feat: dispatch centralized ocr review on PR ready#914
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 2 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
📝 WalkthroughWalkthroughThis PR introduces a new GitHub Actions workflow that automatically dispatches code review events to a centralized service repository whenever a pull request is opened or marked ready for review on the main branch. The workflow includes token validation, concurrency controls, and payload assembly with PR metadata. ChangesCode Review Dispatch Integration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dispatch-code-review.yml:
- Line 52: The workflow currently hardcodes the repository value in the curl
payload (client_payload[repo]=AltimateAI/altimate-code); update the dispatch
payload to use the GitHub Actions repository context instead (e.g., use the
GITHUB_REPOSITORY/GITHUB_REPOSITORY env or the github.repository context) so
client_payload[repo] is set dynamically; locate the line that sets
client_payload[repo] and replace the literal string with the appropriate
variable reference (using the same shell/templating style used elsewhere in the
workflow) to ensure the correct repository is sent.
- Around line 43-58: The gh api call is vulnerable to shell injection because
PR_TITLE, PR_AUTHOR, PR_HEAD_REF, etc. are expanded inside double quotes;
instead of passing these values as -f form fields, construct a JSON payload and
feed it to gh api via stdin (using --input -) so the shell does not perform
command substitution; update the dispatch invocation that currently uses gh api
repos/AltimateAI/altimate-qa/dispatches and the -f "client_payload[...]" fields
to build a proper JSON object from PR_NUMBER, PR_TITLE, PR_AUTHOR, PR_HEAD_REF,
PR_HEAD_SHA and pass it safely to gh api --input -, ensuring all user-controlled
variables are serialized/escaped (e.g., via a JSON serializer or toJSON helper)
and remove direct double-quoted variable expansion in the existing dispatch
block.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: ada14a66-768b-406b-b6f9-8927dcc780e8
📒 Files selected for processing (1)
.github/workflows/dispatch-code-review.yml
| gh api repos/AltimateAI/altimate-qa/dispatches \ | ||
| --method POST \ | ||
| -f event_type=code-review \ | ||
| -f "client_payload[repo]=AltimateAI/altimate-code" \ |
There was a problem hiding this comment.
Use dynamic repository reference instead of hardcoded value.
The repository name is hardcoded as AltimateAI/altimate-code. If this workflow is copied to another repository or the repository is renamed, it will send incorrect metadata to the centralized review service.
♻️ Proposed fix
Use the GitHub context variable instead:
- -f "client_payload[repo]=AltimateAI/altimate-code" \
+ -f "client_payload[repo]=${{ github.repository }}" \Note: This fix is included in the JSON-based approach suggested for the shell injection fix above.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| -f "client_payload[repo]=AltimateAI/altimate-code" \ | |
| -f "client_payload[repo]=${{ github.repository }}" \ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dispatch-code-review.yml at line 52, The workflow
currently hardcodes the repository value in the curl payload
(client_payload[repo]=AltimateAI/altimate-code); update the dispatch payload to
use the GitHub Actions repository context instead (e.g., use the
GITHUB_REPOSITORY/GITHUB_REPOSITORY env or the github.repository context) so
client_payload[repo] is set dynamically; locate the line that sets
client_payload[repo] and replace the literal string with the appropriate
variable reference (using the same shell/templating style used elsewhere in the
workflow) to ensure the correct repository is sent.
There was a problem hiding this comment.
Fair, minor. The literal AltimateAI/altimate-code is correct because this workflow only ever runs in this repo, but ${{ github.repository }} (or $GITHUB_REPOSITORY) is cleaner and copy-paste-safe. If this PR lands, we'll switch the payload to the GitHub-provided repo context (alongside a jq-built JSON body).
There was a problem hiding this comment.
@dev-punia-altimate, that sounds like a solid plan — using $GITHUB_REPOSITORY together with a jq-built JSON body addresses both this concern and the shell-injection risk in one pass. Would you like me to open a follow-up issue to track the $GITHUB_REPOSITORY + jq payload refactor so it doesn't get lost?
dev-punia-altimate
left a comment
dev-punia-altimate
left a comment
There was a problem hiding this comment.
Multi-Persona Review — Verdict: skipped
Multi-persona review completed.
0/0 agents completed · 2s · 0 findings (0 critical, 0 high, 0 medium)
Multi-Persona Review · vllm:qwen3-next-80b (waves) + vllm-fallback (synth) ·
|
👋 This PR was automatically closed by our quality checks. Common reasons:
If you believe this was a mistake, please open an issue explaining your intended contribution and a maintainer will help you. |
dev-punia-altimate
changed the title
|
👋 This PR was automatically closed by our quality checks. Common reasons:
If you believe this was a mistake, please open an issue explaining your intended contribution and a maintainer will help you. |
❌ Tests — Failures DetectedTypeScript — 15 failure(s)
Next StepPlease address the failing cases above and re-run verification. |
2 participants
PINEAPPLE
Summary
altimate-code had no centralized code-review dispatcher — its CI runs
bun testlocally, and thesilent-close-shimis unmerged and only handlespr-closed. This addsdispatch-code-review.ymlso altimate-code PRs trigger the centralized ocr/Gemini review inAltimateAI/altimate-qawhen opened non-draft or marked Ready for review.synchronizeis intentionally omitted (gated loop — re-review only on the next Ready, after altimate-qa flips the PR back to draft on critical findings). Reuses the org-levelAUTOPILOT_DISPATCH_TOKENwith a skip-guard, so no new token is required.Pairs with
AltimateAI/altimate-qa#534 (now merged — enables posting + severity-gated draft-flip).Test Plan
yaml.safe_load).altimate-backend/dispatch-code-review.ymlmechanism (gh api repos/AltimateAI/altimate-qa/dispatches,event_type=code-review).AUTOPILOT_DISPATCH_TOKENisn't visible to this repo, the step no-ops cleanly (an admin then extends the org-secret's repo visibility).Checklist