ci: add PR merge guidance workflow#1971
Conversation
📝 WalkthroughWalkthroughThis PR adds a new GitHub Actions workflow that automatically manages merge guidance comments on pull requests. The workflow monitors PR lifecycle events and pushes to main/develop branches, then posts warnings about merge conflicts or unverified commits to affected PRs with dry-run support by default. ChangesPR Merge Guidance Workflow
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/pr-merge-guidance.yml (2)
65-67: ⚡ Quick winConsider wrapping individual PR processing in try-catch to avoid skipping remaining PRs.
If
processPullRequestthrows for one PR (e.g., transient API error), the loop exits and subsequent PRs are not processed. For push events that may affect many open PRs, this could leave some without guidance.🛡️ Proposed fix to add error handling
for (const openPullRequest of openPullRequests) { - await processPullRequest(openPullRequest.number); + try { + await processPullRequest(openPullRequest.number); + } catch (error) { + core.warning(`Failed to process PR #${openPullRequest.number}: ${error.message}`); + } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-merge-guidance.yml around lines 65 - 67, The loop over openPullRequests should not abort on a single failure: wrap the await processPullRequest(openPullRequest.number) call in a try-catch inside the for loop so each PR is processed independently; on error catch the exception, log a descriptive message including the openPullRequest.number and error details (or record failure) and continue to the next PR, ensuring transient API errors or one bad PR don’t prevent processing of remaining PRs.
37-37: 💤 Low valuePin
actions/github-scriptto a commit SHA (supply-chain security)
.github/workflows/pr-merge-guidance.ymlline 37 usesactions/github-script@v9(mutable tag); pin it to a specific commit SHA such as3a2844b7e9c422d3c10d287c895573f7108da1b3(v9.0.0) to avoid unexpected changes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-merge-guidance.yml at line 37, Replace the mutable action reference "actions/github-script@v9" with a pinned commit SHA to prevent supply-chain changes; update the use of actions/github-script in the workflow (the line that currently references actions/github-script@v9) to the specific commit SHA (for example 3a2844b7e9c422d3c10d287c895573f7108da1b3) so the workflow uses an immutable reference.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/pr-merge-guidance.yml:
- Around line 65-67: The loop over openPullRequests should not abort on a single
failure: wrap the await processPullRequest(openPullRequest.number) call in a
try-catch inside the for loop so each PR is processed independently; on error
catch the exception, log a descriptive message including the
openPullRequest.number and error details (or record failure) and continue to the
next PR, ensuring transient API errors or one bad PR don’t prevent processing of
remaining PRs.
- Line 37: Replace the mutable action reference "actions/github-script@v9" with
a pinned commit SHA to prevent supply-chain changes; update the use of
actions/github-script in the workflow (the line that currently references
actions/github-script@v9) to the specific commit SHA (for example
3a2844b7e9c422d3c10d287c895573f7108da1b3) so the workflow uses an immutable
reference.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c362686c-df22-437f-8281-8b9beb3f6057
📒 Files selected for processing (1)
.github/workflows/pr-merge-guidance.yml
Greptile SummaryThis PR adds a new GitHub Actions workflow (
|
| Filename | Overview |
|---|---|
| .github/workflows/pr-merge-guidance.yml | New GitHub Actions workflow that detects unverified commits and merge conflicts on non-draft PRs and posts/updates/removes a single bot guidance comment; previous review concerns (error isolation, comment ordering, UNKNOWN-state logging) are all addressed in the current diff. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A([Trigger]) --> B{Event type?}
B -- pull_request_target --> C[PR_NUMBER set]
B -- push to main/develop --> D[BASE_BRANCH set]
B -- workflow_dispatch --> E[pr_number input]
C --> F[processPullRequest PR_NUMBER]
E --> F
D --> G[Paginate open PRs on branch]
G --> H{For each PR}
H -- try --> F
H -- catch --> I[core.warning + continue]
F --> J[REST: get PR metadata]
J --> K{PR open?}
K -- No --> L[Skip]
K -- Yes --> M{PR created before cutoff?}
M -- Yes --> L
M -- No --> N[findExistingComment]
N --> O{PR is draft?}
O -- Yes --> P[deleteExistingComment]
O -- No --> Q[getPullRequestState with retries]
Q --> R[listCommits]
R --> S{Conflict or unverified commits?}
S -- None --> T[deleteExistingComment]
S -- Found --> U{Existing comment?}
U -- Yes, body changed --> V[updateComment]
U -- Yes, same body --> W[No-op]
U -- No --> X[createComment]
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
.github/workflows/pr-merge-guidance.yml:3-5
**`pull_request_target` with write permissions — safe today, fragile by design**
This workflow uses `pull_request_target` (which runs in the base-branch context with the full `GITHUB_TOKEN`) alongside `issues: write` and `pull-requests: write`. The current implementation is safe because no PR branch code is checked out or executed. However, `pull_request_target` + write permissions is one of GitHub's most commonly cited high-risk patterns: any future change that adds an `actions/checkout` step pointing at `github.event.pull_request.head.sha` would immediately create a token-exfiltration vector for malicious fork PRs. A prominent comment in the workflow (or a dedicated step guard) warning future contributors not to checkout PR code here would make this constraint explicit and durable.
Reviews (3): Last reviewed commit: "apply review suggestions" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Pouyanpi
force-pushed
the
pouyanpi/github-actions-gpg-comments
branch
from
c0eb109 to
070defc
Compare
|
@claude review |
1 participant
Summary
Adds a PR guidance workflow that comments on non-draft PRs when contributor-actionable merge blockers are detected:
The workflow updates one bot comment, deletes it when no guidance is needed, skips draft PRs, and skips PRs created before April 1, 2026.
Automatic runs remain disabled unless
PR_MERGE_GUIDANCE_ENABLED=trueis set.Testing
Tested on fork PR Pouyanpi#32:
git diff --checkpassedSummary by CodeRabbit