Move dependency audit jobs to a separate scheduled workflow - #350
Conversation
|
Warning Review limit reached
More reviews will be available in 27 minutes and 39 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
WalkthroughThe two dependency-audit jobs ( ChangesDependency Audit Workflow Extraction
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/dependency-audit.yml (2)
8-10: ⚡ Quick winAdd workflow concurrency to prevent push races.
Manual dispatch and the scheduled run can overlap and race on
git push, producing avoidable non-fast-forward failures.Suggested concurrency guard
jobs: audit-and-fix: + concurrency: + group: dependency-audit-${{ github.ref }} + cancel-in-progress: false runs-on: ubuntu-latest🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependency-audit.yml around lines 8 - 10, The workflow lacks concurrency control which allows manual dispatch and scheduled runs to overlap and attempt simultaneous git pushes, causing race conditions. Add a concurrency configuration at the workflow level (typically after the on trigger section and before the jobs section) that groups concurrent runs by a stable identifier (such as the workflow name or a fixed string) and sets cancel-in-progress to true to cancel any previously running instances when a new run is triggered. This ensures only one instance of the audit-and-fix job runs at a time.
28-29: ⚡ Quick winPin
pip-auditto a fixed version for deterministic scheduled runs.These lines use
pipx run pip-auditwithout a version spec, so behavior can change unexpectedly when upstream releases. Pinning avoids surprise failures/churn in automated commits.Suggested determinism diff
audit-and-fix: runs-on: ubuntu-latest + env: + PIP_AUDIT_SPEC: "pip-audit==<pin-version>" @@ - run: pipx run pip-audit -r scripts/requirements.txt + run: pipx run --spec "$PIP_AUDIT_SPEC" pip-audit -r scripts/requirements.txt @@ - run: pipx run pip-audit -r scripts/requirements.txt --fix + run: pipx run --spec "$PIP_AUDIT_SPEC" pip-audit -r scripts/requirements.txt --fix @@ - pipx run pip-audit -r /tmp/infra-mcp-reqs.txt + pipx run --spec "$PIP_AUDIT_SPEC" pip-audit -r /tmp/infra-mcp-reqs.txt @@ - pipx run pip-audit -r /tmp/infra-mcp-reqs.txt + pipx run --spec "$PIP_AUDIT_SPEC" pip-audit -r /tmp/infra-mcp-reqs.txtAlso applies to: 32-33, 42-43, 52-53
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependency-audit.yml around lines 28 - 29, The `pipx run pip-audit` command lacks a version pin, causing non-deterministic behavior when upstream releases new versions. Pin the pip-audit tool to a specific version by modifying each occurrence of `pipx run pip-audit` in the workflow (appearing on lines 28-29, 32-33, 42-43, and 52-53) to include an explicit version constraint, ensuring consistent and deterministic behavior across scheduled runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependency-audit.yml:
- Around line 14-15: The actions/checkout@v6 action is configured with default
credential persistence enabled, which creates a push-capable GITHUB_TOKEN in git
config for all subsequent steps, unnecessarily exposing credentials if any step
is compromised. Add the persist-credentials: false parameter to the checkout
action configuration to disable credential persistence. This security hardening
should be applied to all instances of the checkout action in the workflow
(including the ones referenced at lines 55-63), and authentication should be
provided explicitly at push time only when needed via GITHUB_TOKEN environment
variable.
---
Nitpick comments:
In @.github/workflows/dependency-audit.yml:
- Around line 8-10: The workflow lacks concurrency control which allows manual
dispatch and scheduled runs to overlap and attempt simultaneous git pushes,
causing race conditions. Add a concurrency configuration at the workflow level
(typically after the on trigger section and before the jobs section) that groups
concurrent runs by a stable identifier (such as the workflow name or a fixed
string) and sets cancel-in-progress to true to cancel any previously running
instances when a new run is triggered. This ensures only one instance of the
audit-and-fix job runs at a time.
- Around line 28-29: The `pipx run pip-audit` command lacks a version pin,
causing non-deterministic behavior when upstream releases new versions. Pin the
pip-audit tool to a specific version by modifying each occurrence of `pipx run
pip-audit` in the workflow (appearing on lines 28-29, 32-33, 42-43, and 52-53)
to include an explicit version constraint, ensuring consistent and deterministic
behavior across scheduled runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 56a05c6c-6f3a-4f1c-a63f-c152be45af0f
⛔ Files ignored due to path filters (1)
scripts/infra-mcp/uv.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/dependency-audit.yml.github/workflows/pre-commit.yml
💤 Files with no reviewable changes (1)
- .github/workflows/pre-commit.yml
Summary by CodeRabbit
Release Notes