feat(governance): weekly required-job audit#14
Conversation
Weekly cron (Monday 08:00 UTC) + workflow_dispatch that scans every non-archived repo under resq-software/ and verifies at least one CI workflow on its default branch emits a `required` status context. If any repo is missing it (and not in the ruleset exclude list), opens or comments on a tracking issue in this repo with the repo list and a reference fix. Why: the `default-branch-baseline` ruleset (id 15191038) requires that specific context. Any repo lacking such a job has every PR blocked on 'Expected - Waiting for status to be reported'. Previously hit npm (now fixed via resq-software/npm#46). This audit catches future drift before it bites. - Uses SYNC_TOKEN (preferred, covers private repos) or GITHUB_TOKEN (public-only fallback). - Does NOT fail the run on gaps; only opens/updates an issue. - Matches either `required:` job key or `name: required` anywhere in .github/workflows/*.yml on the default branch.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 29 minutes and 28 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ws in audit Two fixes for the same underlying cause: 1. resq-software/.github doesn't emit the `required` status-check context on its own PRs. The existing required.yml is a reusable workflow (on: workflow_call) that only fires when called via uses:, never on pull_request events. Adds a standalone required-gate.yml with a pass-through `required` job, same pattern used on docs/dev/ardupilot/resq-proto. Unblocks every PR on this repo (including this one and #13). 2. audit-required-job.yml had a false-positive: it matched the `required:` job key inside the reusable aggregator and reported .github as "ok" when it wasn't. Patched the detection to first check that the workflow's `on:` block contains pull_request or push — reusable-only workflows are skipped. Correct behavior.
The audit was false-positive for resq-software/.github: matched the required: job key inside required.yml (on: workflow_call, reusable- only) and reported .github as having a required job on its default branch. Reusables never fire on pull_request so the ruleset saw the context as unreported, blocking every PR on .github. Fix: before matching required: or name: required, extract the workflow's on: block and skip any workflow whose triggers don't include pull_request or push.
2 participants
Summary
Adds a weekly scheduled workflow that scans every non-archived repo under
resq-software/and flags any repo whose default branch lacks a CI job emitting therequiredstatus-check context required by thedefault-branch-baselineruleset (id15191038).Why
The ruleset requires a status context literally named
required. Any consumer repo whose CI doesn't have such a job will block every PR in "Expected — Waiting for status to be reported" state. This happened toresq-software/npm(fixed in resq-software/npm#46) — the audit catches future drift before it hits.How it works
schedule: '0 8 * * MON'(weekly, Monday 08:00 UTC) +workflow_dispatch(manual).conditions.repository_name.excludelist so explicitly-exempt repos aren't false-flagged..github/workflows/*.ymlon the default branch; looks for a top-levelrequired:job key OR aname: requiredline.SYNC_TOKEN(covers private repos) withGITHUB_TOKENfallback (public only). Private repos appear as "unreachable" whenSYNC_TOKENisn't set — informational, not flagged as a gap.Blast radius
ubuntu-latest. Well under GitHub Team's Actions-minutes budget.permissions: contents: read, issues: write— no push/deploy.step-security/harden-runnerin audit mode; consistent with the rest of the org's workflows.Test plan
workflow_dispatchto confirm the scan logic runs clean.required.ymlfrom a test repo → next scheduled run should open an issue listing it.