Conversation
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 Walkthroughwalkthroughadds a new github actions workflow changes
sequence diagram(s)(skip) estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes review notes
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adds an “anti-slop” PR quality screening workflow (via pull_request_target) and updates repo templates/docs/tests to enforce PR template structure and route failed screenings to needs-human-review.
Changes:
- Added
.github/workflows/anti-slop.ymlusing a commit-pinnedpeakoss/anti-slopaction with labeling/commenting behavior on failure. - Restructured the PR template into “Docs Impact” and “Governance Review” sections and added a hidden honeypot blocked term.
- Updated
CONTRIBUTING.mdandtest/documentation.test.tsto document and contract-test the new workflow + template requirements.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.github/workflows/anti-slop.yml |
Introduces the PR screening workflow with pinned action and failure handling. |
.github/pull_request_template.md |
Updates template sections and embeds the honeypot blocked term. |
CONTRIBUTING.md |
Documents new expectations around template usage and the resulting label. |
test/documentation.test.ts |
Adds assertions to ensure the workflow/template constraints remain present and pinned. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 3 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="test/documentation.test.ts">
<violation number="1" location="test/documentation.test.ts:496">
P2: Using `toMatchObject` for workflow permissions allows extra permission scopes to be added without failing the contract test.</violation>
<violation number="2" location="test/documentation.test.ts:512">
P2: The workflow contract test asserts `close-pr: false` but does not assert `lock-pr: false`, so a lock behavior regression can slip through.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/pull_request_template.md:
- Around line 19-28: The two checklist sections "## Docs Impact" and "##
Governance Review" currently present mutually exclusive options without forcing
a single selection; update each section header block to require a single choice
by adding a short explicit instruction like "Select exactly one of the options
below" (or "Pick one:"), and make the options remain checkboxes but include that
enforcement text directly beneath the headings so authors must choose one;
target the "## Docs Impact" and "## Governance Review" blocks in
.github/pull_request_template.md and ensure the wording is clear and unambiguous
to satisfy tests that only validate headings (e.g., add the single-choice
directive line immediately after each heading).
In @.github/workflows/anti-slop.yml:
- Around line 3-6: Add a short inline guardrail comment above the "on:
pull_request_target" declaration in .github/workflows/anti-slop.yml stating that
this workflow must remain metadata-only (no checkouts, no running untrusted PR
code, and no third-party actions that execute PR-supplied content) to avoid
token exposure and cache poisoning; reference the existing test at
test/documentation.test.ts:476 for context and explicitly warn future editors
not to add actions/checkout or any "uses:" or "run:" steps that would execute PR
code.
In `@test/documentation.test.ts`:
- Around line 81-88: The test model in test/documentation.test.ts currently
omits the optional "lock-pr" field so the contract/assertion (around the current
assertion block near lines 512-513) only checks "close-pr"; update the model to
add "lock-pr"?: boolean in the with object schema and modify the corresponding
assertion in the contract test to explicitly assert that "lock-pr" is false for
the maintainer workflow; ensure the new assertion is deterministic (use the same
vitest assertion style used elsewhere in this file) so future flips to
lock-pr:true will fail the test and force explicit review.
- Around line 514-523: The test currently only checks anti-slop sections of the
PR template; update the assertions in test/documentation.test.ts (the block
where prBody = read(prTemplate)) to also assert the required visible headers are
present by adding expects for "## Summary", "## What Changed", "## Risk and
Rollback", and "## Additional Notes" (and any other visible section names from
CONTRIBUTING.md) and ensure it still asserts absence/presence of the anti-slop
sections; locate the prBody usage and augment the expect(prBody).toContain(...)
/ .not.toContain(...) checks accordingly so the test will fail if any required
visible section is removed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 73d70b86-965a-4d18-970e-f3823e70b490
📒 Files selected for processing (4)
.github/pull_request_template.md.github/workflows/anti-slop.ymlCONTRIBUTING.mdtest/documentation.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Greptile Review
🧰 Additional context used
📓 Path-based instructions (1)
test/**
⚙️ CodeRabbit configuration file
tests must stay deterministic and use vitest. demand regression cases that reproduce concurrency bugs, token refresh races, and windows filesystem behavior. reject changes that mock real secrets or skip assertions.
Files:
test/documentation.test.ts
🪛 LanguageTool
CONTRIBUTING.md
[uncategorized] ~62-~62: The official name of this software platform is spelled with a capital “H”.
Context: ...the PR description. 5. Keep the visible .github/pull_request_template.md section struc...
(GITHUB)
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/anti-slop.yml">
<violation number="1" location=".github/workflows/anti-slop.yml:25">
P1: This change drops strict enforcement for `Docs Impact` and `Governance Review`, weakening PR-quality screening and breaking the documentation test contract.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="test/documentation.test.ts">
<violation number="1" location="test/documentation.test.ts:505">
P2: This assertion weakens the anti-slop contract by dropping Docs Impact/Governance Review from strict section enforcement.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
Follow-up after reviewing the current thread set on
Bot reruns are still in progress, so I have not treated the currently open bot threads as settled yet. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@test/documentation.test.ts`:
- Around line 82-90: Add deterministic regression assertions in
documentation.test.ts to cover the anti-slop workflow inputs 'max-failures' and
'exempt-draft-prs' so they cannot silently drift: locate the test that
loads/parses .github/workflows/anti-slop.yml (the existing assertions around the
inputs object) and add vitest expect(...) checks that the parsed inputs include
'max-failures' and 'exempt-draft-prs' with the expected values (or
existence/boolean type as appropriate), using the same parsing helpers used for
the other keys and avoiding mocking secrets; ensure the new expects follow the
pattern used for the other properties like "github-token" and
"require-pr-template".
- Around line 535-537: The test uses prBody but only checks a single generic
"Pick one:" which can pass if one of the two sections loses its instruction;
update the assertions in test/documentation.test.ts to verify the "Pick one:"
instruction is present for both sections by either asserting that "Pick one:"
appears twice in prBody (count occurrences) or by asserting each section
contains its own instruction (e.g., check that "## Docs Impact" is followed by
"Pick one:" and that "## Governance Review" is followed by "Pick one:"); refer
to the prBody variable and the section headers "## Docs Impact" and "##
Governance Review" when adding the stronger assertions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6821d348-e2be-473b-a512-eab476698ee3
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
.github/pull_request_template.md.github/workflows/anti-slop.ymlpackage.jsontest/documentation.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Greptile Review
🧰 Additional context used
📓 Path-based instructions (1)
test/**
⚙️ CodeRabbit configuration file
tests must stay deterministic and use vitest. demand regression cases that reproduce concurrency bugs, token refresh races, and windows filesystem behavior. reject changes that mock real secrets or skip assertions.
Files:
test/documentation.test.ts
🔇 Additional comments (6)
package.json (1)
115-116: looks good: yaml dependency matches the new test contract usage.this change is consistent with
test/documentation.test.ts:13andtest/documentation.test.ts:474..github/pull_request_template.md (2)
1-1: honeypot comment placement is correct.it stays hidden in the template source while remaining verifiable via
test/documentation.test.ts:527.
19-32: single-choice wording is now clear in both sections.the explicit prompt maps cleanly to the template checks in
test/documentation.test.ts:535-538..github/workflows/anti-slop.yml (1)
3-6: workflow hardening looks solid for this privileged trigger.metadata-only guardrails, sha pinning, and narrow permissions align with the contract enforced in
test/documentation.test.ts:482-506andtest/documentation.test.ts:507-525.Also applies to: 10-14, 21-42
test/documentation.test.ts (2)
13-13: good direction on typed yaml contract checks.the yaml parsing plus local interface keeps this test deterministic and readable in vitest.
Also applies to: 64-94
553-554: nice addition on contributing contract coverage.these checks anchor the maintainer workflow expectation in docs (
needs-human-reviewand template usage).
Summary
mainusing a commit-pinnedpeakoss/anti-slopactionValidationstrict while leavingDocs ImpactandGovernance Reviewas explicit single-choice sections that follow anti-slop's non-strict radio-button semanticsWhat Changed
.github/workflows/anti-slop.ymlonpull_request_targetwith metadata-only guardrails, hidden honeypot term blocking, andneeds-human-reviewlabeling/commenting behavior.github/pull_request_template.mdandCONTRIBUTING.mdso contributors preserve the visible template structure, avoid copying hidden trap text, and treatDocs Impact/Governance Reviewas pick-one sectionstest/documentation.test.tsto parse the workflow YAML, assert the maintainer workflow contract, and cover the visible PR template sectionsyamlexplicitly indevDependenciesfor the workflow contract testValidation
npm run lintnpm run typechecknpm testnpm test -- test/documentation.test.tsnpm run buildDocs Impact
Pick one:
Governance Review
Pick one:
Risk and Rollback
.github/workflows/anti-slop.yml,.github/pull_request_template.md,CONTRIBUTING.md,test/documentation.test.ts,package.json, andpackage-lock.jsonAdditional Notes
strict-pr-template-sectionsintentionally remainsValidationonly. Perpeakoss/anti-slop, non-strict multi-checkbox sections already require exactly one checked option, while strict sections require all checkboxes to be present and checked.peakoss/anti-slop@85daca1880e9e1af197fc06ea03349daf08f4202source strips HTML comments beforeblocked-termsmatching, so the hidden template comment only trips when copied into visible PR text.npm run typecheck,npm run build, and fullnpm teststill hit untouched baseline failures fromorigin/main, includinglib/storage.tsandtest/storage.test.ts.pull_request_targetguardrail, visible template structure checks, clearer single-choice guidance for the non-strict checklist sections, and the documented honeypot behavior.note: greptile review for oc-chatgpt-multi-auth. cite files like
lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.Greptile Summary
this PR adds a
pull_request_target-based anti-slop quality gate for PRs againstmain, replaces the flat governance checklist in the PR template with structured radio-button sections (Docs Impact/Governance Review), and hardenstest/documentation.test.tsto act as a workflow contract test — asserting the SHA pin, trigger config, permissions, and everywith:input of the anti-slop step.key changes:
.github/workflows/anti-slop.yml— new workflow; uses SHA-pinnedpeakoss/anti-slop@85daca...viapull_request_targetwithpull-requests: write+issues: write;strict-pr-template-sections: Validationonly (by design —Docs Impact/Governance Reviewuse non-strict single-choice semantics per anti-slop); HTML-comment honeypot termWORKTREE_LANTERN_1455blocks raw-template copy-paste.github/pull_request_template.md— two newPick one:radio sections; honeypot comment confined to HTML so it's stripped before blocked-term scanning; removes old flat governance checklisttest/documentation.test.ts— full contract test added: asserts SHA pin, trigger types, concurrency, permissions, timeout, allwith:inputs, honeypot visibility invariant (visiblePrBodystrip check), and every new template section heading;yamlimport now backed by explicitdevDependencypackage.json/package-lock.json—yaml@^2.8.2added todevDependenciesCONTRIBUTING.md— two new steps explain template integrity requirements andneeds-human-reviewlabel semanticsissues found:
parse()result is cast directly toAntiSlopWorkflowConfigwithout a null/truthy guard; a malformed or empty yaml file would cascade silently through optional chains rather than surfacing a clear parse error (style/test quality concern, no windows/token risk here)pull_request_target+ write scopes is documented and SHA-pinned (covered in prior review threads), no new token leakage risk introducedConfidence Score: 4/5
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[PR opened/synced/edited against main] --> B{pull_request_target trigger} B --> C[anti-slop action runs\npeakoss/anti-slop@85daca...] C --> D{require-pr-template\nchecks template presence} D -->|missing| E[failure count +1] D -->|present| F{strict section check\nValidation — all boxes must be checked} F -->|incomplete| E F -->|ok| G{blocked-terms scan\non visible body only\nHTML comments stripped} G -->|WORKTREE_LANTERN_1455 found| E G -->|clean| H{non-strict sections\nDocs Impact / Governance Review\ncheck one-checked constraint} H -->|violation| E H -->|ok| I[no failures] E --> J{failure count >= max-failures 4?} J -->|yes| K[add needs-human-review label\npost failure-pr-message comment] J -->|no| I I --> L[workflow passes — PR proceeds normally] K --> M[maintainer review required before merge]Prompt To Fix All With AI
Last reviewed commit: 2393d9c