml | Switches AgentShield reusable workflow reference to @v1 and configures inputs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| with: | ||
| min-severity: medium | ||
| agentshield-version: latest | ||
| required-files: [] |
| # This file is a THIN CALLER STUB. The AgentShield CLI scan and the | ||
| # org-specific structural checks live in the reusable workflow above. | ||
| # | ||
| # AGENTS — READ BEFORE EDITING: | ||
| # • This file is a THIN CALLER STUB. The AgentShield CLI scan and the | ||
| # org-specific structural checks live in the reusable workflow above. | ||
| # • You MAY change: the `with:` inputs (min-severity, agentshield-version, | ||
| # required-files, org-standards-ref) — only if your repo genuinely needs | ||
| # a different policy. | ||
| # • You MUST NOT change: trigger events, the `uses:` line, or the job name | ||
| # (used as a required status check). | ||
| # • If you need different behaviour beyond the inputs, open a PR against | ||
| # the reusable in the central repo. | ||
| # ───────────────────────────────────────────────────────────────────────────── | ||
| # | ||
| # AgentShield — thin caller for the org-level reusable. | ||
| # To adopt: copy this file to .github/workflows/agent-shield.yml in your repo. | ||
| # Agents may adjust input parameters (min-severity, agentshield-version, | ||
| # required-files, org-standards-ref) if their repo has specific needs. | ||
| # Everything else must remain unchanged. | ||
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58e8c990ec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| jobs: | ||
| agent-shield: | ||
| uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@376a4fcb1117444595e3e702fa450873d0e54310 # v2 | ||
| uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1 |
There was a problem hiding this comment.
Use an immutable SHA for the reusable workflow instead of the mutable @v1 tag. In this file the previous revision was SHA-pinned, but this change reintroduces ref drift: a future tag move can silently change policy enforcement or break the required agent-shield / AgentShield check without any change in this repo. Pinning to a commit restores reproducible and auditable CI behavior.
Useful? React with 👍 / 👎.
| jobs: | ||
| agent-shield: | ||
| uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@376a4fcb1117444595e3e702fa450873d0e54310 # v2 | ||
| uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1 |
There was a problem hiding this comment.
This change switches the reusable workflow reference from a commit previously documented as v2 to @v1, which is a major-version downgrade. That can remove checks or behavior expected by current branch-protection policy and make the agent-shield / AgentShield status check inconsistent across runs. Keep the caller on the current major line (and pin that exact revision) to avoid regressing enforcement.
Useful? React with 👍 / 👎.
| with: | ||
| min-severity: medium | ||
| agentshield-version: latest | ||
| required-files: [] |
There was a problem hiding this comment.
Reusable-workflow inputs under workflow_call are typed as string|number|boolean, and caller with: values must match that declared type; required-files: [] is a YAML sequence, not a scalar string. If the reusable expects a string input (which is the only way to represent lists there), this causes workflow validation/runtime failure and the agent-shield required check will not report correctly.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7032dac88e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| min-severity: medium | ||
| agentshield-version: latest | ||
| required-files: [] | ||
| org-standards-ref: petry-projects/.github/main |
There was a problem hiding this comment.
With the v1 reusable workflow, org-standards-ref is passed directly to grep -qiE "$ORG_REF" AGENTS.md in the “Validate cross-references” step. The current repository’s AGENTS.md references petry-projects/.github/blob/main/..., so this new value (petry-projects/.github/main) does not match and the AgentShield job will fail on every push/PR even though the required org-standards link is present.
Useful? React with 👍 / 👎.
| uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1 | ||
| with: | ||
| min-severity: medium | ||
| agentshield-version: latest |
There was a problem hiding this comment.
This overrides the reusable workflow’s pinned ecc-agentshield default with latest, so the required AgentShield check can change behavior or start failing when a new npm release is published, without any change in this repo. In CI contexts where this check gates merges, keep this input on a concrete version so scan policy and failures remain reproducible.
Useful? React with 👍 / 👎.
CI Failure: SonarCloud Code AnalysisStep: SonarCloud Code Analysis (Quality Gate) The PR changes Suggested fix: Replace |
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
|
|
Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead. |
Pull request was closed
Closes #253
Implemented by dev-lead agent. Please review.