ci: adopt reusable auto-arm-merge workflow#128
Conversation
Calls chittyfoundation/.github reusable workflow to arm auto-merge --squash --delete-branch on every non-draft PR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
@coderabbitai review Please evaluate:
|
📝 WalkthroughWalkthroughA new GitHub Actions workflow file is added that automatically triggers on pull request lifecycle events (opened, ready for review, reopened) and delegates execution to an external reusable workflow maintained in the chittyfoundation organization. ChangesAuto-Arm Merge Workflow
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review — PR #128: ci: adopt reusable auto-arm-merge workflowOverviewThis PR adds a 7-line caller workflow that delegates all logic to the reusable Issues1. Pinned to
|
| Correctness | Likely correct once permissions are confirmed |
| Security | @main pinning is the primary concern |
| Conventions | Follows project's reusable-workflow pattern |
| Test coverage | N/A for a CI workflow; manual post-merge check planned |
Verdict: Two items should be resolved before merge — the @main pin (#1) and the permissions story (#2). Item #3 is worth a quick check against the upstream workflow. Everything else is low-severity.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46c2391a6e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| arm: | ||
| uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main |
There was a problem hiding this comment.
In repos/orgs configured with the restricted default GITHUB_TOKEN, this reusable workflow will start but won't be able to arm auto-merge because the caller job doesn't pass any write scopes. GitHub's reusable-workflow semantics say that when jobs.<job_id>.permissions is omitted the called workflow only receives the caller's default token permissions, and the called workflow can only downgrade—not elevate—them; since the adopted workflow runs gh pr merge --auto --squash --delete-branch, it needs the caller job to explicitly grant the PR/content write scopes (for example pull-requests: write and contents: write) or the first non-draft PR will fail to arm.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-arm-merge.yml:
- Line 7: Update the reusable workflow reference string currently set to
"chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main": correct
the upstream path to the actual reusable workflow file in the chittyfoundation
repo (remove the duplicated ".github" segment and use the exact filename that
exists) and then replace the branch reference "`@main`" with the specific commit
SHA that contains that valid workflow to pin it; ensure the updated reference
matches the existing file name in the upstream repo and uses the full
40-character commit SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 120b9d65-857f-44e6-aeeb-cccc0ffb58c1
📒 Files selected for processing (1)
.github/workflows/auto-arm-merge.yml
| types: [opened, ready_for_review, reopened] | ||
| jobs: | ||
| arm: | ||
| uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Fetch the latest commit SHA from the upstream workflow repository
# Get the latest commit SHA from the main branch of the external workflow
gh api repos/chittyfoundation/.github/commits/main --jq '.sha'
# Verify the workflow file exists at that path
gh api repos/chittyfoundation/.github/contents/.github/workflows/auto-arm-merge.yml --jq '.sha'Repository: chittyapps/chittyfinance
Length of output: 279
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Local workflow: .github/workflows/auto-arm-merge.yml ==="
ls -la .github/workflows || true
sed -n '1,200p' .github/workflows/auto-arm-merge.yml || true
echo
echo "=== Upstream: chittyfoundation/.github ==="
# Get commit SHA of main (should succeed even if file path is wrong)
echo "--- main commit sha ---"
gh api repos/chittyfoundation/.github/commits/main --jq '.sha'
# List contents of the likely workflows directory
echo
echo "--- list .github/workflows/ in upstream (ref=main) ---"
gh api repos/chittyfoundation/.github/contents/.github/workflows?ref=main --jq '.[] | {name, path, sha}' | head -n 200
# Also try alternative common location without the leading .github/
echo
echo "--- list workflows/ in upstream (ref=main) ---"
gh api repos/chittyfoundation/.github/contents/workflows?ref=main --jq '.[] | {name, path, sha}' | head -n 200
# Check a few likely filenames near the one referenced
echo
echo "--- search for files containing 'auto' in .github/workflows (ref=main) ---"
gh api repos/chittyfoundation/.github/contents/.github/workflows?ref=main --jq '.[] | select(.name|test("auto";"i")) | {name, path}' | head -n 200Repository: chittyapps/chittyfinance
Length of output: 2426
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== .github/workflows/auto-arm-merge.yml (full) ==="
cat -n .github/workflows/auto-arm-merge.ymlRepository: chittyapps/chittyfinance
Length of output: 348
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find whether the referenced workflow file exists anywhere in the upstream repo tree
gh api repos/chittyfoundation/.github/git/trees/main?recursive=1 --jq '
[.tree[]
| select(.path|test("auto-arm-merge\\.yml$";"i"))
| {path, type, sha}
] | .[0:20]
'Repository: chittyapps/chittyfinance
Length of output: 71
🏁 Script executed:
#!/bin/bash
set -euo pipefail
UP="chittyfoundation/.github"
echo "=== Git tree scan for paths containing arm-merge / auto-arm-merge ==="
gh api repos/$UP/git/trees/main?recursive=1 --jq '
[.tree[]
| select(.path|test("(auto-)?arm-merge";"i"))
| {path, sha}
][0:50]
'
echo
echo "=== Git tree scan for any paths containing 'arm' (broader) ==="
gh api repos/$UP/git/trees/main?recursive=1 --jq '
[.tree[]
| select(.path|test("arm";"i"))
| {path, sha}
][0:50]
'
echo
echo "=== GitHub code search for auto-arm-merge (if supported) ==="
gh api "search/code?q=repo:chittyfoundation/.github%20auto-arm-merge&per_page=20" --jq '
[.items[] | {path, html_url}]
'Repository: chittyapps/chittyfinance
Length of output: 273
Pin the reusable workflow reference (and fix the upstream path)
.github/workflows/auto-arm-merge.yml invokes chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main, which tracks the upstream main branch and can change without this repo’s review. Also, that referenced auto-arm-merge.yml path doesn’t exist in chittyfoundation/.github on main (404 from the contents API; no matching auto-arm-merge/arm paths in the repo tree), so the reference appears stale/broken—fix the path first, then pin to the upstream commit SHA that contains the correct reusable workflow.
🔒 Proposed fix to pin the workflow reference
- uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main
+ uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@<commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 7-7: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-arm-merge.yml at line 7, Update the reusable workflow
reference string currently set to
"chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main": correct
the upstream path to the actual reusable workflow file in the chittyfoundation
repo (remove the duplicated ".github" segment and use the exact filename that
exists) and then replace the branch reference "`@main`" with the specific commit
SHA that contains that valid workflow to pin it; ensure the updated reference
matches the existing file name in the upstream repo and uses the full
40-character commit SHA.
|
@coderabbitai review Please evaluate:
|
Code Review —
|
| Supply chain pin | Fix before merge — @main is not safe for a workflow that arms auto-merge |
| Permissions block | Add pull-requests: write for least-privilege |
| Concurrency group | Nice-to-have for robustness |
| Empty diff | Investigate whether this PR is still needed |
The core idea (reusable auto-arm-merge) is sound and fits the repo's workflow patterns. The blocking issue is the @main pin on an org-level reusable workflow that can directly influence merge behavior.
🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Read the new workflow file
cat .github/workflows/auto-arm-merge.yml
echo "---"
# Check all workflow files for context
ls .github/workflows/
echo "---"
# Fetch the reusable workflow from chittyfoundation/.github via GitHub API
gh api repos/chittyfoundation/.github/contents/.github/workflows/auto-arm-merge.yml \
--jq '.content' | base64 -d 2>/dev/null || echo "Could not fetch reusable workflow content"
echo "---"
# Check PR details for permissions, secrets, etc.
gh pr view 128 --repo chittyapps/chittyfinance --json title,author,body,files
echo "---"
# Check repo settings around Actions permissions
gh api repos/chittyapps/chittyfinance/actions/permissions 2>/dev/null || echo "no access"Length of output: 2543 🏁 Script executed: #!/bin/bash
# Check if chittyfoundation/.github repo is accessible (public?)
gh api repos/chittyfoundation/.github --jq '{private: .private, visibility: .visibility, default_branch: .default_branch}' 2>/dev/null || echo "Repo not accessible (private or does not exist)"
echo "---"
# List workflows in chittyfoundation/.github if accessible
gh api repos/chittyfoundation/.github/contents/.github/workflows 2>/dev/null | jq -r '.[].name' || echo "Cannot list workflows"
echo "---"
# Check if chittyfoundation org exists
gh api orgs/chittyfoundation --jq '{login: .login, public_repos: .public_repos}' 2>/dev/null || echo "Org not accessible"
echo "---"
# Check the referenced PR chittyfoundation/.github#7
gh api repos/chittyfoundation/.github/pulls/7 --jq '{title: .title, state: .state, merged: .merged}' 2>/dev/null || echo "Cannot access referenced PR"
echo "---"
# Check if there are any secrets declared in the workflow that could be at risk
grep -ri "secret" .github/workflows/ || echo "No secrets references found"
echo "---"
# Check for permissions blocks in other workflows for comparison
grep -A5 "permissions:" .github/workflows/*.yml 2>/dev/null | head -60Length of output: 7212
Security Review:
|
| Area | Finding | Severity |
|---|---|---|
| Supply chain | Upstream PR#7 not merged; @main mutable pin |
🔴 Critical |
| Supply chain | Branch ref instead of commit SHA | 🟡 High |
| Token scope | Missing permissions: block |
🟡 High |
| Credential exposure | No secrets: inherit, safe trigger event |
✅ Low |
| Breaking changes | None identified | ✅ None |
Suggested order of operations:
- Review and merge feat(workflows): reusable auto-arm-merge workflow chittyfoundation/.github#7 with a full audit of the reusable workflow body.
- Pin this caller to the resulting merge commit SHA.
- Add an explicit
permissions:block. - Then merge this PR.
✅ Action performed
Review finished.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
1 participant
Summary
Adopts the reusable auto-arm-merge workflow from chittyfoundation/.github (see chittyfoundation/.github#7). On every non-draft PR open / ready_for_review / reopen, this arms 'gh pr merge --auto --squash --delete-branch'.
Squash ruleset already locked on this repo; required checks still gate the actual merge.
Skip conditions
Drafts, dependabot/renovate, titles starting with WIP/[WIP]/Draft:/DO NOT MERGE, forks.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit