Repository navigation
ci-health: report tracker credential failures once per scan - #999
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 53 minutes. View limit details
 |
| Layer / File(s) | Summary |
|---|---|
Detect missing tracker tokens scripts/ci-health/detect.sh |
The annotation scan emits a B-TRACKER-TOKEN finding for the first matching missing-credential message. It does not emit additional findings for later matches. The finding recommends comparing pins read-only before provisioning repository-scoped write access. |
Estimated code review effort: 2 (Simple) | ~5 minutes
Change: Bug fix
Possibly related issues
- 🩺 CI-health: estate failure-class report #683 — Both changes concern failure-class entries in the generated CI-health report.
Possibly related PRs
- hyperpolymath/hypatia#992 — Updates reusable-workflow pins and adds consistency checks for the stale-pin failure path referenced by this finding.
Merge Risk: 
a8b7e
-
The new tracker-token finding is detected, but its details and remediation guidance will not appear in the estate report or tracking issue. Add it to the report filter before merging, and document the class in the README.
Pre-merge checks: 
-
Check name Status Explanation Title check The title names the change: the failure-run scan in ci-health now reports tracker credential failures once per scan. The raw summary says the scan reports B-TRACKER-TOKEN once per repository when an a… Description check The description says the change is regression work for estate workflow incident triage and separates observed job-level failures from zero-job startup attribution. The changeset adds B-TRACKER-TOKEN r… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title names the change: the failure-run scan in ci-health now reports tracker credential failures once per scan. The raw summary says the scan reports B-TRACKER-TOKEN once per repository when an annotation contains either missing-AUTOMATION_TOKEN message. The title is specific and matches the changeset. It says 'once per scan' while the summary says 'once per repository', a minor wording difference that does not make the title misleading.
Full details: Description check
-
Explanation
The description says the change is regression work for estate workflow incident triage and separates observed job-level failures from zero-job startup attribution. The changeset adds B-TRACKER-TOKEN reporting in a CI health detection script. The description relates to the changeset's purpose, though it does not name the tracker credential report. The check is lenient, so it passes.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.
-
Finishing Touches
-
Generate docstrings
-
- Coding Agent task started for docstring generation.
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8b7e569c1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [ -n "${job_id:-}" ] || continue | ||
| msg=$(api "repos/$O/$R/check-runs/$job_id/annotations?per_page=100" --jq '.[].message // empty' || true) | ||
| if [ "$tracker_token_seen" = false ] && [[ "$msg" == *"Stale cicd-suite pins detected. AUTOMATION_TOKEN is required"* || "$msg" == *"AUTOMATION_TOKEN is not set. This job edits files under .github/workflows/"* ]]; then | ||
| emit B-TRACKER-TOKEN HIGH "Pin updater reports missing write credential (run $fail_id) → compare pins read-only before provisioning repository-scoped write access" |
There was a problem hiding this comment.
When this emits B-TRACKER-TOKEN, the scheduled entry point in scripts/ci-health/sweep.sh never includes it in the generated report: line 52 only selects B-(ALLOWLIST|LOCKFILE|STARTUPFAIL), while line 53 still sees the new B- row and suppresses the _none_ placeholder. Consequently, repositories with this credential failure disappear from both the workflow summary and rolling tracking issue, potentially leaving a blank B section; add the new class to the report filter.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
pretty sure that's a placeholder
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Regression work for estate workflow incident triage. Keep observed job-level failures separate from zero-job startup attribution.