ci: add issue approval workflows for maintainer triage - #2192
Conversation
|
What reviewer looks at during PR reviewThe following are ideal points maintainers look for during review. Reviewing these points yourself beforehand can help streamline the review process and reduce time to merge.
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review. 📝 WalkthroughWalkthroughNew GitHub Actions workflows label new issues, process maintainer-only ChangesIssue approval enforcement
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to This PR adds issue-approval and unapproved-issue PR-handling workflows; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/issue-approve-command.yml (1)
14-19: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
startsWithprefix match can be triggered by unintended comments.
startsWith(github.event.comment.body, '/approve')also matches comments like/approved,/approve-later, or/approves this. Consider requiring the command to be the whole first line or followed by whitespace/end-of-string.🩹 Suggested tightening
- startsWith(github.event.comment.body, '/approve') + (github.event.comment.body == '/approve' || startsWith(github.event.comment.body, '/approve '))Also applies to: 43-48
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/issue-approve-command.yml around lines 14 - 19, Update the command condition in the workflow’s issue-comment approval check to accept /approve only when it is the complete first line or is followed by whitespace/end-of-string, rather than using an unrestricted prefix match. Preserve the existing pull-request, state, actor, and command-flow checks while preventing variants such as /approved, /approve-later, and /approves from triggering..github/workflows/issue-awaiting-approval.yml (1)
26-39: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winUnhandled race on label creation in both "ensure label exists" blocks. Both workflows check
listLabelsForRepothen callcreateLabelif absent, with no try/catch. If two workflow runs execute this check concurrently (e.g., two issues opened together, or an approve + an issue-open racing), the loser'screateLabelcall throws (422 duplicate label) and aborts the job before the label is actually added to the issue.
.github/workflows/issue-awaiting-approval.yml#L26-L39: wrapcreateLabelfor'Awaiting Approval'in try/catch (ignore 422/"already_exists" errors) soaddLabelson Line 42 still runs..github/workflows/issue-approve-command.yml#L84-L97: wrapcreateLabelfor'Approved Issue'in try/catch (ignore 422/"already_exists" errors) soaddLabelson Line 100 still runs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/issue-awaiting-approval.yml around lines 26 - 39, Handle the label-creation race in both .github/workflows/issue-awaiting-approval.yml lines 26-39 and .github/workflows/issue-approve-command.yml lines 84-97 by wrapping each createLabel call in try/catch, ignoring only 422 or already_exists errors and rethrowing other failures; ensure the subsequent addLabels call still executes in both workflows.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/close-prs-for-unapproved-issues.yml:
- Around line 55-83: Update the error handling around
github.rest.issues.listLabelsOnIssue in the PR validation loop so a 404 response
is treated as an invalid issue reference and closes the associated PR using the
same comment-and-pulls.update flow as an unapproved issue. Preserve logging and
loop continuation for other API errors, and ensure nonexistent or mistyped issue
numbers cannot pass validation silently.
In @.github/workflows/issue-approve-command.yml:
- Around line 113-130: Update the commentBody template in the approval workflow
to close the Markdown italics around the approver attribution, preserving the
existing message text and interpolated approver value.
- Around line 42-130: Add a guard before the approval actions, using the
existing issue labels to detect whether “Approved Issue” is already present, and
return or skip the workflow when it is. Ensure the guard covers the subsequent
label and “Post approval instruction comment” steps so repeated or concurrent
/approve commands do not create duplicate approval comments.
---
Nitpick comments:
In @.github/workflows/issue-approve-command.yml:
- Around line 14-19: Update the command condition in the workflow’s
issue-comment approval check to accept /approve only when it is the complete
first line or is followed by whitespace/end-of-string, rather than using an
unrestricted prefix match. Preserve the existing pull-request, state, actor, and
command-flow checks while preventing variants such as /approved, /approve-later,
and /approves from triggering.
In @.github/workflows/issue-awaiting-approval.yml:
- Around line 26-39: Handle the label-creation race in both
.github/workflows/issue-awaiting-approval.yml lines 26-39 and
.github/workflows/issue-approve-command.yml lines 84-97 by wrapping each
createLabel call in try/catch, ignoring only 422 or already_exists errors and
rethrowing other failures; ensure the subsequent addLabels call still executes
in both workflows.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 12ced23b-b589-4b5f-be1f-7605a2fe17b5
📒 Files selected for processing (3)
.github/workflows/close-prs-for-unapproved-issues.yml.github/workflows/issue-approve-command.yml.github/workflows/issue-awaiting-approval.yml
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/close-prs-for-unapproved-issues.yml (1)
62-62: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRequire
Approved Issue, rather than absence ofAwaiting Approval.Line 62 lets a PR through whenever the pending label is absent. A PR opened immediately after its issue can therefore pass before the issue-labeling workflow adds
Awaiting Approval; it will not be reevaluated unless edited. Require the approval workflow’s positiveApproved Issuelabel instead.Proposed fix
const awaitingLabel = 'Awaiting Approval'; + const approvedLabel = 'Approved Issue'; - if (labels.some(l => l.name === awaitingLabel)) { + if (!labels.some(l => l.name === approvedLabel)) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/close-prs-for-unapproved-issues.yml at line 62, Update the label condition around the visible labels check to require the positive Approved Issue label, rather than allowing the PR when Awaiting Approval is absent. Preserve the existing close/skip behavior for PRs without approval, and use the workflow’s established approval-label symbol if one exists.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/close-prs-for-unapproved-issues.yml:
- Line 62: Update the label condition around the visible labels check to require
the positive Approved Issue label, rather than allowing the PR when Awaiting
Approval is absent. Preserve the existing close/skip behavior for PRs without
approval, and use the workflow’s established approval-label symbol if one
exists.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c18a9617-66c3-4b5d-b3ef-456dbc5ea08c
📒 Files selected for processing (3)
.github/workflows/close-prs-for-unapproved-issues.yml.github/workflows/issue-approve-command.yml.github/workflows/issue-awaiting-approval.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/issue-awaiting-approval.yml
- .github/workflows/issue-approve-command.yml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/issue-awaiting-approval.yml:
- Around line 17-20: Replace the checkout action with actions/github-script
pinned to a full commit SHA wherever the JavaScript script runs:
.github/workflows/issue-awaiting-approval.yml lines 17-20; all four script steps
in .github/workflows/issue-approve-command.yml at lines 25-30, 54-57, 82-85, and
120-125; and .github/workflows/close-prs-for-unapproved-issues.yml lines 19-22.
Preserve each step’s existing script and inputs while ensuring github and core
are provided by github-script.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 647627c2-68ce-4b7e-b4c9-9689394bf8db
📒 Files selected for processing (3)
.github/workflows/close-prs-for-unapproved-issues.yml.github/workflows/issue-approve-command.yml.github/workflows/issue-awaiting-approval.yml
|
4 participants
Description
issue-awaiting-approval.yml— automatically labels every newly opened issue withAwaiting Approvalissue-approve-command.yml— lets authorized maintainers (derberg,Adi-204) approve issues via/approvecomment command, which removesAwaiting Approval, addsApproved Issue, and posts a contributor instruction comment with approval attributionclose-prs-for-unapproved-issues.yml— automatically closes PRs that either reference an unapproved issue (still labeledAwaiting Approval) or don't reference any issue at all, with an explanatory comment in both casesactions/github-script@v7,secrets.GH_TOKEN) and auto-create labels if they don't exist yetRelated issue(s)
Resolves #1838
AI assistance
Generated-by: Claude Opus 4.6Summary by CodeRabbit
/approvecommand for authorized maintainers, including feedback for unauthorized attempts.