ci(rhodibot): switch to the report-only canary (standards#759) - #81
Conversation
The RSR workflow here is the mutating variant: weekly cron, write permissions,
glob deletes, a bulk SPDX `sed` sweep the licence policy forbids, a
`${{ steps.fix.outputs.FIXES }}` injection sink, and a hardcoded personal
e-mail. Replaced with the canary the template ships: same schedule, same drift
signal, reports instead of mutating.
Refs hyperpolymath/standards#759 (option (a), canary propagation).
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (30)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe RSR workflow is now a report-only compliance canary. It reads repository contents, reports detected drift, avoids file mutations and pull requests, and fails when drift is present. ChangesRSR compliance canary
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant CanaryJob
participant Repository
participant StepSummary
GitHubActions->>CanaryJob: Run compliance canary
CanaryJob->>Repository: Read files and scan patterns
Repository-->>CanaryJob: Return compliance findings
CanaryJob->>StepSummary: Write warnings and notes
CanaryJob-->>GitHubActions: Exit 1 when drift is detected
Merge Risk: ⚪ Minimal · up to The canary’s required-guide check remains aligned with its existing Markdown-guide policy, so no actionable merge risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the purpose and key changes, but it does not follow the repository template. It omits the RSR Quality Checklist, Testing, and Screenshots sections, and it does not document test or checklist results. Resolution Restructure the description using the repository template. Add the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. Mark each applicable checklist item and describe the tests performed, or state why a section is not applicable. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit watches files in rows Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
1 participant
The RSR workflow in this repository is the mutating variant of rhodibot: it runs on a
weekly cron with
contents: write+pull-requests: write, deletes files by glob, andbulk-rewrites SPDX headers — which the standing licence policy forbids. It also interpolates
${{ steps.fix.outputs.FIXES }}into arun:block (repo-derived filenames, soattacker-influenceable) and hardcodes a personal e-mail address.
This replaces it with the report-only canary that the estate template already ships — the
already-approved design, not a new one. Same weekly schedule, same drift signal, no mutation:
it reports what an auto-fixer would have changed and fails the run when it finds drift,
rather than editing anything. Licence/SPDX drift is reported for manual, owner-only
correction; rhodibot must never edit a licence header.
Part of the
standards#759migration (canary propagation, option (a)). The workflow'suses:pins are unchanged, so
actions.lockis unaffected.