Skip to content

ci: fix fallback reviewer token permissions (checks/statuses read, GITHUB_TOKEN read-only) #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevVig merged 1 commit into from
Oct 6, 2026
Merged

ci: fix fallback reviewer token permissions (checks/statuses read, GITHUB_TOKEN read-only) #115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions .github/workflows/coderabbit-fallback-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,15 @@ concurrency:

permissions:
contents: read
pull-requests: write
issues: write
# Writes (comments, labels) go through CODEX_GITHUB_TOKEN, not GITHUB_TOKEN.
# Same-repo pull_request jobs check out PR code and omit the PAT,
# so GITHUB_TOKEN stays read-only.
pull-requests: read
issues: read
# loadPrEvidence reads CodeRabbit check-runs and commit statuses. Unlisted
# scopes are none, so without these the in-progress safeguard is silently empty.
checks: read
statuses: read

env:
FALLBACK_WINDOW_MINUTES: "45"
Expand All @@ -62,7 +69,7 @@ jobs:
- name: Evaluate ready pull requests
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CODEX_GITHUB_TOKEN: ${{ secrets.CODEX_GITHUB_TOKEN }}
CODEX_GITHUB_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CODEX_GITHUB_TOKEN || '' }}
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_API_URL: ${{ github.api_url }}
GITHUB_EVENT_NAME: ${{ github.event_name }}
Expand Down
2 changes: 1 addition & 1 deletion docs/ops/pr-review-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Record the fallback honestly as an independent review, never as `CodeRabbit: 0`.

### Automatic Codex fallback

Jonathan approved this automation on October 5, 2026: request a Codex review automatically only when CodeRabbit cannot review a ready pull request. The workflow is `.github/workflows/coderabbit-fallback-review.yml` and the decision script is `.github/pr-review-fallback/pr-review-fallback.mjs`. Unit tests live at `scripts/pr-review-fallback.test.mjs` so `node --test` (which skips hidden `.github/` directories) actually runs them; CI invokes that file explicitly because this repository does not run a repo-root `node --test`. It is fallback-only and must not run on every pull request.
Jonathan approved this automation on October 5, 2026: request a Codex review automatically only when CodeRabbit cannot review a ready pull request. The workflow is `.github/workflows/coderabbit-fallback-review.yml` and the decision script is `.github/pr-review-fallback/pr-review-fallback.mjs`. Unit tests live at `scripts/pr-review-fallback.test.mjs` so `node --test` (which skips hidden `.github/` directories) actually runs them; CI invokes that file explicitly because this repository does not run a repo-root `node --test`. It is fallback-only and must not run on every pull request. The workflow token is read-only plus checks/statuses read, and all writes use `CODEX_GITHUB_TOKEN`.

Triggers:

Expand Down
Loading