[WRONG BRANCH] fix(ci): invalidate maintainer-sponsored on synchronize (treat sponsorship as head-specific) - #46
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughThe change exports a shared list of head-specific approval labels, tests the list, and updates the PR hygiene workflow to use it during synchronization cleanup. ChangesHead-specific approval label handling
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
changed the title
maintainer-sponsored on synchronize (treat sponsorship as head-specific)maintainer-sponsored on synchronize (treat sponsorship as head-specific)
⏳ DRAFT
What to do
Its title has been prefixed with |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/pr-sponsored-surface.test.cjs:
- Around line 11-14: Update the HEAD_SPECIFIC_APPROVAL_LABELS test to assert the
exact five-label contract, rather than only checking that "maintainer-sponsored"
is included. Use the complete expected label set defined by
HEAD_SPECIFIC_APPROVAL_LABELS and preserve the existing test’s purpose of
validating all labels cleared when the reviewed revision changes.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8ef84b0a-e33f-4ab5-bd61-76df065a10c0
📒 Files selected for processing (3)
.github/scripts/pr-sponsored-surface.cjs.github/scripts/pr-sponsored-surface.test.cjs.github/workflows/pr-hygiene.yml
| describe("HEAD_SPECIFIC_APPROVAL_LABELS", () => { | ||
| it("invalidates maintainer sponsorship when the reviewed revision changes", () => { | ||
| assert.ok(HEAD_SPECIFIC_APPROVAL_LABELS.includes("maintainer-sponsored")); | ||
| }); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
Assert the complete head-specific approval-label contract.
Line 13 checks only maintainer-sponsored. The test still passes if any of the other four labels are removed or renamed. The synchronization workflow would then stop clearing that approval after a new commit.
Assert the exact five-label set.
Proposed assertion
- assert.ok(HEAD_SPECIFIC_APPROVAL_LABELS.includes("maintainer-sponsored"));
+ assert.deepStrictEqual([...HEAD_SPECIFIC_APPROVAL_LABELS].sort(), [
+ "dependency-change-approved",
+ "generated-change-approved",
+ "maintainer-sponsored",
+ "suppression-approved",
+ "test-exception-approved",
+ ].sort());As per path instructions, .github/** is a security boundary, and workflow changes require explicit security review per MAINTAINERS.md.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| describe("HEAD_SPECIFIC_APPROVAL_LABELS", () => { | |
| it("invalidates maintainer sponsorship when the reviewed revision changes", () => { | |
| assert.ok(HEAD_SPECIFIC_APPROVAL_LABELS.includes("maintainer-sponsored")); | |
| }); | |
| describe("HEAD_SPECIFIC_APPROVAL_LABELS", () => { | |
| it("invalidates maintainer sponsorship when the reviewed revision changes", () => { | |
| assert.deepStrictEqual([...HEAD_SPECIFIC_APPROVAL_LABELS].sort(), [ | |
| "dependency-change-approved", | |
| "generated-change-approved", | |
| "maintainer-sponsored", | |
| "suppression-approved", | |
| "test-exception-approved", | |
| ].sort()); | |
| }); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/pr-sponsored-surface.test.cjs around lines 11 - 14, Update
the HEAD_SPECIFIC_APPROVAL_LABELS test to assert the exact five-label contract,
rather than only checking that "maintainer-sponsored" is included. Use the
complete expected label set defined by HEAD_SPECIFIC_APPROVAL_LABELS and
preserve the existing test’s purpose of validating all labels cleared when the
reviewed revision changes.
Source: Path instructions
1 participant
Motivation
maintainer-sponsoredlabel to survive asynchronizeevent, letting stale sponsorship authorize new, unreviewed changes to sensitive surfaces like auth, workflows, release automation, and dependency files.Description
HEAD_SPECIFIC_APPROVAL_LABELS(includesmaintainer-sponsored) in.github/scripts/pr-sponsored-surface.cjsand export it so the hygiene job can treat those approvals as head-specific..github/workflows/pr-hygiene.ymlto remove every label inHEAD_SPECIFIC_APPROVAL_LABELSon asynchronizeevent before re-evaluating the PR, preventing stale approvals from suppressingunsponsored_surface..github/scripts/pr-sponsored-surface.test.cjsasserting the sponsorship label is included among head-specific approvals.Testing
node --test .github/scripts/pr-sponsored-surface.test.cjs, which passed.bun run privacy:scan,git diff --check,bun run typecheck, andbun run lint:gui, which passed.bun run prepushand the prepush driver completed typecheck and lint steps, but the full-suite push encountered unrelated environment-sensitive failures/timeouts in some tests.bun test tests/ci-workflows.test.tsfailed in this environment due to the runtime lackingBun.YAML.parse(an environment/runtime mismatch), so full workflow tests could not be completed here.Codex Task
Summary by CodeRabbit