fix: spec-author checkout 本仓@action_ref（可复用上下文，W0-C4 #133） - #46
Conversation
… caller 实测 FileNotFoundError）
|
Warning Review limit reached
Next review available in: 11 minutes Limit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Comment |
PR Summary by QodoFix spec-author reusable workflow to checkout CI-Workflows at github.action_ref
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
There was a problem hiding this comment.
Pull request overview
该 PR 旨在修复 spec-author 作为 可复用 workflow 被调用时的运行上下文问题：actions/checkout 默认会拉取 调用方仓库，导致被调方需要的本仓文件（如 pipeline/spec-template.md）在 caller 上下文缺失，从而触发运行时错误。
Changes:
- 在
spec-author的首个actions/checkout中显式指定repository: Cloudbird-Software/CI-Workflows - 试图通过
ref: ${{ github.action_ref }}将 checkout 锁定到调用方钉定的版本
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: Cloudbird-Software/CI-Workflows | ||
| ref: ${{ github.action_ref }} | ||
| persist-credentials: false |
Code Review by Qodo
1. Wrong ref context used
|
| repository: Cloudbird-Software/CI-Workflows | ||
| ref: ${{ github.action_ref }} |
There was a problem hiding this comment.
1. Wrong ref context used 🐞 Bug ≡ Correctness
ref: ${{ github.action_ref }} 取到的是“当前 step 执行的 action 的 ref”，不是可复用 workflow 本身的 SHA，导致 checkout
可能指向不存在于 CI-Workflows 仓的 ref（从而直接失败）或指向错误版本。结果是 pipeline/spec-template.md 等同仓文件读取仍可能失败或出现版本漂移。
Agent Prompt
## Issue description
The workflow sets `actions/checkout` `ref` to `${{ github.action_ref }}`, but `github.action_ref` refers to the ref of an action being executed (e.g., the `actions/checkout` action), not the reusable workflow's own pinned revision. This can cause checkout to fail (ref not found in CI-Workflows) or checkout the wrong commit.
## Issue Context
This workflow reads files co-located with the workflow definition (e.g. `pipeline/spec-template.md`), so it must reliably checkout the repository and commit that contains the workflow file being executed.
## Fix Focus Areas
- .github/workflows/spec-author.yml[43-50]
## Suggested change
Replace the hard-coded ref with the reusable-workflow-specific contexts:
- `repository: ${{ job.workflow_repository }}`
- `ref: ${{ job.workflow_sha }}`
(These contexts are designed for reusable workflows to checkout their own source.)
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| # SHA，自引用钉点——被调方永远执行自己被钉定的版本，#143 实测教训） | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: Cloudbird-Software/CI-Workflows |
There was a problem hiding this comment.
2. Hardcoded repository reduces reuse 🐞 Bug ⚙ Maintainability
将 checkout 仓库硬编码为 Cloudbird-Software/CI-Workflows 会在仓库迁移/改名、或该 workflow 被 fork/镜像复用时直接失效，降低可维护性与可移植性。使用 job.workflow_repository 可在不改变语义（始终 checkout 被调用方仓库）的前提下自动适配。
Agent Prompt
## Issue description
The checkout step hardcodes `repository: Cloudbird-Software/CI-Workflows`, which will break if the repo is renamed/migrated or if the workflow is reused from a fork/mirror.
## Issue Context
In reusable workflows, GitHub exposes the repository containing the workflow file via `job.workflow_repository`, which is intended for exactly this use-case.
## Fix Focus Areas
- .github/workflows/spec-author.yml[46-50]
## Suggested change
Replace:
- `repository: Cloudbird-Software/CI-Workflows`
with:
- `repository: ${{ job.workflow_repository }}`
(And pair it with `ref: ${{ job.workflow_sha }}` to ensure the checked-out code matches the pinned workflow revision.)
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
可复用 workflow 在调用方上下文运行：checkout 不带 repository 拉的是调用方仓（.github）——conductor 实调时
pipeline/spec-template.mdFileNotFoundError（run 32455589396 spec job）。显式 repository: CI-Workflows + ref: github.action_ref（自引用钉点：被调方永远执行调用方钉定的 SHA；dispatch 时 action_ref=main 分支引用，同样成立）。注：此缺陷 dispatch 自测无法暴露（本仓上下文 checkout 天然正确）——只能 caller 实调发现。