Conversation
… errors Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>
|
/ai don't we already have a CI detective workflow we could just provide custom instructions to? I couldn't find it in the documentation but maybe you can |
|
Short answer: we have something close, but not equivalent.
This new workflow is specialized for the daily remediation use case: scheduled run, scans default + configurable long-term branches, matches the exact So yes, we could force this into generic/custom instructions, but the dedicated fixer gives deterministic behavior + documentation/discoverability for this recurring incident class. What is this? | From workflow: Mention in PR Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
|
/ai let's adjust the workflow here to be similar to our issue ones where we don't want to repost the same issue and so we run a script ahead of time and just have the output of that ready for the agent. In the script let's enumerate the workflows look for any logs etc so that we can tag the workflows that have this problem and write them to disk and only have the agent investigate workflows with the problem. That should make this into a fairly simple workflow for the agent to follow. Let's have it open one issue with the combined analysis of the results. Let's have an input which is the number of look-back days. And let's document how you could get somewhat similar behavior just using the scheduled audit |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a new auto-generated GitHub Actions detector/fixer workflow that scans for "Resource not accessible by integration" failures, plus trigger/reuse workflows, docs, example usage, mkdocs entry, and registration in quick-setup. Changes
Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant ReuseWorkflow as Reuse Workflow (lock.yml)
participant Prescan
participant MCP as MCP Gateway / Safe-Outputs
participant CopilotCLI as Copilot CLI / Agent
participant ThreatDetect as Threat Detector
participant GitHub as GitHub Issues / Artifacts
Scheduler->>ReuseWorkflow: trigger (cron or workflow_dispatch)
ReuseWorkflow->>Prescan: run prescan (look-back-days, branches)
Prescan->>MCP: upload prescan artifacts / start safe-outputs
ReuseWorkflow->>CopilotCLI: render prompts, start agent via Copilot CLI
CopilotCLI->>MCP: request safe outputs, fetch artifacts
CopilotCLI->>ThreatDetect: run threat-detection passes
ThreatDetect->>GitHub: create combined analysis issue / upload artifacts
ReuseWorkflow->>MCP: stop safe-outputs / teardown
ReuseWorkflow->>Scheduler: conclude (noop or create-issue)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md:
- Around line 186-203: The PR template uses a triple-backtick fenced block that
contains another triple-backtick block under the "## Failure Evidence" section,
creating nested fences; change the outer fence to a four-backtick fence and
replace the inner triple-backtick with a ```text fenced block (and the matching
closing fences) so the example log snippet is rendered correctly; update the
block that contains "## Affected Workflow" / "## Failure Evidence" accordingly
so the outer fence opens with ````markdown and closes with ```` and the inner
log snippet uses ```text and ``` to close.
- Around line 220-223: Replace the misspelled reviewer team slug
"elastic/observablt-ci" with the correct "elastic/observability-ci" wherever it
appears in the workflow text so reviewer assignment works as intended; confirm
the change by searching for the exact string "elastic/observablt-ci" and
updating it to "elastic/observability-ci" (the README already references
"elastic/observability-cicd" so only the reviewer slug in the workflow needs
correction).
ℹ️ Review info
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.lock.yml.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md.github/workflows/trigger-resource-not-accessible-by-integration-fixer.ymldocs/workflows/gh-agent-workflows.mdgh-agent-workflows/README.mdgh-agent-workflows/resource-not-accessible-by-integration-fixer/README.mdgh-agent-workflows/resource-not-accessible-by-integration-fixer/example.ymlmkdocs.ymlscripts/quick-setup.sh
.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md
Outdated
Show resolved
Hide resolved
.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md
Outdated
Show resolved
Hide resolved
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@copilot let's change this to a detection workflow (not fix) and use a step to do the failed workflow scan and ideally check the logs for the "Resource not accessible by integration" message so we create a simple file for the Agent to review which has the workflows it needs to identify remediations for |
…ok-back-days input Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>
Yes —
Done in bdfd89f. The workflow is now a detection-only workflow:
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
- Resolve merge conflict in gh-agent-workflows/README.md (keep new workflow + Elastic-specific section) - Fix issues permission: read → write so create-issue can operate - Fix inputs.title-prefix → inputs.issue-title-prefix in lock.yml for dedup search Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md (2)
196-198: Consider adding language specifier to fenced code block.The markdownlint tool flags this block for missing a language specifier (MD040). Adding
textwould silence the warning.Proposed fix
- ```` + ````text https://raw.githubusercontent.com/elastic/observability-cicd/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt ````🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md around lines 196 - 198, The fenced code block containing the URL (the four-backtick fence "````" enclosing https://raw.githubusercontent.com/elastic/observability-cicd/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt) should include a language specifier to satisfy markdownlint MD040; update the opening fence to "````text" so the block becomes a text code block.
215-246: Consider adding language specifier to the issue body template block.The markdownlint tool flags this block for missing a language specifier (MD040). Adding
markdownwould silence the warning and clarify the content type.Proposed fix
- ```` + ````markdown ## Scan Summary ...</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In @.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md
around lines 215 - 246, The code block in the template (the opening fence that
starts withfollowed by "## Scan Summary") is missing a language specifier which triggers MD040; update the opening fence to include the language specifier by changing the code fence tomarkdown so the block readsmarkdown followed by the "## Scan Summary" content and the closing, ensuring the
language is explicit and markdownlint no longer flags it.</details> </blockquote></details> </blockquote></details> <details> <summary>🤖 Prompt for all review comments with AI agents</summary>Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md:
- Around line 196-198: The fenced code block containing the URL (the
four-backtick fence "" enclosing https://raw.githubusercontent.com/elastic/observability-cicd/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt) should include a language specifier to satisfy markdownlint MD040; update the opening fence to "text" so the block becomes a text code block.- Around line 215-246: The code block in the template (the opening fence that
starts withfollowed by "## Scan Summary") is missing a language specifier which triggers MD040; update the opening fence to include the language specifier by changing the code fence tomarkdown so the block readsmarkdown followed by the "## Scan Summary" content and the closing, ensuring the
language is explicit and markdownlint no longer flags it.</details> --- <details> <summary>ℹ️ Review info</summary> **Configuration used**: Repository UI (base), Organization UI (inherited) **Review profile**: CHILL **Plan**: Pro <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 922bc15b32b0f61e1acec45df183e30f27ff2b74 and 76f1842164f1612aeacf96b2610ff7daab3dbd97. </details> <details> <summary>📒 Files selected for processing (5)</summary> * `.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.lock.yml` * `.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md` * `docs/workflows/gh-agent-workflows.md` * `gh-agent-workflows/README.md` * `mkdocs.yml` </details> <details> <summary>🚧 Files skipped from review as they are similar to previous changes (3)</summary> * mkdocs.yml * gh-agent-workflows/README.md * docs/workflows/gh-agent-workflows.md </details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
|
/ai fix pr open issues |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
/ai if now it's a detector, I think the name of the workflow and all its references shouldn't be |
There was a problem hiding this comment.
REQUEST_CHANGES: Deduplication is currently broken in .github/workflows/gh-aw-estc-actions-resource-not-accessible-detector.lock.yml (line 577), where TITLE_PREFIX is sourced from $\{\{ inputs.title-prefix }} even though the workflow defines issue-title-prefix; this makes the previous-findings search use an empty prefix and can miss existing tracking issues.
What is this? | From workflow: PR Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Summary
Adds a daily detector workflow for
Resource not accessible by integrationfailures in Elastic repositories. It scans failed GitHub Actions runs on the default branch plus optional long-term branches, then opens one combined tracking issue when matches are found.What changed
.github/workflows/gh-aw-estc-actions-resource-not-accessible-detector.md.github/workflows/gh-aw-estc-actions-resource-not-accessible-detector.lock.ymlgh-agent-workflows/estc-actions-resource-not-accessible-detector/README.mdgh-agent-workflows/estc-actions-resource-not-accessible-detector/example.ymlgh-agent-workflows/README.mddocs/workflows/gh-agent-workflows.mdmkdocs.ymlscripts/dogfood.shexclusions (not auto-dogfooded in this repository).Workflow behavior
06:00 UTCin the example trigger) and supports manual dispatch.look-back-days(default1) to define the failed-run scan window.long-term-branches, downloads logs, and matchesResource not accessible by integration.noopand does not open an issue.issue-title-prefix(default[resource-not-accessible-by-integration]) to deduplicate against equivalent open tracking issues.actions: read,contents: read, andissues: write.Similar behavior with base Scheduled Audit
The consumer README documents how to achieve similar behavior with the generic Scheduled Audit workflow via
additional-instructions.