refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver) - #34
Conversation
Move github.md to references/ per CONTRIBUTING.md convention and make it the single source of truth for GitHub command primitives. SKILL.md steps now reference its sections instead of inlining the commands, cutting ~120 lines of verbatim duplication. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Drop the claim that other skills reuse this file — the sibling code-review skill is CLI-based and has no GitHub API usage. The intro now accurately scopes the file to the autofix skill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add an Overview heading, rename Key Notes to Guidelines and move it ahead of the workflow so its safety rules load before execution, and label the Step 4 issue table as the output format. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…mat.md Move Step 4's extraction fields, severity mapping, Action derivation, and output table into a reference file loaded at display time. Also fold the Overview's untrusted-input warning into the equivalent Guidelines bullet, broadening it to cover all comment bodies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe autofix skill centralizes safety rules, GitHub procedures, issue parsing, and review summary templates in shared reference documents. ChangesAutofix workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/autofix/references/github.md`:
- Around line 141-151: Define issue_count from the local workflow state before
constructing the neutral review-complete comment, then use an expansion-enabled
heredoc or printf so the posted message contains the actual count instead of the
literal <issue-count>. Update the gh pr comment flow shown in the no-fixes path
while preserving the existing message and formatting.
In `@skills/autofix/references/issue-format.md`:
- Around line 33-40: Update the fenced code block in the issue-format
documentation to use markdown as its opening fence language, while preserving
the existing example content and closing fence.
- Around line 24-28: Update the Action Derivation guidance and corresponding
Step 4/Step 6 instructions in SKILL.md so validity-dependent action selection is
not finalized during Step 4 parsing: either move the LOW/invalid/non-actionable
override to Step 6 after local inspection, or explicitly define Step 4’s result
as provisional and require updating it after that judgment. Preserve the
CRITICAL/HIGH/MEDIUM Fix mapping and flag any ambiguity or conflict in the path
instructions.
- Around line 7-14: Add an explicit Issue Title field to the CodeRabbit thread
extraction format, defining its source as the exact CodeRabbit root-comment
title and requiring it to be preserved verbatim rather than paraphrased or
inferred. Align this rule with the exact-title requirement in the autofix
workflow, and flag any ambiguous or conflicting title guidance.
In `@skills/autofix/SKILL.md`:
- Around line 36-58: Insert one blank line immediately after the “Required
State” heading in SKILL.md and before its list, preserving the existing list
content and formatting.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: f05ec317-f12b-460b-89b8-1e1becad9010
📒 Files selected for processing (3)
skills/autofix/SKILL.mdskills/autofix/references/github.mdskills/autofix/references/issue-format.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / 0_verify.txt: Hotfix/autofix brevity
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / verify: Hotfix/autofix brevity
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
📓 Path-based instructions (1)
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/autofix/SKILL.md
🪛 LanguageTool
skills/autofix/SKILL.md
[uncategorized] ~36-~36: The official name of this software platform is spelled with a capital “H”.
Context: ..., summary comments) live in references/github.md. Read the r...
(GITHUB)
[uncategorized] ~36-~36: The official name of this software platform is spelled with a capital “H”.
Context: ... comments) live in references/github.md. Read the referenced section before...
(GITHUB)
[style] ~51-~51: Consider using a different verb for a more formal wording.
Context: ...t only the files needed to validate and fix the reported issue - **Keep outbound co...
(FIX_RESOLVE)
[uncategorized] ~84-~84: The official name of this software platform is spelled with a capital “H”.
Context: ...number` with the command in references/github.md §1. **If n...
(GITHUB)
[uncategorized] ~84-~84: The official name of this software platform is spelled with a capital “H”.
Context: ... the command in references/github.md §1. If no PR: Ask "Create PR?" → ...
(GITHUB)
[uncategorized] ~92-~92: The official name of this software platform is spelled with a capital “H”.
Context: ...ck Resolve owner/repo (references/github.md §2), then f...
(GITHUB)
[uncategorized] ~92-~92: The official name of this software platform is spelled with a capital “H”.
Context: ...owner/repo (references/github.md §2), then fetch all review threads wit...
(GITHUB)
[uncategorized] ~192-~192: The official name of this software platform is spelled with a capital “H”.
Context: ...ing the success template in references/github.md §4. **If n...
(GITHUB)
[uncategorized] ~192-~192: The official name of this software platform is spelled with a capital “H”.
Context: ...ess template in references/github.md §4. If no fixes were applied: Ski...
(GITHUB)
🪛 markdownlint-cli2 (0.23.2)
skills/autofix/references/issue-format.md
[warning] 33-33: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
skills/autofix/SKILL.md
[warning] 38-38: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🔇 Additional comments (4)
skills/autofix/SKILL.md (2)
24-26: LGTM!
84-94: LGTM!skills/autofix/references/github.md (1)
5-5: LGTM!skills/autofix/references/issue-format.md (1)
18-27: 🎯 Functional CorrectnessDefine how security priority affects action and ordering.
Line [22] says that
🔒 Securityis high priority. Lines [26-27] deriveActiononly from normalized severity. A security issue paired with🟢 Info/Suggestiontherefore remainsLOWandReview. Confirm whether security overrides severity. If it does, define one normalized value and reuse it for bothActionand Step 6 ordering.As per path instructions, flag ambiguous or conflicting guidance.
Source: Path instructions
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fixes Applied SuccessfullyFixed 3 file(s) based on 5 CodeRabbit feedback item(s). Files modified:
Commit: The latest autofix changes are on the |
tanderson-tns
changed the title
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
skills/autofix/references/issue-format.md (1)
34-45: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winEscape reviewer text before rendering the Markdown table.
The output inserts the exact issue title and description directly into table cells. A
|changes the column structure, and line breaks are not valid table-cell content. GitHub documents escaping a literal pipe as\|. (docs.github.com)Preserve raw fields for exact-title requirements. Escape table delimiters and render line breaks safely for display.
As per path instructions, flag ambiguous guidance.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/autofix/references/issue-format.md` around lines 34 - 45, Update the output-format guidance to require escaping issue titles and descriptions before inserting them into Markdown table cells, including replacing literal pipes with \| and rendering line breaks safely. Preserve raw reviewer fields separately for exact-title requirements, and explicitly flag ambiguous guidance as required by the path instructions.Source: Path instructions
skills/autofix/SKILL.md (1)
30-37: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDeclare
jqand reconcile the PR prerequisite.
- The pagination loop invokes standalone
jqatreferences/github.mdlines 82, 86, and 87. Addjqto Required Tools and verifyjq --version, or replace these calls with supportedghformatting.- Required State requires an open PR, but Step 2 handles the no-PR case and offers PR creation. Make the prerequisite and workflow path consistent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/autofix/SKILL.md` around lines 30 - 37, Update the Required Tools section to include jq and verify it with jq --version, unless the standalone jq calls in the pagination loop of the GitHub reference are replaced with supported gh formatting. Reconcile the open-PR prerequisite with Step 2 by either requiring an existing open PR and removing the creation path, or documenting no-PR handling and creation as an allowed workflow state.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/autofix/references/issue-format.md`:
- Around line 25-32: Update the Step 6 workflow in SKILL.md to explicitly
process issues initially assigned the Review action, including local validation
and summary tracking for their no-fix outcomes. Preserve the documented
LOW-to-Review mapping in the Action Derivation section, or consistently change
that mapping and all downstream handling; flag any ambiguity or conflict between
these instructions.
In `@skills/autofix/SKILL.md`:
- Around line 39-43: Update the “Required State” section in SKILL.md to remove
the open-PR requirement from the initial prerequisites, making an existing PR
optional until Step 2 can check for one and create it when absent. Preserve the
GitHub repository and current-branch requirements, and ensure the documented
flow does not make the no-PR creation path unreachable.
---
Outside diff comments:
In `@skills/autofix/references/issue-format.md`:
- Around line 34-45: Update the output-format guidance to require escaping issue
titles and descriptions before inserting them into Markdown table cells,
including replacing literal pipes with \| and rendering line breaks safely.
Preserve raw reviewer fields separately for exact-title requirements, and
explicitly flag ambiguous guidance as required by the path instructions.
In `@skills/autofix/SKILL.md`:
- Around line 30-37: Update the Required Tools section to include jq and verify
it with jq --version, unless the standalone jq calls in the pagination loop of
the GitHub reference are replaced with supported gh formatting. Reconcile the
open-PR prerequisite with Step 2 by either requiring an existing open PR and
removing the creation path, or documenting no-PR handling and creation as an
allowed workflow state.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 2a4862f8-4d75-496a-9cdb-69b3f2f94ece
📒 Files selected for processing (3)
skills/autofix/SKILL.mdskills/autofix/references/github.mdskills/autofix/references/issue-format.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / 0_verify.txt: Hotfix/autofix brevity
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / verify: Hotfix/autofix brevity
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
📓 Path-based instructions (1)
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/autofix/SKILL.md
🔇 Additional comments (5)
skills/autofix/SKILL.md (2)
24-29: LGTM!Also applies to: 45-60
86-96: LGTM!Also applies to: 112-112, 194-200
skills/autofix/references/github.md (2)
1-5: LGTM!
119-158: LGTM!skills/autofix/references/issue-format.md (1)
1-16: LGTM!
| ## Action Derivation | ||
|
|
||
| Actions derived at parse time (Step 4) are provisional — severity-based only. | ||
|
|
||
| - `Fix` for CRITICAL, HIGH, or MEDIUM issues | ||
| - `Review` for LOW issues | ||
|
|
||
| During Step 6, downgrade any issue to `Review` if local inspection judges it invalid or non-actionable. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Define the Step 6 route for Review actions.
This specification maps LOW issues to Review, but SKILL.md Step 6 only processes Fix issues in severity order. A LOW issue can therefore be displayed and then omitted without local validation or summary tracking.
Process Review items explicitly in Step 6 and record their no-fix outcome, or change the action mapping and update the downstream workflow.
As per path instructions, flag ambiguous or conflicting guidance.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/autofix/references/issue-format.md` around lines 25 - 32, Update the
Step 6 workflow in SKILL.md to explicitly process issues initially assigned the
Review action, including local validation and summary tracking for their no-fix
outcomes. Preserve the documented LOW-to-Review mapping in the Action Derivation
section, or consistently change that mapping and all downstream handling; flag
any ambiguity or conflict between these instructions.
Source: Path instructions
There was a problem hiding this comment.
CodeRabbit chat interactions are restricted to organization members for this repository. Ask an organization member to interact with CodeRabbit, or set chat.allow_non_org_members: true in your configuration.
There was a problem hiding this comment.
CodeRabbit chat interactions are restricted to organization members for this repository. Ask an organization member to interact with CodeRabbit, or set chat.allow_non_org_members: true in your configuration.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fixes Applied SuccessfullyFixed 1 file(s) based on 2 CodeRabbit feedback item(s). Files modified:
Commit: The latest autofix changes are on the |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/autofix/SKILL.md (1)
196-202: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPost the success summary only after a successful push.
Step 9 makes
git pushoptional, but Lines [196]-[202] still allow a success comment and reaction whenever a fix was applied. If the user declines the push, the PR does not contain the fix while the workflow reports success. Gate both actions on a successful push. Otherwise, keep the result local and do not update the PR.Proposed fix
-If at least one fix was applied: +If at least one fix was applied and the consolidated commit was pushed successfully: Post one success summary comment on the PR. -Optionally react to CodeRabbit's main comment with 👍. +If the success comment was posted, optionally react to CodeRabbit's main comment with 👍.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/autofix/SKILL.md` around lines 196 - 202, Update the success-summary comment and optional CodeRabbit reaction flow so both execute only after a successful git push. When the push is declined or fails, keep the applied fixes local and do not post or react on the PR; retain the existing no-fixes behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@skills/autofix/SKILL.md`:
- Around line 196-202: Update the success-summary comment and optional
CodeRabbit reaction flow so both execute only after a successful git push. When
the push is declined or fails, keep the applied fixes local and do not post or
react on the PR; retain the existing no-fixes behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 223251ba-9483-4e18-b5a4-00cea04c0b3e
📒 Files selected for processing (1)
skills/autofix/SKILL.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / 0_verify.txt: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / verify: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
📓 Path-based instructions (1)
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/autofix/SKILL.md
🔇 Additional comments (2)
skills/autofix/SKILL.md (2)
24-60: LGTM!Also applies to: 86-96, 112-112
159-161: 🎯 Functional CorrectnessDefine the consent path for
Reviewitems.Line [159] allows local validation only when the user asks. Lines [159]-[161] then require the final summary to record each item as
reviewed-without-fix. Step 5 does not state whether selectingReview issuesis that request. State this explicitly. Otherwise, record unvalidated items asdeferred.As per path instructions, flag ambiguous or conflicting guidance.
Source: Path instructions
Step 10 posted "Fixes Applied Successfully" and reacted 👍 whenever fixes were applied, even if the Step 9 push was declined or failed — publicly citing a commit absent from the remote. Both actions now require a successful push; unpushed fixes stay local with no PR activity, and the no-fixes neutral path is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/autofix/SKILL.md (1)
35-37: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winScope the GitHub CLI authentication check to the repository host.
Resolve the repository host from the current Git remote, then run
gh auth status --hostname <host> --activeand stop the workflow if it exits non-zero. The bare command checks all configured hosts, so an unrelated authentication issue can block a valid run. Without an explicit failure condition, the workflow can continue without valid authentication for the target host.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/autofix/SKILL.md` around lines 35 - 37, Update the GitHub CLI authentication step in SKILL.md to resolve the host from the current Git remote, then run gh auth status with --hostname <host> --active. Treat any non-zero exit status as a hard stop before continuing the workflow, and preserve the existing reference to references/github.md for subsequent GitHub command primitives.Source: Path instructions
♻️ Duplicate comments (1)
skills/autofix/SKILL.md (1)
39-43: 🎯 Functional Correctness | 🟠 MajorMove the CodeRabbit-review prerequisite to Step 3.
Required Statestill requires a PR reviewed by CodeRabbit. Step 2 handles the case where no PR exists and asks the user to create one. Enforcing Line [43] first makes that path unreachable.Keep repository and branch requirements in the initial prerequisites. Check for a completed CodeRabbit review immediately before Step 3.
Proposed fix
### Required State - Git repo on GitHub - An open PR on the current branch (optional — Step 2 offers to create one) -- PR reviewed by CodeRabbit bot (`coderabbitai`, `coderabbit[bot]`, `coderabbitai[bot]`) ... ### Step 3: Fetch Thread-Aware CodeRabbit Feedback +Require a CodeRabbit-reviewed PR before fetching review threads.As per path instructions, flag ambiguous or conflicting guidance.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/autofix/SKILL.md` around lines 39 - 43, Remove the CodeRabbit review requirement from the Required State section, leaving only the GitHub repository and current-branch requirements there. Add the completed CodeRabbit review check immediately before Step 3, after Step 2 can handle creating a missing PR, and flag any conflicting or ambiguous path guidance encountered.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@skills/autofix/SKILL.md`:
- Around line 35-37: Update the GitHub CLI authentication step in SKILL.md to
resolve the host from the current Git remote, then run gh auth status with
--hostname <host> --active. Treat any non-zero exit status as a hard stop before
continuing the workflow, and preserve the existing reference to
references/github.md for subsequent GitHub command primitives.
---
Duplicate comments:
In `@skills/autofix/SKILL.md`:
- Around line 39-43: Remove the CodeRabbit review requirement from the Required
State section, leaving only the GitHub repository and current-branch
requirements there. Add the completed CodeRabbit review check immediately before
Step 3, after Step 2 can handle creating a missing PR, and flag any conflicting
or ambiguous path guidance encountered.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: ac4f0e47-d714-41e1-9552-e61673e986d9
📒 Files selected for processing (1)
skills/autofix/SKILL.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / 0_verify.txt: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / verify: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
📓 Path-based instructions (1)
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/autofix/SKILL.md
🪛 LanguageTool
skills/autofix/SKILL.md
[uncategorized] ~196-~196: The official name of this software platform is spelled with a capital “H”.
Context: ...ing the success template in references/github.md §4. Optiona...
(GITHUB)
[uncategorized] ~196-~196: The official name of this software platform is spelled with a capital “H”.
Context: ...ess template in references/github.md §4. Optionally react to CodeRabbit's m...
(GITHUB)
🔇 Additional comments (2)
skills/autofix/SKILL.md (2)
86-96: LGTM!Also applies to: 112-112, 159-161
196-202: 🔒 Security & PrivacyThe §4 summary templates do not echo issue titles. They publish only local counts, file paths, commit SHA, and branch name. Other Step 10 outbound paths are not established.
Bare `gh auth status` passes when authenticated to any GitHub host and defined no failure behavior. Resolve the host from the origin remote, verify with `gh auth status --hostname <host> --active`, and treat any non-zero exit as a hard stop. Command lives in references/github.md Prerequisites; SKILL.md states the requirement and hard-stop rule. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Requiring a completed review upfront contradicted Step 3, which explicitly handles in-progress and missing reviews with graceful exits. State the check happens at Step 3 instead; bot logins remain documented in Step 3's thread filter where they are used. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/autofix/references/github.md`:
- Around line 9-16: Update the remote-host parsing and authentication workflow
in the GitHub instructions to correctly extract the hostname from HTTPS,
scp-style SSH, and ssh:// remotes without returning “ssh”. Export the resolved
host as GH_HOST before subsequent workflow commands, and add --hostname "$host"
to gh api invocations where needed so every gh operation targets the
repository’s actual GitHub host.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: c81ee429-7b87-4f4f-a796-e9235d5be2c8
📒 Files selected for processing (2)
skills/autofix/SKILL.mdskills/autofix/references/github.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / verify: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / 0_verify.txt: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
📓 Path-based instructions (1)
skills/**/SKILL.md
⚙️ CodeRabbit configuration file
skills/**/SKILL.md: Keep skill Markdown focused on domain context, routing, and workflow framing.
Put repeatable deterministic operations in referenced scripts or tools when practical.
Use focused references for details that are only needed in some workflows.
Flag ambiguous or conflicting guidance.
Keep guidance portable across declared agents unless it is explicitly scoped.
Verify CLI commands and options against current public documentation.
Check the Agent Skills specification, the AGENTS.md open format, and the
current public documentation for every declared host agent.
Files:
skills/autofix/SKILL.md
🪛 LanguageTool
skills/autofix/SKILL.md
[uncategorized] ~35-~35: The official name of this software platform is spelled with a capital “H”.
Context: ...remote using the command in references/github.md (Prerequisi...
(GITHUB)
[uncategorized] ~35-~35: The official name of this software platform is spelled with a capital “H”.
Context: ...ing the command in references/github.md (Prerequisites). Any failure is a h...
(GITHUB)
🔇 Additional comments (3)
skills/autofix/SKILL.md (1)
24-58: LGTM!Also applies to: 85-97, 113-113, 160-162, 197-203
skills/autofix/references/github.md (2)
127-133: LGTM!Also applies to: 135-166
134-134: 🎯 Functional CorrectnessDo not filter blank lines.
git show --name-only --pretty=format: HEADemits onlyfile.txtfor the tested commit, so no empty `- `` entry is produced.> Likely an incorrect or invalid review comment.
| - `gh` authenticated for the host of the current repository's remote — verify with: | ||
|
|
||
| ```bash | ||
| host=$(git remote get-url origin | sed -E 's#^(https?://|git@)##; s#[:/].*$##') | ||
| gh auth status --hostname "$host" --active | ||
| ``` | ||
|
|
||
| A non-zero exit status is a hard stop: do not continue the workflow. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for remote in \
'https://github.com/org/repo.git' \
'git@github.com:org/repo.git' \
'ssh://git@github.com/org/repo.git'; do
host=$(printf '%s\n' "$remote" |
sed -E 's#^(https?://|git@)##; s#[:/].*$##')
printf '%s -> %s\n' "$remote" "$host"
done
gh help api | grep -F -- '--hostname'Repository: coderabbitai/skills
Length of output: 378
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- reference file map ---'
wc -l skills/autofix/references/github.md
printf '%s\n' '--- relevant sections ---'
sed -n '1,35p' skills/autofix/references/github.md
sed -n '115,175p' skills/autofix/references/github.md
printf '%s\n' '--- GitHub CLI operations in the file ---'
rg -n -C 3 'gh (auth|api|pr|issue|repo)|GH_HOST|hostname|git remote get-url' skills/autofix/references/github.md
printf '%s\n' '--- related instructions ---'
find .. -name SKILL.md -printRepository: coderabbitai/skills
Length of output: 5495
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import re
remotes = [
"https://github.com/org/repo.git",
"http://github.com/org/repo.git",
"git@github.com:org/repo.git",
"ssh://git@github.com/org/repo.git",
"ssh://github.com/org/repo.git",
"ssh://git@github.com:2222/org/repo.git",
"git+ssh://git@github.com/org/repo.git",
"https://user:pass@github.example.com/org/repo.git",
]
pattern = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://|^[^`@/`]+@|[:/].*$")
for remote in remotes:
# Model the proposed sed expression as three ordered substitutions.
value = re.sub(r"^[A-Za-z][A-Za-z0-9+.-]*://", "", remote)
value = re.sub(r"^[^`@/`]+@", "", value)
value = re.sub(r"[:/].*$", "", value)
print(f"{remote} -> {value}")
PYRepository: coderabbitai/skills
Length of output: 559
Use one canonical GitHub host for all gh operations.
The parser returns ssh for valid ssh://git@github.com/org/repo.git remotes. The workflow then stops incorrectly. Other gh commands also omit the host, so GitHub Enterprise operations can target github.com.
Parse all supported remote forms, then export GH_HOST="$host" before the workflow commands. Also pass --hostname "$host" to gh api when appropriate.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/autofix/references/github.md` around lines 9 - 16, Update the
remote-host parsing and authentication workflow in the GitHub instructions to
correctly extract the hostname from HTTPS, scp-style SSH, and ssh:// remotes
without returning “ssh”. Export the resolved host as GH_HOST before subsequent
workflow commands, and add --hostname "$host" to gh api invocations where needed
so every gh operation targets the repository’s actual GitHub host.
The host parser returned "ssh" for ssh:// remotes, wrongly hard-stopping valid setups, and gh api defaults to github.com regardless of repo context, so GHE repos would query the wrong host. Parse scheme, user@, and port correctly; resolve host in §2 and pass --hostname to the GraphQL call. gh pr commands resolve hosts natively and GH_HOST is deliberately not exported — a bad parse would poison every command instead of one flagged call. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/autofix/references/github.md`:
- Line 64: Validate the host derived from the remote before the GraphQL request
in the surrounding script, allowing only github.com or explicitly configured
Enterprise hosts; reject any other host before invoking gh api or forwarding
credentials, while preserving the existing approved-host request flow.
- Around line 45-48: Validate the remote-derived host immediately after it is
assigned and before any authenticated gh api calls. Allow only github.com and
approved GitHub Enterprise hostnames, reject all other values with a failure,
and ensure the existing authentication flow does not proceed when validation
fails.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 01021996-277c-47a9-ad50-63bcd4d8f005
📒 Files selected for processing (1)
skills/autofix/references/github.md
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: Required approver / 0_verify.txt: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
GitHub Actions: Required approver / verify: refactor: autofix skill (tools: edited autofix + devclarityai/devclarity-marketplace:skill-improver)
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1mowner="${REPOSITORY%%/*}"�[0m
�[36;1mrepo="${REPOSITORY#*/}"�[0m
�[36;1m�[0m
�[36;1mresponse="$(�[0m
�[36;1m gh api graphql \�[0m
�[36;1m -f owner="$owner" \�[0m
�[36;1m -f repo="$repo" \�[0m
�[36;1m -F number="$PR_NUMBER" \�[0m
�[36;1m -f query='�[0m
�[36;1m query($owner: String!, $repo: String!, $number: Int!) {�[0m
�[36;1m repository(owner: $owner, name: $repo) {�[0m
�[36;1m pullRequest(number: $number) {�[0m
�[36;1m isDraft�[0m
�[36;1m reviews(last: 100) {�[0m
�[36;1m nodes {�[0m
�[36;1m author {�[0m
�[36;1m login�[0m
�[36;1m }�[0m
�[36;1m commit {�[0m
�[36;1m oid�[0m
�[36;1m }�[0m
�[36;1m state�[0m
�[36;1m submittedAt�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m }�[0m
�[36;1m '�[0m
�[36;1m)"�[0m
�[36;1m�[0m
�[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
�[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
�[36;1m echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1mapproved_by="$(�[0m
�[36;1m jq -r \�[0m
�[36;1m --arg head "$HEAD_SHA" \�[0m
�[36;1m --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
�[36;1m '�[0m
�[36;1m .data.repository.pullRequest.reviews.nodes�[0m
�[36;1m | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
�[36;1m | sort_by(.author.login)�[0m
�[36;1m | group_by(.author.login)�[0m
�[36;1m | map(max_by(.submittedAt))�[0m
�[36;1m | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
�[36;1m | first.author.login // empty�[0m
�[36;1m ...
🧰 Additional context used
🪛 LanguageTool
skills/autofix/references/github.md
[uncategorized] ~48-~48: The official name of this software platform is spelled with a capital “H”.
Context: ...ed --hostname "$host" (its default is github.com regardless of repo context). ## 3...
(GITHUB)
🔇 Additional comments (2)
skills/autofix/references/github.md (2)
12-13: LGTM!
130-169: LGTM!
| host=$(git remote get-url origin | sed -E 's#^[a-zA-Z+]+://##; s#^[^@/]+@##; s#[:/].*$##') | ||
| ``` | ||
|
|
||
| `gh pr` commands resolve the host from the repo's remotes natively; only `gh api` calls need `--hostname "$host"` (its default is `github.com` regardless of repo context). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- github.md ---'
sed -n '1,190p' skills/autofix/references/github.md
printf '%s\n' '--- SKILL.md relevant sections ---'
sed -n '1,115p' skills/autofix/SKILL.md
printf '%s\n' '--- host and gh api references ---'
rg -n -C 3 '\bhost\b|gh api|remote get-url|auth status' skills/autofixRepository: coderabbitai/skills
Length of output: 13760
🌐 Web query:
GitHub CLI gh auth status --hostname arbitrary host GH_TOKEN gh api --hostname authentication behavior official documentation
💡 Result:
The behavior of the GitHub CLI (gh) concerning the --hostname flag differs significantly between gh auth status and gh api. gh auth status When using the --hostname flag with gh auth status, the CLI restricts its authentication check to only the specified host [1][2]. The command verifies the stored authentication credentials for that host by performing an API round-trip to ensure the token is still valid [3]. If an account on the specified host has authentication issues, the command exits with a non-zero status (1) and writes an error message to stderr [1][2][4]. If the specified hostname is not configured in your gh environment, it may result in an error message or exit code depending on the version and specific configuration [5]. gh api When using the --hostname flag with gh api, the flag specifies the target GitHub instance for the API request [6][7]. If not provided, it defaults to github.com [8][6]. The command will use the authentication token associated with that specific host in your gh configuration to authorize the request [7]. If you are not authenticated to the target hostname, the request will fail because the CLI requires authentication to perform API operations [9][7]. In summary, for gh auth status, --hostname acts as a filter for reporting the status of known accounts [1][2]; for gh api, it acts as a target destination selector to determine which configured credentials to use for the request [6][7].
Citations:
- 1: https://cli.github.com/manual/gh_auth_status
- 2: https://github.com/cli/cli/blob/trunk/pkg/cmd/auth/status/status.go
- 3: Add JSON output to
gh auth statuscli/cli#11544 - 4: Exit with 1 on authentication issues cli/cli#9240
- 5: gh auth status -h <enterprise host> passes if host not yet configured cli/cli#2775
- 6: https://cli.github.com/manual/gh_api
- 7: https://docs.github.com/en/enterprise-cloud@latest/rest/using-the-rest-api/getting-started-with-the-rest-api
- 8: https://cli.github.com/manual/gh_help_reference
- 9: https://docs.github.com/en/rest/using-the-rest-api/getting-started-with-the-rest-api?tool=cli
🌐 Web query:
GitHub CLI source gh auth status hostname token selection api hostname credentials GH_TOKEN
💡 Result:
The GitHub CLI (gh) determines which authentication token to use based on a strict precedence order and per-hostname resolution [1][2]. When making API requests, the CLI resolves the token for the target hostname [2]. Token Precedence For any given GitHub host, the CLI evaluates sources in the following order of highest to lowest precedence [1]: 1. Environment Variables: If specific environment variables are set, they override all other configurations [1]. - For enterprise hosts, GH_ENTERPRISE_TOKEN or GITHUB_ENTERPRISE_TOKEN are checked first [1]. - Generally, GH_TOKEN and GITHUB_TOKEN take precedence [1]. 2. Configuration File & Keyring: If no environment variable is present, the CLI looks at its configuration (typically stored in hosts.yml) [1]. This configuration points to tokens stored securely in the system keyring or, if the keyring is unavailable or configured otherwise, in a plain text file [3][1]. Active Account & Hostname Selection - The CLI enforces a mapping of accounts to hosts [4]. - While multiple accounts can be configured for a single host, only one account can be marked as "active" at a time [4][5]. - API requests use the token associated with the "active" account for the target hostname [4][2]. - You can change the active account for a host using the gh auth switch command [6][4]. - When running commands, you can use the --hostname flag to explicitly target a specific host [6][7][8]. For non-interactive automation, the --user flag (combined with --hostname) can be used with commands like gh auth token to disambiguate accounts [7][4]. gh auth status - The gh auth status command displays the current authentication state for all known hosts [6][8]. - It identifies the active account for each host [6]. - Use --show-token to display the actual token (use caution) or --json to output machine-readable status information [6]. - If you have authentication issues, the command returns an exit code of 1 [6][9]. Note on Redirects: To prevent token leakage, the CLI strips the Authorization header if a request is redirected to a different hostname (e.g., from api.github.com to a third-party domain) [2].
Citations:
- 1: https://github.com/cli/go-gh/blob/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go
- 2: https://readoss.com/en/cli/cli/http-middleware-auth-injection-github-api-client
- 3: https://cli.github.com/manual/gh_auth_login
- 4: https://github.com/cli/cli/blob/trunk/docs/multiple-accounts.md
- 5: Add JSON output to
gh auth statuscli/cli#11544 - 6: https://cli.github.com/manual/gh_auth_status
- 7: https://cli.github.com/manual/gh_auth_token
- 8: https://manpages.debian.org/trixie/gh/gh-auth-status.1.en.html
- 9: https://github.com/cli/cli/blob/trunk/pkg/cmd/auth/status/status.go
🏁 Script executed:
#!/bin/bash
set -eu
for url in \
https://raw.githubusercontent.com/cli/go-gh/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go \
https://raw.githubusercontent.com/cli/cli/trunk/pkg/cmd/auth/status/status.go \
https://raw.githubusercontent.com/cli/cli/trunk/pkg/cmd/api/api.go
do
echo "--- $url ---"
curl -fsSL "$url" | rg -n -C 5 'GH_TOKEN|GITHUB_TOKEN|GH_ENTERPRISE_TOKEN|GITHUB_ENTERPRISE_TOKEN|hostname|Authorization|api\.github'
doneRepository: coderabbitai/skills
Length of output: 10904
🏁 Script executed:
#!/bin/bash
set -eu
echo '--- token selection ---'
curl -fsSL https://raw.githubusercontent.com/cli/go-gh/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go |
sed -n '30,125p'
echo '--- hostname validation ---'
curl -fsSL https://raw.githubusercontent.com/cli/cli/trunk/pkg/cmd/api/api.go |
sed -n '230,245p'
curl -fsSL https://raw.githubusercontent.com/cli/cli/trunk/internal/ghinstance/ghinstance.go |
rg -n -C 8 'HostnameValidator|func HostnameValidator'Repository: coderabbitai/skills
Length of output: 3918
🏁 Script executed:
#!/bin/bash
set -eu
api=https://api.github.com/repos/cli/cli/contents/internal/ghinstance
curl -fsSL "$api" |
jq -r '.[].download_url' |
while read -r url; do
echo "--- $url ---"
curl -fsSL "$url" | rg -n -C 8 'HostnameValidator|hostname.*valid|IsEnterprise|github\.com|net\.ParseIP|localhost'
doneRepository: coderabbitai/skills
Length of output: 206
SSRF (CWE-918): Server-Side Request Forgery (SSRF)
Validate the remote-derived host before API calls.
The authentication check does not restrict host to approved GitHub or GitHub Enterprise hosts. If an untrusted checkout supplies a host with matching credentials, gh api graphql --hostname "$host" sends an authenticated request there. Add an explicit allowlist and fail closed.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~48-~48: The official name of this software platform is spelled with a capital “H”.
Context: ...ed --hostname "$host" (its default is github.com regardless of repo context). ## 3...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/autofix/references/github.md` around lines 45 - 48, Validate the
remote-derived host immediately after it is assigned and before any
authenticated gh api calls. Allow only github.com and approved GitHub Enterprise
hostnames, reject all other values with a failure, and ensure the existing
authentication flow does not proceed when validation fails.
| fi | ||
|
|
||
| response=$(gh api graphql "${args[@]}" -f query='query($owner:String!, $repo:String!, $pr:Int!, $cursor:String) { | ||
| response=$(gh api graphql --hostname "$host" "${args[@]}" -f query='query($owner:String!, $repo:String!, $pr:Int!, $cursor:String) { |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- github.md relevant sections ---'
cat -n skills/autofix/references/github.md | sed -n '1,190p'
printf '%s\n' '--- SKILL.md prerequisites and workflow ---'
cat -n skills/autofix/SKILL.md | sed -n '20,105p'
printf '%s\n' '--- host/token references ---'
rg -n -S 'GH_(ENTERPRISE_)?TOKEN|GH_TOKEN|hostname|remote|get-url|auth status|gh api' skills/autofixRepository: coderabbitai/skills
Length of output: 12738
🌐 Web query:
GitHub CLI gh api --hostname GH_ENTERPRISE_TOKEN host-specific token selection redirects documentation
💡 Result:
The GitHub CLI (gh) determines the authentication token for an API request based on the target hostname [1][2]. There is currently no mechanism to explicitly map a specific token variable to a specific arbitrary hostname; instead, the CLI categorizes hosts into two groups: GitHub.com/GHEC (GitHub Enterprise Cloud) and GitHub Enterprise Server (GHES) [1][2]. Token Selection Logic: 1. GitHub.com and Subdomains of ghe.com: The CLI uses tokens provided by the GH_TOKEN or GITHUB_TOKEN environment variables (in order of precedence) [1][2]. 2. GitHub Enterprise Server (GHES): The CLI uses tokens provided by the GH_ENTERPRISE_TOKEN or GITHUB_ENTERPRISE_TOKEN environment variables (in order of precedence) [1][2]. If these environment variables are not set, the CLI attempts to use credentials stored locally in the authentication configuration file (hosts.yml), which are created via the gh auth login command [3][1]. Important Considerations: - Hostname Targeting: You can specify the target host using the --hostname flag in the gh api command or by setting the GH_HOST environment variable [4][3][1]. - Trust/Security: The GH_ENTERPRISE_TOKEN variable is treated as a fallback for any host that is not GitHub.com or a ghe.com subdomain [5][6]. Because the CLI does not currently have a "trusted host" mapping for this variable, it will send the token associated with GH_ENTERPRISE_TOKEN to any host that falls into the GHES category [5]. - Recommendation: For production or complex automation environments involving multiple different enterprise instances, it is recommended to authenticate using gh auth login for each specific host [7][3]. This stores credentials securely in the CLI configuration, allowing the CLI to automatically select the correct token for the target host without relying on broadly scoped environment variables [1].
Citations:
- 1: https://cli.github.com/manual/gh_help_environment
- 2: Adjust environment help for host and tokens cli/cli#9809
- 3: https://cli.github.com/manual/
- 4: https://cli.github.com/manual/gh_api
- 5: Env var to host trust mapping for token authentication cli/cli#12928
- 6: https://github.com/cli/go-gh/blob/trunk/pkg/auth/auth.go
- 7: https://docs.github.com/en/rest/quickstart?tool=cli
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import re
samples = [
"https://github.com/owner/repo.git",
"https://user@example.com/owner/repo.git",
"git@example.com:owner/repo.git",
"ssh://git@example.com/owner/repo.git",
"https://ghe.example.com/owner/repo.git",
]
pattern = re.compile(r'^[a-zA-Z+]+://|^[^`@/`]+@|[:/].*$')
for remote in samples:
host = remote
host = re.sub(r'^[a-zA-Z+]+://', '', host)
host = re.sub(r'^[^`@/`]+@', '', host)
host = re.sub(r'[:/].*$', '', host)
print(f"{remote} -> {host}")
PYRepository: coderabbitai/skills
Length of output: 416
Sensitive Data Exposure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor
Restrict the API host before forwarding credentials.
gh api --hostname "$host" can use GH_ENTERPRISE_TOKEN for any non-github.com host. Because host comes from origin, an untrusted remote can direct the authenticated request to an unapproved host. Allow only github.com or configured Enterprise hosts.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/autofix/references/github.md` at line 64, Validate the host derived
from the remote before the GraphQL request in the surrounding script, allowing
only github.com or explicitly configured Enterprise hosts; reject any other host
before invoking gh api or forwarding credentials, while preserving the existing
approved-host request flow.
|
| CodeRabbit chat interactions are restricted to organization members for this repository. Ask an organization member to interact with CodeRabbit, or set chat.allow_non_org_members: true in your configuration. I'm surprised to receive this message from a coderabbit repository. Was this overlooked for open source contributions? So, per your message, I'm asking you review the last coderabbit comments. It's really out of scope for what I was trying to do, but in the spirit of the tool, I've been following along with each recommendation. |
1 participant
Summary
Shrinks the always-loaded
autofixSKILL.md from 339 lines (1,638 words, 98 fenced-code lines) to 198 lines (1,223 words, 2 fenced-code lines) so each invocation spends fewer context tokens before real work starts. The user-visible workflow is unchanged: every bash block that was duplicated verbatim betweenSKILL.mdandgithub.mdnow lives only in the reference file,github.mdmoved to thereferences/directory per the repo convention in CONTRIBUTING.md, the SKILL.md sections were aligned to skill-structure conventions (Overview added; Key Notes renamed to Guidelines and moved ahead of the workflow so safety rules load before execution), and Step 4's issue-parsing spec was extracted to a new reference loaded only at display time. One drift-prone claim was also corrected:github.mdno longer asserts other skills reuse it (the siblingcode-reviewskill is CLI-based and has no GitHub API usage).Affected surfaces
skills/autofix/SKILL.md(rewritten for brevity; behavior unchanged),skills/autofix/references/github.md(moved fromskills/autofix/github.md; intro corrected; neutral no-fix comment template added to §4),skills/autofix/references/issue-format.md(new; extraction fields, severity mapping, Action derivation, output table).commands/andagents/untouched.plugin.jsonandgemini-extension.jsonunchanged; neither enumerates skill files, so the file move requires no manifest edits.README.md's autofix section links onlyskills/autofix/SKILL.md, which did not move..github/workflows/release.ymlpackages viagit archiveof the full tree; no per-file paths to update.Public references
references/layout): https://docs.claude.com/en/docs/agents-and-tools/agent-skills/overviewPullRequestReviewThread(the API used byreferences/github.md, content unchanged): https://docs.github.com/en/graphql/reference/objects#pullrequestreviewthreadValidation
bash skill-lint.sh skills/autofix(skill-improver linter) — before: 339 lines / 1,638 words / 98 fenced-code lines, structure flags for missing Overview and Guidelines. After: 198 lines / 1,223 words / 2 fenced-code lines; Overview, Inputs, Steps, and Guidelines sections all pass; both reference files detected as referenced, no orphans. Remaining "Output format section missing" flag is deliberate — the table spec lives at its point of use in Step 4.grep -rn "](\./github.md)\|](github.md)" skills/— no matches; no dangling links to the pre-move path.git diff --stat main..HEAD— 3 files changed, 78 insertions, 169 deletions across 4 commits..github/workflows/contains only release packaging and approver checks).Checklist
SKILL.mdstays focused on activation, routing, domain context, and workflow framing.Summary by CodeRabbit