ci: wire RBKunnela/sinkra-action as PR validation gate#44
Conversation
Adds .github/workflows/sinkra-validation.yml — runs the 9-agent AIOX council on every PR (opened/sync/reopened) and on push to main. SHA-pinned to v0.1.3 (af19709) per supply-chain hygiene. Reads ZAI_API_KEY from repo secrets (already configured 2026-05-22). Once this workflow has run on a PR, the verbatim check context name must be added to branch protection's required_status_checks.contexts in a separate operation (post-merge).
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 25 minutes and 7 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughNew GitHub Actions workflow triggers SINKRA validation on pull request lifecycle events and pushes to main. The workflow checks out the repository with full history and invokes the SHA-pinned ChangesCI Validation Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sinkra-validation.yml:
- Around line 33-35: Replace the unpinned checkout action and enable
non-persistent credentials: change the "uses: actions/checkout@v4" invocation to
a SHA-pinned ref (use the full commit SHA for actions/checkout) and add "with:
persist-credentials: false" (preserving any existing keys like fetch-depth) so
GITHUB_TOKEN is not written to .git/config; update the workflow step that
contains uses: actions/checkout@v4 and ensure the new SHA ref and
persist-credentials: false are present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c6348a4d-3f84-492c-82e2-7f208bf79eb1
📒 Files selected for processing (1)
.github/workflows/sinkra-validation.yml
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
SHA-pin the checkout action and disable credential persistence.
Two supply-chain and credential security gaps:
-
Unpinned action:
actions/checkout@v4uses tag-pinning instead of SHA-pinning. This violates the stated "blanket policy" from static analysis and contradicts your own supply-chain hygiene comment on line 38. An attacker who compromises the v4 tag can inject malicious code. -
Credential persistence: Missing
persist-credentials: falseleavesGITHUB_TOKENin.git/configafter checkout. If the sinkra-action or future steps expose git configuration, the token can leak.
🔒 Proposed fix for SHA pinning and credential persistence
- name: Checkout PR head
- uses: actions/checkout@v4
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 32-35: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 33-33: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sinkra-validation.yml around lines 33 - 35, Replace the
unpinned checkout action and enable non-persistent credentials: change the
"uses: actions/checkout@v4" invocation to a SHA-pinned ref (use the full commit
SHA for actions/checkout) and add "with: persist-credentials: false" (preserving
any existing keys like fetch-depth) so GITHUB_TOKEN is not written to
.git/config; update the workflow step that contains uses: actions/checkout@v4
and ensure the new SHA ref and persist-credentials: false are present.
Swap the private RBKunnela/sinkra-action for the public RBKunnela/friendlyai-review wrapper. The action behaviour is identical (same 9-agent council) but the public wrapper is consumable from any repo and carries the FriendlyAI public brand. Changes: - delete .github/workflows/sinkra-validation.yml - add .github/workflows/friendlyai-review.yml - SHA-pin to cd694398 (v0.1.0) - check-run name: `friendlyai-review/verdict` - workflow job name: `9-agent council review` The post-merge step (add the verbatim check context to required_status_checks.contexts) stays the same; the new context name will be captured from `gh pr checks` after CI runs.
1 participant
Summary
Wires
RBKunnela/sinkra-action@v0.1.3(SHAaf19709) as a PR validation check on this repo.pull_request(opened/synchronize/reopened) andpushtomainZAI_API_KEYfrom existing repo secrets (configured 2026-05-22)v0.1.3in comment for human readability)What this does NOT do
This PR does not make the new check a required status check. After this PR is merged AND the workflow has run once on a real PR, the verbatim check context name (captured from
gh pr checks) must be added tobranch protection > required_status_checks.contextsin a separate operation. That step happens post-merge.Governance
Chore-style CI wiring change — no source code touched. The SINKRA chain still applies per
.claude/rules/automated-pr-merge-authority.md(in AIOX-Enterprise):action.ymlOnly @devops merges. Do not enable auto-merge.
Verification
Once CI runs on this PR itself, verify:
Sinkra Validationjob appears in checksZAI_API_KEY(already in secrets)🤖 Generated with Claude Code — Gage (@devops)
Summary by CodeRabbit