ci(competition): register the engine gate on the default branch - #568
Conversation
pull_request_target workflows only trigger when the workflow file exists on the default branch. the engine gate lived only on the ladder and feature branches, so engine-lane pr #567 got no scoring run at all while the kit gate (registered from main) ran fine. the file is byte-identical to the ladder copy; the run itself still checks out and executes base-branch code per its security model.
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughChangesStrategy engine gate
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant GitHubAPI
participant score_strategy.py
participant Maintainer
PullRequest->>GitHubActions: trigger qualifying pull request workflow
GitHubActions->>GitHubAPI: list changed files and fetch challenger source
GitHubAPI-->>GitHubActions: strategy file content
GitHubActions->>score_strategy.py: score baseline against challenger
score_strategy.py-->>GitHubActions: verdict and JSON scorecard
GitHubActions->>PullRequest: post scorecard comment and check result
Maintainer->>PullRequest: review and merge strategy manually
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
ci
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/koth-engine-gate.yml:
- Around line 49-57: Update the changed-file retrieval and engine eligibility
logic in the workflow so it preserves each file’s GitHub status, not just its
filename. Require the single strategy file’s status to be non-removed before
assigning engine mode, while preserving the existing filename and count checks.
- Line 41: The workflow uses mutable action tags in a privileged
pull_request_target job. In .github/workflows/koth-engine-gate.yml lines 41 and
91, update actions/checkout and actions/setup-python references to trusted full
40-character commit SHAs, respectively, while preserving their existing action
versions and configuration.
- Around line 21-23: Add a narrowly scoped zizmor suppression for the
dangerous-triggers finding on the koth-engine-gate pull_request_target workflow,
using the existing rationale that it checks out only the base and sandbox PR
strategy as data. Place the suppression in .github/zizmor.yml or inline in the
workflow, and apply it only to this engine gate trigger after action pins are
fixed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9869f827-e3a2-48b3-a37f-29140e92bcdc
📒 Files selected for processing (1)
.github/workflows/koth-engine-gate.yml
| on: | ||
| pull_request_target: | ||
| types: [opened, synchronize, reopened, ready_for_review] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
cat -n .github/workflows/koth-engine-gate.yml | sed -n '1,120p'
echo
echo "== workflow lint config / references =="
for f in .github/worklint .github/gitleaks-ignore .zizmor.yml zizmor.toml zizmor.yaml .github/actions.yml .github/actionlint.yaml actionlint.yaml; do
[ -f "$f" ] && { echo "--- $f"; cat -n "$f"; }
done
echo
echo "== zizmor references =="
rg -n "zizmor|dangerous-triggers|pull_request_target|workflow-lint|actionlint" .github . 2>/dev/null | sed -n '1,200p'
echo
echo "== files maybe relevant =="
git ls-files '.github/workflows/*' '.github/**/*.yml' '.github/**/*.yaml' | sed -n '1,120p'Repository: vouchdev/vouch
Length of output: 9624
🌐 Web query:
zizmor 1.27.0 dangerous-triggers pull_request_target workflow run zizmor inline ignore
💡 Result:
In zizmor v1.27.0, the dangerous-triggers audit flags workflows using pull_request_target or workflow_run because these triggers are often used insecurely [1][2][3]. However, as of version 1.27, zizmor includes an explicit exception for workflows that use pull_request_target solely with the actions/labeler action [1][4]. Specifically, if a workflow has exactly one job containing only one step, and that step uses actions/labeler, zizmor will suppress the dangerous-triggers finding [2][5]. If you encounter a dangerous-triggers finding that you believe is secure or necessary for your use case, you can suppress it using inline ignore comments or a zizmor.yml configuration file [6][7]: 1. Inline Ignore: You can add an ignore comment to the relevant line in your workflow file [6][8]: # zizmor: ignore[dangerous-triggers] 2. Configuration File (zizmor.yml): You can add a rule to a zizmor.yml file to ignore the finding for a specific file or location [6][9][10]: rules: dangerous-triggers: ignore: - filename.yml Ensure the ignore comment is placed correctly—it must be a valid YAML comment and cannot be placed inside a string or block literal [6][8]. More granular ignores can be achieved in zizmor.yml by specifying line and column numbers (e.g., filename.yml:line:column) [9][10].
Citations:
- 1: https://docs.zizmor.sh/release-notes/
- 2: https://github.com/zizmorcore/zizmor/blob/563b7b25/crates/zizmor/src/audit/dangerous_triggers.rs
- 3: https://docs.zizmor.sh/audits/
- 4: Add a dangerous-triggers exception for actions/labeler zizmorcore/zizmor#1956
- 5: https://github.com/woodruffw/zizmor/blob/main/crates/zizmor/src/audit/dangerous_triggers.rs
- 6: https://docs.zizmor.sh/usage/
- 7: https://docs.zizmor.sh/quickstart/
- 8: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md
- 9: https://docs.zizmor.sh/configuration/
- 10: https://github.com/zizmorcore/zizmor/blob/main/docs/configuration.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== zizmor.yml =="
cat -n .github/zizmor.yml | sed -n '1,160p'
echo
echo "== workflow-lint trigger/run =="
cat -n .github/workflows/workflow-lint.yml | sed -n '1,80p'
echo
echo "== nearby comparable pull_request_target inline suppressions =="
for f in .github/workflows/labeler.yml .github/workflows/coderabbit-gate.yml .github/workflows/ui-screenshot-gate.yml .github/workflows/auto-merge.yml; do
[ -f "$f" ] && { echo "--- $f"; cat -n "$f" | sed -n '1,70p'; }
done
echo
echo "== full koth-engine-gate =="
cat -n .github/workflows/koth-engine-gate.ymlRepository: vouchdev/vouch
Length of output: 22852
Add a scoped zizmor suppression for the engine gate trigger.
.github/zizmor.yml only disables other rules globally; it does not suppress dangerous-triggers, so zizmor==1.27.0 --offline --persona regular still fails koth-engine-gate.yml. Add a narrowly scoped .github/zizmor.yml override or an inline suppression with the existing “checks out only base + sandbox PR strategy as data” rationale after the action pins are fixed.
🧰 Tools
🪛 GitHub Actions: workflow-lint / 0_zizmor (workflow security).txt
[error] 21-23: zizmor [dangerous-triggers]: use of fundamentally insecure workflow trigger. pull_request_target is almost always used insecurely.
🪛 GitHub Actions: workflow-lint / zizmor (workflow security)
[error] 21-23: zizmor error[dangerous-triggers]: use of fundamentally insecure workflow trigger. 'pull_request_target' is almost always used insecurely.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/koth-engine-gate.yml around lines 21 - 23, Add a narrowly
scoped zizmor suppression for the dangerous-triggers finding on the
koth-engine-gate pull_request_target workflow, using the existing rationale that
it checks out only the base and sandbox PR strategy as data. Place the
suppression in .github/zizmor.yml or inline in the workflow, and apply it only
to this engine gate trigger after action pins are fixed.
Source: Pipeline failures
workflow lint only runs on prs that touch workflows, so the koth gates' pull_request_target findings never surfaced until the engine-gate registration pr woke the linter. both gates now carry the ignore annotation with the justification inline (base-branch code only, pr content handled as data, read-only tokens), and the scorecard comment script declares its literal backticks for shellcheck.
a trailing comment on the directive line keeps shellcheck from parsing it, and a top-of-script placement did not attach to the compound command. the directive now sits bare, immediately above the comment block it covers.
pin checkout and setup-python to immutable commit shas (mutable tags in a pull_request_target workflow are a supply-chain surface), and classify a delete-only strategy pr as normal instead of engine - the filename shape matched but there is nothing to fetch at the head sha, so the gate failed messy instead of passing through.
|
@coderabbitai review — annotation was already in place, sha pins and the delete-only classification are addressed in the latest push. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
for file in .github/workflows/koth-engine-gate.yml .github/workflows/koth-gate.yml; do
if [ -f "$file" ]; then
echo "===== OUTLINE: $file ====="
ast-grep outline "$file" --lang yaml --view expanded || true
echo "===== RELEVANT LINES: $file ====="
rg -n -C 3 '(pull_request_target|uses:|zizmor|ShellCheck|delete|deleted|scorecard|changed)' "$file" || true
else
echo "MISSING: $file"
fi
done
echo "===== WORKFLOW FILE STATUS ====="
git status --short -- .github/workflows/koth-engine-gate.yml .github/workflows/koth-gate.yml
git diff --no-ext-diff -- .github/workflows/koth-engine-gate.yml .github/workflows/koth-gate.yml
echo "===== ENGINE VS LADDER CONTENT COMPARISON ====="
if [ -f .github/workflows/koth-engine-gate.yml ] && [ -f .github/workflows/koth-gate.yml ]; then
diff -u .github/workflows/koth-gate.yml .github/workflows/koth-engine-gate.yml || true
fiLength of output: 19514
✅ Action performedReview finished.
|
1 participant
pull_request_target workflows only trigger when the file exists on the default branch — engine-lane pr #567 got no scoring run while the kit gate (registered from main) ran fine. byte-identical to the ladder copy; runs still execute base-branch code per the gate's security model.
Summary by CodeRabbit
New Features
CI/Quality