feat(compliance-audit): detect non-stub centralized workflow copies#89
feat(compliance-audit): detect non-stub centralized workflow copies#89
Conversation
Adds a new check to compliance-audit.sh that flags downstream repos whose Tier 1 workflows are not the canonical thin caller stubs pinned to @v1. For each centralizable workflow (claude, dependency-audit, dependabot-{automerge,rebase}, agent-shield, feature-ideation), the check distinguishes three failure modes for actionable findings: 1. Inline copy of pre-centralization logic → "is an inline copy instead of a thin caller stub" 2. References the reusable but not pinned to @v1 (e.g. @main, @v0) → "references the reusable but is not pinned to @v1" 3. Some other malformed uses: line → "the uses: line does not match the canonical stub" The central .github repo is exempt because it owns the reusables and may legitimately reference them by @main during release preparation. Verified locally with hand-crafted fixtures: stub@v1 → no finding, stub@main → flagged with the @v1 message, inline copy → flagged with the inline message, missing file → no finding (handled by check_required_workflows). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 4 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new compliance check function Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/compliance-audit.sh`:
- Around line 524-525: The grep pattern used to test decoded for
"petry-projects/.github/.github/workflows/${reusable}" uses unescaped dots so
BRE's dot will match any character; update the check in
scripts/compliance-audit.sh that uses echo "$decoded" | grep -q
"petry-projects/.github/.github/workflows/${reusable}" to perform a literal
match (either escape the dots as \\.github or switch grep to fixed-string mode
with -F) so the path is matched exactly against the variable ${reusable}.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7f7dc496-5c21-4111-bb30-fafbe4b680c8
📒 Files selected for processing (1)
scripts/compliance-audit.sh
CodeRabbit on #89: the second-branch grep used an unescaped "petry-projects/.github/.github/workflows/${reusable}" pattern, where BRE dots could in principle match any character. Switch to \`grep -F\` (fixed-string) to match the path literally. No real-world false positive observed (workflow paths contain literal dots), but the hygiene is right. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR extends the weekly scripts/compliance-audit.sh to detect drift from the org’s Tier 1 “centralized workflow” model by checking that downstream repos use the canonical thin caller stubs pinned to @v1 (and flagging inline copies or non-@v1 refs).
Changes:
- Added
check_centralized_workflow_stubsto validate Tier 1 workflow stubs referencepetry-projects/.githubreusables at@v1. - Wired the new check into the per-repo audit loop in
main().
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address remaining Copilot review feedback on #89: 1. Anchor the \`uses:\` regex to start-of-line + optional indent (\`^[[:space:]]*uses:\`) so a commented \`# uses: ...@v1\` line cannot fool the check into marking an inline workflow as compliant. Verified with a fixture: a workflow whose only mention of @v1 is in a YAML comment is now correctly flagged. 2. List \`.github/workflows/\` once per repo and short-circuit the per-file check when the workflow isn't present, instead of probing each of the six centralized files individually. Cuts up to 5 wasted gh api calls per repo (worst case ~2500 fewer requests across the org per audit run). 3. Drop the misleading "missing workflow caught by check_required_workflows" comment — only some of the six are required (claude, dependency-audit, dependabot-automerge, agent-shield); dependabot-rebase and feature-ideation are intentionally optional/conditional. The new directory-listing short-circuit handles all of these uniformly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Summary
Closes the loop on the workflow centralization effort started in #87 (build reusables) and #88 (pin to v1, document tiers). Now that the canonical stubs exist and are versioned, the weekly compliance audit can detect when a downstream repo carries an inline copy or a stale
@main/@v0reference instead of the v1 stub.What the check does
Adds
check_centralized_workflow_stubstoscripts/compliance-audit.shand wires it into the per-repo audit loop. For each Tier 1 workflow (claude.yml,dependency-audit.yml,dependabot-automerge.yml,dependabot-rebase.yml,agent-shield.yml,feature-ideation.yml):check_required_workflows)uses: petry-projects/.github/.github/workflows/<reusable>.yml@v1→ compliant@v1"standards/workflows/<file>"The central
.githubrepo is exempt because it owns the reusables.Test plan
bash -nandshellcheckcleanWhy this matters
Without this check, the centralization is best-effort: a future agent could copy an old inline workflow into a new repo and nobody would notice until something broke. With it, drift is detected at the next audit run and surfaced as a remediation issue with a precise fix instruction (re-sync from the named template).
🤖 Generated with Claude Code
Summary by CodeRabbit