Import YAML helpers for repository governance - #1
Conversation
…tory management. * **Chores** * Configured automated dependency monitoring with weekly checks and auto-merge for minor/patch updates. * Added security scanning workflows using CodeQL and OpenSSF Scorecard for continuous code analysis. * Enabled automated code quality and linting checks on pull requests. * Introduced standardized templates for bug reports and feature requests to improve contribution workflow. * Added GitHub funding links and configured label synchronization for improved repository management.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughThis PR establishes comprehensive GitHub repository automation infrastructure, including structured issue and pull request templates, dependency management configuration, GitHub Actions workflows for CI/CD and security scanning, a label taxonomy, and a Python module that generates issues from AI-analyzed code changes. Changes
Sequence DiagramsequenceDiagram
participant GA as GitHub Actions<br/>(ai-issue.yml)
participant TA as trigger_action.py
participant GH as GitHub API
participant Model as AI Model API
participant Issue as GitHub Issue
GA->>TA: trigger (push/PR event,<br/>env vars)
TA->>GH: fetch commit/PR details
GH-->>TA: file patches, author, message
TA->>TA: extract dedup key,<br/>labels, file context
TA->>GH: scan existing issues<br/>(dedup check)
GH-->>TA: issue list
alt diff too small or duplicate
TA-->>GA: skip
else proceed
TA->>TA: build prompt<br/>(role, severity scale,<br/>files, diff)
TA->>Model: call with prompt<br/>(retry/backoff)
Model-->>TA: issue payload + labels
TA->>TA: map severity to label,<br/>build permalink
TA->>GH: create issue
GH-->>Issue: issue created
Issue-->>TA: issue number
alt pull_request event
TA->>GH: post PR comment<br/>(link to issue)
end
end
Estimated Code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
.github/pull_request_template.md (1)
12-16: Testing checklist items are project-specific.The testing section references
process_event.pyand "Gemini API" which may not apply to all PRs in this repository. Consider making these items more generic or adding a note that contributors should adjust based on the changes being made.♻️ Suggested generic alternative
## Testing Performed -- [ ] Local execution of `process_event.py` -- [ ] Verified JSON output structure from Gemini API -- [ ] Tested GitHub Action workflow trigger (dry-run) +- [ ] Local testing completed +- [ ] Relevant workflow/action tested (if applicable) +- [ ] Integration points verified - [ ] Other:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/pull_request_template.md around lines 12 - 16, Update the "## Testing Performed" section to use a generic, adaptable checklist: replace specific items like `process_event.py` and "Gemini API" with neutral placeholders or guidance (e.g., "Run relevant project tests / scripts", "Verify API responses where applicable") and add a short note telling contributors to adjust checklist items to match their PR changes; update the header block that currently lists `process_event.py` and "Gemini API" so the template reads generically and includes an "Other: (describe)" prompt for project-specific checks..github/workflows/scorecard.yml (1)
30-35: Missing SARIF upload step to publish results to GitHub Security tab.The workflow generates a SARIF file but doesn't upload it to GitHub's Security tab. The
publish_results: trueoption publishes to the OpenSSF public dashboard, but you need an additional step to see findings in your repository's Security tab.🔧 Proposed fix to add SARIF upload
- name: Run analysis uses: ossf/scorecard-action@v2.4.3 with: results_file: scorecard-results.sarif results_format: sarif publish_results: true + + - name: Upload SARIF to GitHub Security + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: scorecard-results.sarif🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/scorecard.yml around lines 30 - 35, The workflow runs the OSSF Scorecard action ("Run analysis" using ossf/scorecard-action@v2.4.3) and writes scorecard-results.sarif but never uploads it to the repository Security tab; add a follow-up step that uses the GitHub SARIF uploader (e.g., github/codeql-action/upload-sarif) to upload the artifact by specifying the same results file (scorecard-results.sarif) so findings appear in the repo Security tab and not just the public OpenSSF dashboard.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/dependabot.yml:
- Around line 7-9: The dependabot config references labels "python" and
"actions" that are not defined in your managed label set, causing Dependabot to
create default-styled labels; add label entries for name "python" (color 3572A5,
description "Python-related changes") and name "actions" (color 2088FF,
description "GitHub Actions workflow changes") to .github/labels.yml so they
match your taxonomy and prevent auto-created defaults.
In @.github/workflows/ai-issue.yml:
- Around line 26-49: The workflow currently checks out and executes PR-head code
(trigger_action.py) while exposing secrets (GH_MODELS_TOKEN, GITHUB_TOKEN);
change the job so it runs the analysis from a trusted ref instead of the PR
head: in the "Run AI Analysis" job (symbols: actions/checkout@v6,
trigger_action.py, GH_MODELS_TOKEN, GITHUB_TOKEN) checkout a known safe ref
(e.g., the PR base branch or a protected branch) by adding a checkout step with
ref: github.event.pull_request.base.ref (or a hardcoded main/prod ref) before
running the script, or switch the workflow to pull_request_target and ensure
checkout uses the base ref; do not pass repository secrets to any step that runs
code from the PR head.
In @.github/workflows/sast.yml:
- Around line 11-13: Move the top-level concurrency section into the job that
defines the matrix so the matrix context is available: remove the workflow-level
"concurrency" block and add an identical "concurrency:" block inside the job
definition that uses the matrix (the job that runs CodeQL), keeping "group:
codeql-${{ matrix.language }}" and "cancel-in-progress: false" so parallel
matrix runs deduplicate correctly using matrix.language.
In `@trigger` action/trigger_action.py:
- Around line 442-456: The retry loop in trigger_action.py (the for attempt in
range(retries) block that posts to ENDPOINT and calls
resp.raise_for_status()/json.loads(raw)) swallows failures and calls exit(0),
making CI/workflows report success even when requests/auth/JSON parsing fail;
change the final failure behavior to surface the error by either re-raising the
last exception or calling exit with a non-zero status (e.g., exit(1)), and
include the last exception message in the log before exiting so failures cause
the job to fail rather than silently succeeding.
- Around line 156-161: In build_permalink, the code currently prefers COMMIT_SHA
(which may be the synthetic merge SHA) and doesn't URL-encode filenames; change
the logic to use the PR head SHA when pr_ref is present (use pr_ref.head.sha as
the primary source, falling back to COMMIT_SHA or empty string) and URL-encode
the filename/path (e.g., via urllib.parse.quote) before interpolating into the
URL; update references in build_permalink to use the resolved sha and the
encoded filename while keeping repo_name and line as before.
---
Nitpick comments:
In @.github/pull_request_template.md:
- Around line 12-16: Update the "## Testing Performed" section to use a generic,
adaptable checklist: replace specific items like `process_event.py` and "Gemini
API" with neutral placeholders or guidance (e.g., "Run relevant project tests /
scripts", "Verify API responses where applicable") and add a short note telling
contributors to adjust checklist items to match their PR changes; update the
header block that currently lists `process_event.py` and "Gemini API" so the
template reads generically and includes an "Other: (describe)" prompt for
project-specific checks.
In @.github/workflows/scorecard.yml:
- Around line 30-35: The workflow runs the OSSF Scorecard action ("Run analysis"
using ossf/scorecard-action@v2.4.3) and writes scorecard-results.sarif but never
uploads it to the repository Security tab; add a follow-up step that uses the
GitHub SARIF uploader (e.g., github/codeql-action/upload-sarif) to upload the
artifact by specifying the same results file (scorecard-results.sarif) so
findings appear in the repo Security tab and not just the public OpenSSF
dashboard.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6dcbbe3e-7950-470b-97a2-5badedcc476c
📒 Files selected for processing (12)
.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/dependabot.yml.github/labels.yml.github/pull_request_template.md.github/workflows/ai-issue.yml.github/workflows/dependabot-auto-merge.yml.github/workflows/label-sync.yml.github/workflows/lint.yml.github/workflows/sast.yml.github/workflows/scorecard.ymltrigger action/trigger_action.py
| labels: | ||
| - "dependencies" | ||
| - "python" |
There was a problem hiding this comment.
Missing label definitions for "python" and "actions".
The labels python (line 9) and actions (line 17) are referenced here but are not defined in .github/labels.yml. The dependencies label exists (line 55 of labels.yml), but the other two do not. This will result in Dependabot creating these labels with default styling, causing inconsistency with your managed label taxonomy.
Add these labels to .github/labels.yml:
- name: "python"
color: "3572A5"
description: "Python-related changes"
- name: "actions"
color: "2088FF"
description: "GitHub Actions workflow changes"Also applies to: 15-17
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/dependabot.yml around lines 7 - 9, The dependabot config references
labels "python" and "actions" that are not defined in your managed label set,
causing Dependabot to create default-styled labels; add label entries for name
"python" (color 3572A5, description "Python-related changes") and name "actions"
(color 2088FF, description "GitHub Actions workflow changes") to
.github/labels.yml so they match your taxonomy and prevent auto-created
defaults.
| - name: Checkout code | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| pip install --no-cache-dir PyGithub==2.5.0 requests==2.32.3 | ||
|
|
||
| - name: Run AI Analysis | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| REPOSITORY: ${{ github.repository }} | ||
| EVENT_NAME: ${{ github.event_name }} | ||
| COMMIT_SHA: ${{ github.sha }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }} | ||
| ALLOWED_USER: ${{ secrets.ALLOWED_USER }} | ||
| run: python "trigger action/trigger_action.py" |
There was a problem hiding this comment.
Do not run PR-head code with repository secrets.
This job checks out the PR branch and then executes trigger action/trigger_action.py with GH_MODELS_TOKEN plus write-scoped GITHUB_TOKEN. A same-repo PR can modify that script and exfiltrate secrets or post arbitrary issues/comments. Since the script already reads diffs via the GitHub API, it should run from a trusted ref instead of the PR head.
Suggested fix
- name: Checkout code
uses: actions/checkout@v6
with:
- fetch-depth: 0
+ ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.sha }}
+ fetch-depth: 1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| pip install --no-cache-dir PyGithub==2.5.0 requests==2.32.3 | |
| - name: Run AI Analysis | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPOSITORY: ${{ github.repository }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| COMMIT_SHA: ${{ github.sha }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }} | |
| ALLOWED_USER: ${{ secrets.ALLOWED_USER }} | |
| run: python "trigger action/trigger_action.py" | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.sha }} | |
| fetch-depth: 1 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| pip install --no-cache-dir PyGithub==2.5.0 requests==2.32.3 | |
| - name: Run AI Analysis | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REPOSITORY: ${{ github.repository }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| COMMIT_SHA: ${{ github.sha }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }} | |
| ALLOWED_USER: ${{ secrets.ALLOWED_USER }} | |
| run: python "trigger action/trigger_action.py" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ai-issue.yml around lines 26 - 49, The workflow currently
checks out and executes PR-head code (trigger_action.py) while exposing secrets
(GH_MODELS_TOKEN, GITHUB_TOKEN); change the job so it runs the analysis from a
trusted ref instead of the PR head: in the "Run AI Analysis" job (symbols:
actions/checkout@v6, trigger_action.py, GH_MODELS_TOKEN, GITHUB_TOKEN) checkout
a known safe ref (e.g., the PR base branch or a protected branch) by adding a
checkout step with ref: github.event.pull_request.base.ref (or a hardcoded
main/prod ref) before running the script, or switch the workflow to
pull_request_target and ensure checkout uses the base ref; do not pass
repository secrets to any step that runs code from the PR head.
| concurrency: | ||
| group: codeql-${{ github.ref }}-${{ matrix.language }} | ||
| cancel-in-progress: false |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Locate and read the sast.yml workflow file
fd -name "sast.yml" -path "*/.github/workflows/*"Repository: readme-SVG/readme-badges
Length of output: 298
🏁 Script executed:
# Read the file around lines 11-13 to verify the snippet
cat -n .github/workflows/sast.yml | head -25Repository: readme-SVG/readme-badges
Length of output: 679
🌐 Web query:
GitHub Actions matrix context scope workflow-level concurrency availability
💡 Result:
Web search failed: Server error: no LLM provider could handle the message
🏁 Script executed:
# Search for GitHub Actions documentation or comments about this issue in the repo
rg -i "matrix.*context\|context.*matrix" --type yamlRepository: readme-SVG/readme-badges
Length of output: 216
🏁 Script executed:
# Check git log for any commits related to this codeql workflow
git log --oneline .github/workflows/sast.yml | head -10Repository: readme-SVG/readme-badges
Length of output: 161
🏁 Script executed:
# Look for any other workflows that might show correct usage patterns
fd -name "*.yml" -o -name "*.yaml" -path "*/.github/workflows/*" | xargs cat | rg -A 3 -B 3 "concurrency:" | head -40Repository: readme-SVG/readme-badges
Length of output: 298
🏁 Script executed:
# Check if there are any issues, error logs, or discussions about workflow problems
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.log" \) | xargs grep -l -i "codeql\|workflow\|concurrency" 2>/dev/null | head -10Repository: readme-SVG/readme-badges
Length of output: 120
🏁 Script executed:
# Look at the complete job section to understand matrix definition
sed -n '15,50p' .github/workflows/sast.ymlRepository: readme-SVG/readme-badges
Length of output: 828
🏁 Script executed:
# Search for any comments in the workflow file that might document this
cat .github/workflows/sast.yml | grep -E "^[[:space:]]*#"Repository: readme-SVG/readme-badges
Length of output: 50
🏁 Script executed:
# Check if there's a .github directory with any run logs or artifacts
ls -la .github/Repository: readme-SVG/readme-badges
Length of output: 561
🏁 Script executed:
# Look for any workflow run artifacts, logs, or cache
find .github -type f -name "*.log" -o -name "*.txt" 2>/dev/nullRepository: readme-SVG/readme-badges
Length of output: 50
🏁 Script executed:
# Check the complete sast.yml to confirm full structure
cat .github/workflows/sast.ymlRepository: readme-SVG/readme-badges
Length of output: 1053
🏁 Script executed:
# Check README and documentation for any mention of this workflow or issues
cat CONTRIBUTING.md README.md 2>/dev/null | grep -i -A 5 -B 5 "codeql\|workflow"Repository: readme-SVG/readme-badges
Length of output: 661
🏁 Script executed:
# Check if there's any CI/CD status badge or documentation about workflow status
cat README.md 2>/dev/null | head -50Repository: readme-SVG/readme-badges
Length of output: 1959
Move concurrency into the job to resolve matrix.language.
Line 12 uses ${{ matrix.language }} in the workflow-level concurrency block, but matrix context is only available at the job level. This breaks concurrency grouping and prevents proper deduplication of parallel matrix runs.
Suggested fix
concurrency:
- group: codeql-${{ github.ref }}-${{ matrix.language }}
+ group: codeql-${{ github.ref }}
cancel-in-progress: false
jobs:
codeql:
+ concurrency:
+ group: codeql-${{ github.ref }}-${{ matrix.language }}
+ cancel-in-progress: false
name: Analyze (${{ matrix.language }})🧰 Tools
🪛 actionlint (1.7.12)
[error] 12-12: context "matrix" is not allowed here. available contexts are "github", "inputs", "vars". see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability for more details
(expression)
[error] 12-12: property "language" is not defined in object type {}
(expression)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/sast.yml around lines 11 - 13, Move the top-level
concurrency section into the job that defines the matrix so the matrix context
is available: remove the workflow-level "concurrency" block and add an identical
"concurrency:" block inside the job definition that uses the matrix (the job
that runs CodeQL), keeping "group: codeql-${{ matrix.language }}" and
"cancel-in-progress: false" so parallel matrix runs deduplicate correctly using
matrix.language.
| def build_permalink(filename: str, line: int = 1) -> str: | ||
| """Build a GitHub blob permalink for a file and line number.""" | ||
| sha = os.environ.get("COMMIT_SHA") or "" | ||
| if not sha and pr_ref: | ||
| sha = pr_ref.head.sha | ||
| return f"https://github.com/{repo_name}/blob/{sha}/{filename}#L{line}" |
There was a problem hiding this comment.
Build PR permalinks from the head SHA and URL-encode the path.
On pull requests, Line 158 prefers COMMIT_SHA, and the workflow currently sets that to github.sha, which is the synthetic merge SHA rather than the PR head commit. That makes generated permalinks unstable, and paths like trigger action/trigger_action.py are emitted without URL encoding, so the link itself is malformed.
Suggested fix
+from urllib.parse import quote
+
def build_permalink(filename: str, line: int = 1) -> str:
"""Build a GitHub blob permalink for a file and line number."""
- sha = os.environ.get("COMMIT_SHA") or ""
- if not sha and pr_ref:
- sha = pr_ref.head.sha
- return f"https://github.com/{repo_name}/blob/{sha}/{filename}#L{line}"
+ sha = pr_ref.head.sha if pr_ref else (os.environ.get("COMMIT_SHA") or "")
+ encoded_filename = quote(filename, safe="/")
+ return f"https://github.com/{repo_name}/blob/{sha}/{encoded_filename}#L{line}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| def build_permalink(filename: str, line: int = 1) -> str: | |
| """Build a GitHub blob permalink for a file and line number.""" | |
| sha = os.environ.get("COMMIT_SHA") or "" | |
| if not sha and pr_ref: | |
| sha = pr_ref.head.sha | |
| return f"https://github.com/{repo_name}/blob/{sha}/{filename}#L{line}" | |
| from urllib.parse import quote | |
| def build_permalink(filename: str, line: int = 1) -> str: | |
| """Build a GitHub blob permalink for a file and line number.""" | |
| sha = pr_ref.head.sha if pr_ref else (os.environ.get("COMMIT_SHA") or "") | |
| encoded_filename = quote(filename, safe="/") | |
| return f"https://github.com/{repo_name}/blob/{sha}/{encoded_filename}#L{line}" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@trigger` action/trigger_action.py around lines 156 - 161, In build_permalink,
the code currently prefers COMMIT_SHA (which may be the synthetic merge SHA) and
doesn't URL-encode filenames; change the logic to use the PR head SHA when
pr_ref is present (use pr_ref.head.sha as the primary source, falling back to
COMMIT_SHA or empty string) and URL-encode the filename/path (e.g., via
urllib.parse.quote) before interpolating into the URL; update references in
build_permalink to use the resolved sha and the encoded filename while keeping
repo_name and line as before.
| for attempt in range(retries): | ||
| try: | ||
| resp = requests.post(ENDPOINT, headers=headers, json=payload, timeout=60) | ||
| resp.raise_for_status() | ||
| data = resp.json() | ||
| raw = data['choices'][0]['message']['content'].strip() | ||
| raw = re.sub(r'^```json\s*|```$', '', raw, flags=re.MULTILINE).strip() | ||
| return json.loads(raw) | ||
| except Exception as e: | ||
| print(f"Attempt {attempt + 1} failed: {e}") | ||
| if attempt < retries - 1: | ||
| time.sleep(delay) | ||
|
|
||
| print("All attempts failed. Exiting gracefully.") | ||
| exit(0) |
There was a problem hiding this comment.
Fail the job when analysis is actually broken.
Lines 450-456 swallow every failure path and then exit with status 0. If auth is wrong, the endpoint is down, or the model returns malformed JSON, the workflow still looks successful and the automation silently stops producing issues.
Suggested fix
- except Exception as e:
+ except (requests.RequestException, json.JSONDecodeError, KeyError, IndexError, TypeError) as e:
print(f"Attempt {attempt + 1} failed: {e}")
if attempt < retries - 1:
time.sleep(delay)
- print("All attempts failed. Exiting gracefully.")
- exit(0)
+ raise SystemExit("AI analysis failed after all retries")📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| for attempt in range(retries): | |
| try: | |
| resp = requests.post(ENDPOINT, headers=headers, json=payload, timeout=60) | |
| resp.raise_for_status() | |
| data = resp.json() | |
| raw = data['choices'][0]['message']['content'].strip() | |
| raw = re.sub(r'^```json\s*|```$', '', raw, flags=re.MULTILINE).strip() | |
| return json.loads(raw) | |
| except Exception as e: | |
| print(f"Attempt {attempt + 1} failed: {e}") | |
| if attempt < retries - 1: | |
| time.sleep(delay) | |
| print("All attempts failed. Exiting gracefully.") | |
| exit(0) | |
| for attempt in range(retries): | |
| try: | |
| resp = requests.post(ENDPOINT, headers=headers, json=payload, timeout=60) | |
| resp.raise_for_status() | |
| data = resp.json() | |
| raw = data['choices'][0]['message']['content'].strip() | |
| raw = re.sub(r'^ |
🧰 Tools
🪛 Ruff (0.15.9)
[warning] 450-450: Do not catch blind exception: Exception
(BLE001)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@trigger` action/trigger_action.py around lines 442 - 456, The retry loop in
trigger_action.py (the for attempt in range(retries) block that posts to
ENDPOINT and calls resp.raise_for_status()/json.loads(raw)) swallows failures
and calls exit(0), making CI/workflows report success even when
requests/auth/JSON parsing fail; change the final failure behavior to surface
the error by either re-raising the last exception or calling exit with a
non-zero status (e.g., exit(1)), and include the last exception message in the
log before exiting so failures cause the job to fail rather than silently
succeeding.
This pull request introduces necessary configuration files for repository management.
Summary by CodeRabbit
New Features
Chores