ci(doc-drift): use GitHub App token and harden workflow#101
Conversation
- Replace GITHUB_TOKEN with a per-job GitHub App installation token so issue_comment-triggered comment writes survive the public-repo token downgrade that returned 403 on the authorization step - Allow OWNER and MEMBER author associations to trigger /check-docs so repo admins are no longer rejected as unauthorized commenters - Skip any commenter whose login contains [bot] at the job-if level so bot accounts cannot trigger the workflow at all
- Replace the npx tsx invocation of build-doc-drift-message.ts with an inline bash heredoc so the workflow no longer fetches and executes a runtime-downloaded TypeScript tool on each run - Produce byte-identical prompt output to the original script - Remove the now-unused GITHUB_WORKSPACE env override on the step
- Replace the act-only test workflow's tsx invocation with the same inline bash heredoc used in the production workflow - Delete .github/scripts/build-doc-drift-message.ts, now that neither workflow references it, so no runtime-fetched tool is executed
📝 WalkthroughWalkthroughThe doc-drift workflow now filters bot comments, permits owners and members, uses a GitHub App token for GitHub operations, and generates agent instructions inline. The standalone message-builder script was removed, and the workflow test was updated accordingly. ChangesDoc-drift workflow
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub PR comment
participant Workflow as doc-drift workflow
participant GitHubAPI as GitHub API
participant Agent as doc-drift agent
GitHub->>Workflow: /check-docs comment
Workflow->>GitHubAPI: Generate app token and fetch PR diff
Workflow->>Agent: Provide inline instructions and diff path
Agent-->>Workflow: Produce report files
Workflow->>GitHubAPI: Post report or failure comment
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/doc-drift.yml (2)
11-15: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valuePrefer
user.typefor bot filtering.While checking for
[bot]in the login is a common heuristic, GitHub provides a directtypefield on user objects which is more robust and prevents false positives if a normal user login happens to contain that substring.Consider using
github.event.comment.user.type != 'Bot'instead.💡 Proposed change
# Only run on PR comments that start with /check-docs (skip bots) if: | github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/check-docs') && - !contains(github.event.comment.user.login, '[bot]') + github.event.comment.user.type != 'Bot'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/doc-drift.yml around lines 11 - 15, Update the workflow condition guarding the /check-docs comment handler to filter bots using github.event.comment.user.type != 'Bot' instead of checking whether the login contains '[bot]'. Preserve the existing pull-request and command-prefix checks.
167-170: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valuePrevent
pipefailfrom crashing the script if no reports are found.Although the doc-drift agent is contracted to always output a report (even if no issues are found), if the agent unexpectedly produces no output, the intended graceful fallback (
if [ -z "$REPORT_FILES" ]) will never execute. Because GitHub Actions runsbashwithset -o pipefail,lsreturning a non-zero exit code when no files match will immediately crash the step, bypassing the targeted comment and triggering the generic failure comment instead.Appending
|| trueto the pipeline ensures the script continues and posts the specific fallback message.🛠️ Proposed fix
env: GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - REPORT_FILES=$(ls "$GITHUB_WORKSPACE"/pr/.doc-drift-*.md 2>/dev/null | sort -V) + REPORT_FILES=$(ls "$GITHUB_WORKSPACE"/pr/.doc-drift-*.md 2>/dev/null | sort -V || true) if [ -z "$REPORT_FILES" ]; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/doc-drift.yml around lines 167 - 170, Update the REPORT_FILES assignment in the workflow step to tolerate the no-match case under pipefail by appending a successful fallback to the ls/sort pipeline. Preserve the existing empty-value check and graceful fallback behavior that follows.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/doc-drift.yml:
- Around line 11-15: Update the workflow condition guarding the /check-docs
comment handler to filter bots using github.event.comment.user.type != 'Bot'
instead of checking whether the login contains '[bot]'. Preserve the existing
pull-request and command-prefix checks.
- Around line 167-170: Update the REPORT_FILES assignment in the workflow step
to tolerate the no-match case under pipefail by appending a successful fallback
to the ls/sort pipeline. Preserve the existing empty-value check and graceful
fallback behavior that follows.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1291b118-3b50-42ef-ade7-a865e86dd4c2
📒 Files selected for processing (3)
.github/scripts/build-doc-drift-message.ts.github/workflows/doc-drift.ymltests/workflows/docs-drift-test.yml
💤 Files with no reviewable changes (1)
- .github/scripts/build-doc-drift-message.ts
1 participant
Summary
The
/check-docsdoc drift workflow failed with403 Resource not accessible by integrationbecauseissue_comment-triggered runs on a public repo downgradeGITHUB_TOKENto read-only, even when thepermissions:block requestsissues: write. This PR swaps all write paths to a GitHub App installation token so comment posting works regardless of trigger event or repo visibility.Also broadens the authorization guard to allow
OWNERandMEMBERassociations (admins were being rejected asMEMBER), skips bot accounts at the trigger level, and inlines the agent message builder so the workflow no longer fetches and executestsxvianpxat runtime.Branch Target
release-docsbecause it updates docs for the latest released CLI and should be published now.mainbecause it describes unreleased or in-development behavior.Verification
Prerequisites before first run:
Issues: write,Pull requests: write,Contents: readrepository permissions, installed onTRocket-Labs/vectorlint.APP_IDandAPP_PRIVATE_KEYrepository secrets.To verify:
/check-docson a PR → workflow runs, posts 👀 reaction and drift report.Summary by CodeRabbit
/check-docs.