fix: prepare dbt review action for v0.8.5#900
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
Too much diff to scan? Review this PR in Change Stack to start with the highest-impact changes. Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR exposes runner.manifestAvailable(), seeds orchestrator anyManifest from that signal, centralizes the GitHub App install URL, hardens composite action steps and permissions, adds asset and adversarial tests, and updates docs/examples/changelog to reference v0.8.5. Changes0.8.5 Release Readiness
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
anandgupta42
force-pushed
the
fix/v0.8.4-dbt-review-launch
branch
from
f683f50 to
b0d0a8d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/opencode/src/altimate/review/orchestrate.ts`:
- Line 1006: Awaiting the optional hook input.runner.manifestAvailable() is
currently unprotected and can reject and crash runReview; wrap the call in a
try/catch (while still honoring the optional nature) so that if
input.runner.manifestAvailable throws or rejects you set anyManifest = false (or
a safe default) and optionally log the error, instead of letting the exception
bubble; update the code around the anyManifest assignment (the await of
input.runner.manifestAvailable) to perform this guarded call.
In `@packages/opencode/test/altimate/review-runner.test.ts`:
- Around line 2-17: Replace the manual temp-dir lifecycle (mkdtempSync, tempDirs
array and afterEach cleanup) with the test fixture helper: import tmpdir from
"fixture/fixture" and use the await using pattern to create the directory for
the test; specifically, remove tempDirs and the afterEach block and change the
mkdtempSync usage in the test to an await using (const tmp =
tmpdir("altimate-review-manifest-")) { const dir = tmp.path; const manifestPath
= path.join(dir, "manifest.json"); ... } so the fixture automatically cleans up
when the scope exits; keep existing references to createDispatcherRunner and
other test logic unchanged.
In `@packages/opencode/test/altimate/review.test.ts`:
- Around line 1236-1241: The test currently sets manifestAvailable() to true but
leaves impact().hasManifest true, so it doesn't validate the decoupling; change
the stubbed impact() return to set hasManifest: false while keeping
manifestAvailable() === true so env.summary.degraded will reflect the new
contract. Update the same change in the other test seed that mirrors this
behavior (the second occurrence of these stubs) so both cases assert
manifestAvailable() is respected independently of impact().hasManifest.
In `@packages/opencode/test/install/repository-symlinks.test.ts`:
- Line 13: The test currently only asserts the symlink target exists; update the
assertion to also verify the resolved target is inside the repository root by
computing the absolute target (using readlinkSync and path.resolve) and then
checking path.relative(repoRoot, target) does not start with '..' (and is not
equal to '') or by asserting target.startsWith(path.resolve(repoRoot) ) before
asserting existsSync(target) is true; reference the variables/functions link,
readlinkSync, path.resolve, path.relative, and existsSync when making the
change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 47534ee8-5ec9-4572-9b02-cd16b0ee76e2
⛔ Files ignored due to path filters (6)
packages/identity/mark-192x192.pngis excluded by!**/*.pngpackages/identity/mark-512x512-light.pngis excluded by!**/*.pngpackages/identity/mark-512x512.pngis excluded by!**/*.pngpackages/identity/mark-96x96.pngis excluded by!**/*.pngpackages/identity/mark-light.svgis excluded by!**/*.svgpackages/identity/mark.svgis excluded by!**/*.svg
📒 Files selected for processing (12)
CHANGELOG.mdREADME.mddocs/docs/usage/dbt-pr-review.mdgithub/README.mdgithub/review/examples/altimate-ingestion.ymlpackages/opencode/src/altimate/review/orchestrate.tspackages/opencode/src/altimate/review/runner.tspackages/opencode/src/cli/cmd/github.tspackages/opencode/test/altimate/review-runner.test.tspackages/opencode/test/altimate/review.test.tspackages/opencode/test/cli/github-action.test.tspackages/opencode/test/install/repository-symlinks.test.ts
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 18 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
1 issue found across 3 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
Contributor
dev-punia-altimate
left a comment
dev-punia-altimate
left a comment
There was a problem hiding this comment.
Multi-Persona Review — Verdict: skipped
Multi-persona review completed.
0/0 agents completed · 2s · 0 findings (0 critical, 0 high, 0 medium)
Multi-Persona Review · vllm:qwen3-next-80b (waves) + vllm-fallback (synth) ·
anandgupta42
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@github/review/action.yml`:
- Line 67: The VERSION fallback uses a curl invocation that has no timeouts and
can hang; update the curl call that sets VERSION (the line starting with
VERSION=$(curl -sf ...)) to include sensible timeout flags (e.g.
--connect-timeout and --max-time) and optional retry behavior (e.g. --retry) so
the job won't stall on transient network issues; keep the existing -s -f
behavior and ensure the whole subshell still falls back to empty on failure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 5bee33e3-ec0e-46ee-9526-c4872b9a36a0
📒 Files selected for processing (5)
CHANGELOG.mddocs/docs/usage/dbt-pr-review.mdgithub/review/action.ymlgithub/review/examples/altimate-ingestion.ymlpackages/opencode/test/skill/release-v0.8.5-adversarial.test.ts
✅ Files skipped from review due to trivial changes (2)
- CHANGELOG.md
- docs/docs/usage/dbt-pr-review.md
🚧 Files skipped from review as they are similar to previous changes (1)
- github/review/examples/altimate-ingestion.yml
This was referenced Jun 6, 2026
anandgupta42
added a commit
that referenced
this pull request
Jun 6, 2026
Follow-up hardening for the `github/review` composite action from the #900 review. Stacks on #900 (refines its new semver version step). - Authenticate the release-version lookup with `${{ github.token }}` (lifts the unauthenticated 60 req/hr IP limit to 1,000 req/hr) so busy runners aren't throttled into the `latest` fallback. - Skip the binary cache when the version resolves to `latest` (`if: steps.version.outputs.version != 'latest'`), so one rate-limited/offline lookup can't pin a stale binary across all later runs. - Read the hosted API key from the environment inside the `jq` program (`$ENV.IN_ALT_KEY`) instead of passing it via `--arg`, keeping it out of `argv` (visible to other processes; printed under `ACTIONS_STEP_DEBUG`). - Add 4 adversarial tests: auth header present with a token, omitted+safe without one (bash-3.2 empty-array idiom), cache gated on `!= 'latest'`, and the API key absent from the `jq` argv. Closes #909 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
11 tasks
anandgupta42
added a commit
that referenced
this pull request
Jun 6, 2026
Follow-up hardening for the `github/review` composite action from the #900 review. Stacks on #900 (refines its new semver version step). - Authenticate the release-version lookup with `${{ github.token }}` (lifts the unauthenticated 60 req/hr IP limit to 1,000 req/hr) so busy runners aren't throttled into the `latest` fallback. - Skip the binary cache when the version resolves to `latest` (`if: steps.version.outputs.version != 'latest'`), so one rate-limited/offline lookup can't pin a stale binary across all later runs. - Read the hosted API key from the environment inside the `jq` program (`$ENV.IN_ALT_KEY`) instead of passing it via `--arg`, keeping it out of `argv` (visible to other processes; printed under `ACTIONS_STEP_DEBUG`). - Add 4 adversarial tests: auth header present with a token, omitted+safe without one (bash-3.2 empty-array idiom), cache gated on `!= 'latest'`, and the API key absent from the `jq` argv. Closes #909 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github/reviewcomposite action archivev0.8.5tagv0.8.4was published from main for the trace-durability fix while this PR was open. Its archive still contains the broken dangling symlinks, so this PR now targetsv0.8.5. It does not create or publish the tag.Adversarial and end-to-end validation
latestbase,head, and manifest values remain argv data and cannot execute shell commands0600, are not logged, and invalid combinations fail closedgit archiveextracts with regular, non-empty action dependenciesv0.8.4tagreviewPullRequestexecution against a temporary git/dbt project with a valid manifest34adversarial and trace regression tests passed88reviewer, manifest, action, and installer tests passed215repository and upstream-merge guards passedThe branch is merged with the released
mainstate and preserves the v0.8.4 trace-durability release changes.Summary by CodeRabbit
Bug Fixes
New Features
Documentation
Security
Tests