Skip to content

[WRONG BRANCH] fix(ci): include .github/scripts and .github/workflows in CI allowlist - #246

Draft
luvs01 wants to merge 1 commit into
mainfrom
codex/propose-fix-for-ci-security-vulnerability
Draft

[WRONG BRANCH] fix(ci): include .github/scripts and .github/workflows in CI allowlist#246
luvs01 wants to merge 1 commit into
mainfrom
codex/propose-fix-for-ci-security-vulnerability

Conversation

@luvs01

@luvs01 luvs01 commented Aug 11, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The aggregate ci job could report success for PRs that only modified repository automation (e.g. .github/scripts/** or workflow files) because those paths were omitted from the expensive-jobs allowlist, so substantive verification jobs were skipped while the aggregate gate accepted skipped results as passing.

Description

  • Add .github/scripts/** and .github/workflows/** to the push trigger paths in .github/workflows/ci.yml so workflow and script edits are considered release-relevant.
  • Add .github/scripts/** and .github/workflows/** to the changes job ci filters in .github/workflows/ci.yml so PR-scoped path filtering triggers substantive CI for automation changes.
  • Update tests/ci-workflows.test.ts to assert the allowlist includes repository automation paths and to document the intent in the test comments.

Testing

  • Ran git diff --check and inspected the ci.yml / test diffs with no whitespace errors reported.
  • Ran bun test tests/ci-workflows.test.ts with the environment's Bun (v1.2.14) and the run failed due to Bun.YAML.parse incompatibility in this older Bun; this is an environment/tooling issue rather than a logic regression in the change.
  • Attempted to run the tests under Bun v1.3.14 but the runner could not download the runtime in this environment, so full test execution was not completed here; local static checks and the targeted workflow test modifications are present to exercise the intended behavior when run in CI or a properly provisioned environment.

Codex Task

@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@luvs01, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b21e4bd6-bd74-43cf-9f3e-a010b7405492

📥 Commits

Reviewing files that changed from the base of the PR and between 6d881db and bf460d1.

📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • tests/ci-workflows.test.ts

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the bug Something isn't working label Aug 11, 2026
@github-actions github-actions Bot changed the title fix(ci): include .github/scripts and .github/workflows in CI allowlist [WRONG BRANCH] fix(ci): include .github/scripts and .github/workflows in CI allowlist Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

⏳ DRAFT

  • wrong target branch (main); retarget to dev.

What to do

  • Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

@github-actions
github-actions Bot marked this pull request as draft August 11, 2026 00:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant