ci(schema): Deliver schema updates via PR instead of direct push to main#1614
Conversation
intent(schema-update): the Update Schema workflow's direct push to main fails at every version bump — the branch ruleset rejects it (GH013, pull_request required) because github-actions[bot] is not in the bypass list (only the admin role is) decision(schema-update): on main (push / workflow_dispatch) open a PR via peter-evans/create-pull-request instead of pushing; keep the existing git-auto-commit-into-PR-branch behavior for pull_request events so schema changes still ride along with the PR that caused them decision(schema-token): use the existing COMMITTER_TOKEN PAT so the generated PR triggers CI and is mergeable; the create-pull-request step is gated to non-pull_request events, so the PAT is never exposed to fork-triggered runs constraint(branch-ruleset): main requires PR + 1 approving + code-owner review with no required status checks, so the schema PR is merged by the admin (bypass) — typically one click per release Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
⚡ Performance Benchmark
Details
History19a2d68 fix(ci): Harden schema-update PR/fork/dispatch handling
77f72f6 ci(schema): Deliver schema updates via PR instead of direct push to main
|
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughSingle workflow file updated to publish regenerated schema differently based on event type: auto-commits back to PR branches, creates separate PR for non-PR events, with additional GitHub permissions. ChangesSchema Publishing Automation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1614 +/- ##
=======================================
Coverage 90.86% 90.86%
=======================================
Files 121 121
Lines 4698 4698
Branches 1096 1096
=======================================
Hits 4269 4269
Misses 429 429 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Deploying repomix with
|
| Latest commit: |
4f73c60
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://233774ca.repomix.pages.dev |
| Branch Preview URL: | https://ci-schema-update-auto-pr.repomix.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
decision(schema-update): check out the PR head branch only for same-repo PRs so git-auto-commit can push the regenerated schema; push/dispatch/fork all fall back to main decision(schema-update): gate the PR-branch auto-commit to same-repo PRs — fork PRs get a read-only GITHUB_TOKEN and would fail (or push to main) decision(schema-update): pin create-pull-request to `base: main` so a manual workflow_dispatch from another ref still targets main learned(gha-expressions): accessing `github.event.pull_request.head.repo.full_name` on push/dispatch (where pull_request is null) yields empty, not an error, so the `&& ... || 'main'` fallback is safe Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Code ReviewReviewed by 6 parallel reviewer agents (code-quality, security, performance, test-coverage, conventions, holistic). The design (split same-repo PR commit-back vs. main-branch PR creation) is sound; the PR is well-described and the security-sensitive claims (PAT never reaches fork runs) check out. A handful of substantive items below. Recommended1. Add a 2. Add a 3. Tighten 4. Commit message casing (conventions, per CLAUDE.md) Nice-to-haveDetails5. Observability when 6. Token-rot risk (holistic) 7. DRY the same-repo PR condition (code-quality, minor) 8. Step naming convention (conventions, minor) 9. Pre-merge validation Not flagged
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/schema-update.yml:
- Around line 21-24: The workflow checks out the wrong ref for forked
pull_request runs (the ref expression at `ref:` falls back to 'main'), causing
`node --run website-generate-schema` to run against the base branch instead of
the PR and hiding schema drift; change the checkout `ref` logic in
schema-update.yml to prefer the pull request head ref even for forks (use
`github.event.pull_request.head.ref`/`github.event.pull_request.head.repo.full_name`
or equivalent) so the PR code is used, and add post-generation validation that
fails CI on schema drift or, if allowed, opens/commits a schema-update PR using
`secrets.COMMITTER_TOKEN` (or aborts with a clear error) so generated schema
mismatches are surfaced instead of silently skipped.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6c03fc12-3a1a-4d09-b389-07d4ac1dfc11
📒 Files selected for processing (1)
.github/workflows/schema-update.yml
decision(schema-update): fork PRs now check out the merge ref and fail on schema drift instead of silently checking out main — surfaces fork-authored schema changes in CI (CodeRabbit) decision(schema-update): add a concurrency group so two near-simultaneous main pushes don't race on the reused chore/schema-update branch decision(schema-token): drop the unused `pull-requests: write` permission — create-pull-request uses COMMITTER_TOKEN (PAT), not GITHUB_TOKEN, and auto-commit needs only contents:write decision(commit-message): capitalize the bot commit message to 'Auto-generate schema' per the project's Conventional Commits casing rule Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Thanks for the thorough review. Disposition of the items (addressed in Applied
Skipped (minor / scope)
Deferred to maintainer (judgment calls — left for @yamadashy)
|
1 participant
Summary
The Update Schema workflow fails at every version bump. The cause is the
mainbranch ruleset:The ruleset requires changes to land via PR (
pull_requestrule), and only the admin role is in the bypass list — sogithub-actions[bot]'s direct push of the regenerated schema is rejected. Regular merges pass because there is nothing to commit; the failure only happens when a newschemas/<version>/is generated (i.e. at release time).Change
main(push /workflow_dispatch): open a PR viapeter-evans/create-pull-requestinstead of pushing directly. Branchchore/schema-update, auto-deleted after merge.pull_request: unchanged — keep committing the regenerated schema back into the PR branch (git-auto-commit-action) so schema changes ride along with the PR that caused them.pull-requests: writepermission.Token
Uses the existing
COMMITTER_TOKENPAT (already used byhomebrew.yml) so the generated PR triggers CI and is mergeable. Thecreate-pull-requeststep is gated togithub.event_name != 'pull_request', so the PAT is never exposed to fork-triggered runs.Notes / things to verify
COMMITTER_TOKENscope: it must havecontents+pull-requestswrite onyamadashy/repomix. It is a classic-scoped PAT used for Homebrew bumps, so this is very likely already covered — but worth confirming. If it is scoped too narrowly, swap in a dedicated PAT.pull_requestevent, so it exercises only the unchangedgit-auto-commitpath. The newcreate-pull-requestpath runs onpush: main/workflow_dispatchand will be exercised at the next version bump (or a manualworkflow_dispatchonce merged).Checklist
npm run testnpm run lint