fix(ci): CR Thread Gate caller job emits 'gate / CodeRabbit Thread Check' [OMN-9032]#321
Conversation
…r to fix 0-job failures
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 0 minutes and 36 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughReplaced an event-driven workflow with a reusable Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GitHub as "GitHub Event"
participant Caller as "cr-thread-gate-caller.yml"
participant Reusable as "cr-thread-gate.yml (workflow_call)"
participant Runner as "Actions runner"
participant Script as "scripts/check-unresolved-threads.sh"
GitHub->>Caller: Trigger (PR / review / comment / merge_group)
Caller->>Reusable: workflow_call(pr-number, CROSS_REPO_PAT)
Reusable->>Runner: start job (ubuntu-latest)
Runner->>Runner: checkout specified script from OmniNode-ai/omniclaude
Runner->>Runner: resolve owner/repo, determine PR number, set GH_TOKEN
Runner->>Script: run check-unresolved-threads.sh
Script-->>Runner: exit code and COUNT
alt COUNT > 0
Runner->>GitHub: emit ::error:: annotation and fail job
else COUNT == 0 or skipped
Runner->>GitHub: succeed or skip
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical/error findings | No |
blocked |
CRITICAL or ERROR findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/cr-thread-gate.yml:
- Around line 9-10: Remove the unsupported GitHub Actions trigger entry
"pull_request_review_thread" (and its types array like "types: [resolved,
unresolved]") from the workflow; locate the block containing the symbol
pull_request_review_thread and delete that event declaration so the workflow
uses only supported triggers (e.g., keep other valid events or replace with a
supported event such as pull_request_review if you intended review-related
events).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c84481bf-ee78-49cc-80c9-6779cff462a3
📒 Files selected for processing (1)
.github/workflows/cr-thread-gate.yml
jonahgabriel
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/cr-thread-gate.yml (2)
64-79: Validate the helper output before declaring success.
COUNTis treated as success unless it is a number greater than zero. Ifcheck-unresolved-threads.shever emits anything but digits on stdout, this step still reachesAll CodeRabbit threads resolved.and exits 0. Fail closed on empty/non-numeric output before the numeric comparison.Suggested change
COUNT=$(bash scripts/check-unresolved-threads.sh \ "${{ steps.resolve-repo.outputs.owner }}" \ "${{ steps.resolve-repo.outputs.repo }}" \ "$PR") + case "$COUNT" in + ''|*[!0-9]*) + echo "::error::Unexpected unresolved-thread count: '$COUNT'" + exit 1 + ;; + esac echo "Unresolved CodeRabbit threads: $COUNT" if [ "$COUNT" -gt 0 ]; then🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/cr-thread-gate.yml around lines 64 - 79, The step assumes COUNT (from scripts/check-unresolved-threads.sh) is a numeric value; validate COUNT before using the -gt comparison and fail closed on empty/non-numeric output. Modify the logic after COUNT=... to trim whitespace, check that COUNT matches a digits-only regex (e.g. using shell pattern or grep), and if not numeric or empty call echo "::error::" with a descriptive message and exit 1; only proceed to the existing numeric comparison (if [ "$COUNT" -gt 0 ]) when the validation passes. Ensure you update references to COUNT and the invocation of scripts/check-unresolved-threads.sh to reflect this validation.
33-36: Harden this cross-repo checkout step.
actions/checkoutdocuments that${{ github.token }}is scoped to the current repository, so a private/internal secondary repo needs an explicit PAT. This step also follows two mutable refs (actions/checkout@v4andOmniNode-ai/omniclaude@main), which makes a required gate non-reproducible. WireCROSS_REPO_PATintotoken:here and pin both refs to immutable SHAs. (github.com)Suggested change
- uses: actions/checkout@v4 + uses: actions/checkout@<checkout-v4-sha> with: repository: OmniNode-ai/omniclaude - ref: main + ref: <omniclaude-commit-sha> + token: ${{ secrets.CROSS_REPO_PAT || secrets.github-token || secrets.GITHUB_TOKEN }} sparse-checkout: scripts/check-unresolved-threads.sh sparse-checkout-cone-mode: falseBased on learnings, third-party action references should remain pinned to specific commit SHAs that match the latest release when the PR was created; this is intentional for reproducibility and supply-chain security.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/cr-thread-gate.yml around lines 33 - 36, The checkout step uses mutable refs and the default github token (uses: actions/checkout@v4 and repository: OmniNode-ai/omniclaude ref: main); change it to use an explicit cross-repo PAT and pin both refs to immutable SHAs: replace the token usage with token: ${{ secrets.CROSS_REPO_PAT }} (or the designated secret name) and replace actions/checkout@v4 and ref: main with their corresponding commit SHAs so the step is reproducible and can access the private repo.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/cr-thread-gate.yml:
- Around line 40-47: The owner/repo splitting uses TARGET and always sets both
owner and repo from TARGET, so a bare repo name incorrectly sets owner to the
repo; update the resolve-repo step to detect whether TARGET contains a slash and
if not set owner to github.repository_owner (use the existing github input
variable) while setting repo to TARGET, otherwise split as currently done (i.e.,
when TARGET contains '/', use ${TARGET%%/*} for owner and ${TARGET##*/} for
repo); ensure the outputs written to GITHUB_OUTPUT remain "owner=..." and
"repo=..." and that the logic references TARGET and github.repository_owner
accordingly.
---
Nitpick comments:
In @.github/workflows/cr-thread-gate.yml:
- Around line 64-79: The step assumes COUNT (from
scripts/check-unresolved-threads.sh) is a numeric value; validate COUNT before
using the -gt comparison and fail closed on empty/non-numeric output. Modify the
logic after COUNT=... to trim whitespace, check that COUNT matches a digits-only
regex (e.g. using shell pattern or grep), and if not numeric or empty call echo
"::error::" with a descriptive message and exit 1; only proceed to the existing
numeric comparison (if [ "$COUNT" -gt 0 ]) when the validation passes. Ensure
you update references to COUNT and the invocation of
scripts/check-unresolved-threads.sh to reflect this validation.
- Around line 33-36: The checkout step uses mutable refs and the default github
token (uses: actions/checkout@v4 and repository: OmniNode-ai/omniclaude ref:
main); change it to use an explicit cross-repo PAT and pin both refs to
immutable SHAs: replace the token usage with token: ${{ secrets.CROSS_REPO_PAT
}} (or the designated secret name) and replace actions/checkout@v4 and ref: main
with their corresponding commit SHAs so the step is reproducible and can access
the private repo.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1963fe6a-289b-4249-8d79-66ae1c7c74d4
📒 Files selected for processing (2)
.github/workflows/cr-thread-gate-caller.yml.github/workflows/cr-thread-gate.yml
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/cr-thread-gate-caller.yml
… repository_owner
1 participant
Summary
cr-thread-gate.ymlhad agate:caller job butpr-number: ${{ ... || ... }}evaluates to booleanfalsein merge_group/push context → workflow fails with 0 jobs →gate / CodeRabbit Thread Checknever emitted.merge_grouptrigger; useformat('{0}', ... || 0)for pr-number (always a string); standardize triggers to match other repos (addpull_request_review_comment,pull_request_review_thread).Test plan
gate / CodeRabbit Thread Checkappears in PR checksSummary by CodeRabbit