Skip to content

PR assessment workflow #140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hardyjosh merged 1 commit into from
Aug 15, 2025
Merged

PR assessment workflow #140

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/pr-assessment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
name: GitHub PR Size Assessment
on:
pull_request:
types:
- closed

Comment on lines +1 to +6
Copy link

@coderabbitai coderabbitai bot Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Set explicit, least-privilege GITHUB_TOKEN permissions

Reusable workflows can’t elevate permissions; the caller must declare them. Be explicit to avoid surprises if defaults change and to ensure the called workflow has what it needs.

 name: GitHub PR Size Assessment
 on:
   pull_request:
     types:
       - closed
+
+permissions:
+  contents: read
+  pull-requests: read

If the called workflow needs additional scopes (e.g., actions: read/write, checks: write), adjust accordingly after verifying its requirements.

🏁 Script executed:

#!/bin/bash
# Check for reusable workflow calls and actions usage in pr-assessment workflow
grep -R -nE 'uses:|workflow_call' .github/workflows/pr-assessment.yaml || true

Length of output: 151

🏁 Script executed:

#!/bin/bash
set -e

echo "=== Checking for existing permissions in pr-assessment.yaml ==="
rg -n 'permissions:' -C3 .github/workflows/pr-assessment.yaml || echo "No permissions block found"

echo
echo "=== Context around reusable workflow call ==="
rg -n 'uses: rainlanguage/github-chore' -C5 .github/workflows/pr-assessment.yaml || true

echo
echo "=== Full workflow header ==="
sed -n '1,50p' .github/workflows/pr-assessment.yaml

Length of output: 1368

Add explicit, least-privilege GITHUB_TOKEN permissions

Your workflow currently inherits default token scopes, which may change or be overly permissive. Since you’re calling a reusable workflow, you must declare its required permissions upfront. At minimum, grant read-only on repository contents and pull requests:

File: .github/workflows/pr-assessment.yaml

 name: GitHub PR Size Assessment
 on:
   pull_request:
     types:
       - closed
+  permissions:
+    contents: read
+    pull-requests: read

 jobs:
   assess-pr-size-on-merge:
     uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
     …

After reviewing the reusable workflow’s needs, add any additional scopes (e.g. checks: write, actions: read/write) as required.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
name: GitHub PR Size Assessment
on:
pull_request:
types:
- closed
name: GitHub PR Size Assessment
on:
pull_request:
types:
- closed
permissions:
contents: read
pull-requests: read
jobs:
assess-pr-size-on-merge:
uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
…
🤖 Prompt for AI Agents 
In .github/workflows/pr-assessment.yaml around lines 1 to 6, the workflow relies
on the default GITHUB_TOKEN scope; add an explicit least-privilege permissions
block declaring at minimum permissions: contents: read and pull-requests: read,
and then add any additional specific scopes required by the reusable workflow
(for example checks: write or actions: read/write) so the workflow only has the
needed token permissions.

jobs:
assess-pr-size-on-merge:
uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
with:
pr_number: ${{ github.event.pull_request.number }}
repo: ${{ github.event.repository.name }}
owner: ${{ github.repository_owner }}
merged: ${{ github.event.pull_request.merged }}
Comment on lines +8 to +14
Copy link

@coderabbitai coderabbitai bot Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Gate the job to only run when the PR is merged

Triggering on pull_request.closed also fires on “closed without merge.” Add a job-level condition to avoid unnecessary runs and potential noise.

 jobs:
   assess-pr-size-on-merge:
+    if: ${{ github.event.pull_request.merged == true }}
     uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
     with:
       pr_number: ${{ github.event.pull_request.number }}
       repo: ${{ github.event.repository.name }}
       owner: ${{ github.repository_owner }}
       merged: ${{ github.event.pull_request.merged }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
assess-pr-size-on-merge:
uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
with:
pr_number: ${{ github.event.pull_request.number }}
repo: ${{ github.event.repository.name }}
owner: ${{ github.repository_owner }}
merged: ${{ github.event.pull_request.merged }}
jobs:
assess-pr-size-on-merge:
if: ${{ github.event.pull_request.merged == true }}
uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
with:
pr_number: ${{ github.event.pull_request.number }}
repo: ${{ github.event.repository.name }}
owner: ${{ github.repository_owner }}
merged: ${{ github.event.pull_request.merged }}
🤖 Prompt for AI Agents 
.github/workflows/pr-assessment.yaml around lines 8-14: the job currently runs
for pull_request.closed which also triggers on non-merged closes; add a
job-level conditional to run only when the PR was merged by adding an if
condition that checks github.event.pull_request.merged (for example: if:
github.event.pull_request.merged == true) on the assess-pr-size-on-merge job so
the job is skipped for closed-but-not-merged events.

Comment on lines +9 to +14
Copy link

@coderabbitai coderabbitai bot Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Confirm the called workflow supports workflow_call and input types; add secrets: inherit if needed

Ensure rainlanguage/github-chore/.github/workflows/pr-assessment.yml defines on: workflow_call with inputs pr_number, repo, owner, and merged (preferably typed, e.g., boolean for merged). If it requires any secrets beyond GITHUB_TOKEN, forward them with secrets: inherit or explicit mappings.

If secrets are required, update:

   assess-pr-size-on-merge:
     if: ${{ github.event.pull_request.merged == true }}
-    uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
+    uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
+    secrets: inherit
     with:
       pr_number: ${{ github.event.pull_request.number }}
       repo: ${{ github.event.repository.name }}
       owner: ${{ github.repository_owner }}
       merged: ${{ github.event.pull_request.merged }}

Script to verify the called workflow accepts these inputs:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Fetch the reusable workflow content
content=$(gh api repos/rainlanguage/github-chore/contents/.github/workflows/pr-assessment.yml \
  -f ref='main' | jq -r '.content' | base64 --decode)

# Show workflow_call section and inputs
printf '%s\n' "$content" | awk '
  /workflow_call:/,0 { print }
' | sed -n '1,150p'

Length of output: 288

I couldn’t fetch the workflow via gh api—let’s pull it directly and inspect the workflow_call inputs:

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Download the reusable workflow
curl -fsSL \
  https://raw.githubusercontent.com/rainlanguage/github-chore/main/.github/workflows/pr-assessment.yml \
  -o pr-assessment.yml

echo "===== on: section ====="
grep -n 'on:' -A5 pr-assessment.yml || echo "no on: block found"

echo
echo "===== workflow_call inputs ====="
grep -n 'workflow_call:' -A20 pr-assessment.yml || echo "no workflow_call found"

Length of output: 1054

Let’s verify whether pr-assessment.yml references any secrets beyond the default GITHUB_TOKEN:

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Check for explicit secrets mappings
echo "=== secrets: sections ==="
grep -n 'secrets:' pr-assessment.yml || echo "No 'secrets:' sections found"

echo
# Check for any use of secrets.* in action inputs
echo "=== secrets.* usage ==="
grep -n '\${{ *secrets\.' pr-assessment.yml || echo "No secrets referenced in workflow"

Length of output: 349

Add secrets: inherit to the reusable‐workflow call

The downstream workflow defines on: workflow_call with typed inputs (pr_number, repo, owner, merged)—that part is correct. However, it also uses ${{ secrets.GITHUB_TOKEN }} inside its steps, and secrets are not forwarded by default. You need to pass them via secrets: inherit.

• In your .github/workflows/pr-assessment.yaml invocation (e.g. under assess-pr-size-on-merge), update:

   uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
+  secrets: inherit
   with:
     pr_number: ${{ github.event.pull_request.number }}
     repo:       ${{ github.event.repository.name }}
     owner:      ${{ github.repository_owner }}
     merged:     ${{ github.event.pull_request.merged }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
with:
pr_number: ${{ github.event.pull_request.number }}
repo: ${{ github.event.repository.name }}
owner: ${{ github.repository_owner }}
merged: ${{ github.event.pull_request.merged }}
uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main
secrets: inherit
with:
pr_number: ${{ github.event.pull_request.number }}
repo: ${{ github.event.repository.name }}
owner: ${{ github.repository_owner }}
merged: ${{ github.event.pull_request.merged }}
🤖 Prompt for AI Agents 
.github/workflows/pr-assessment.yaml around lines 9 to 14: the reusable workflow
is invoked with inputs under "with" but does not forward repository secrets, so
any use of secrets.GITHUB_TOKEN inside the called workflow will be empty; add a
"secrets: inherit" mapping at the same level as "with" for the reusable-workflow
call (i.e., under the job/step that has "uses:
rainlanguage/github-chore/...@main") so the caller forwards its secrets to the
reusable workflow.

Loading