[greenc-FNAL]

Summary

• Determine whether a push matches a merged PR into main using GitHub PR records rather than the committer name, including rebase merges.
• Alert for forced pushes even when they restore a previously merged PR commit, and for other direct branch updates.
• Grant read access to PR records, process push metadata safely through environment variables, and fail when Slack configuration or delivery fails.

Dependencies

This PR is independent of the actionlint/uv tooling stack and targets the latest main directly. It changes only .github/workflows/guardrail-audit-alert.yaml and can merge in either order relative to that stack. No merge queue is required by the repository rules.

Validation

• Pre-commit checks passed for the changed workflow, including pinned actionlint 1.7.12, yamllint, YAML checks, and Prettier. These ran on the preserved original combined branch to use its pinned lint hooks; the guardrail workflow was verified byte-identical to this PR branch.
• git diff --check passed.
• No live Slack webhook delivery was exercised.

Original commit: 5caedd994eaaf009618d4f9b5ac7b874f1ac964c.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 98894a7b-dea1-4ef9-b246-c5b7e45bf869

Commits

Reviewing files that changed from the base of the PR and between f3e4a74 and e32628f.

Files selected for processing: 1

• .github/workflows/guardrail-audit-alert.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

There are no active review issues for the guardrail workflow update.

No open issues 🎉

What changed in this PR

Updates the guardrail workflow to identify direct pushes to main using merged pull request records rather than committer names, supporting rebase merges.

Changes:

• Grants read access to pull requests and checks whether the pushed commit matches a merged PR.
• Always alerts on forced pushes and removes the Dependabot exemption.
• Passes push metadata through environment variables and fails on missing Slack configuration or HTTP delivery errors.

File	Description
.github/​workflows/​guardrail-audit-alert.yaml	Replaces committer-based detection with PR lookups and strengthens Slack alert error handling.

_{Review effort: Balanced}