feat: add summary report-mode + outputs to scanner reusables - #72
Conversation
Adds a 'report-mode' input (default 'comment', unchanged behavior) to the bumblebee and betterleaks reusables. In 'summary' mode they skip posting their own PR comment / tracking issue and instead expose workflow_call outputs (status: ok|warn|fail|error, total: count) for an aggregator. Enables a single consolidated 'Security Suite' PR comment instead of one comment per scanner. Part of geolonia-operations#196.
|
Warning Review limit reached
More reviews will be available in 2 minutes and 8 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Secret Leak CheckOK No secrets detected in this PR's diff. |
Run the scanners in report-mode: summary (quiet) and add a report job that posts a single consolidated comment with a status table for all four checks, instead of one comment per scanner. Temporarily references the report-mode reusables at the #72 branch SHA; bump to the release tag once #72 ships. Part of geolonia-operations#196.
Run the scanners in report-mode: summary (quiet) and add a report job that posts a single consolidated comment with a status table for all four checks, instead of one comment per scanner. Temporarily references the report-mode reusables at the #72 branch SHA; bump to the release tag once #72 ships. Part of geolonia-operations#196.
#72 released as v1.18.0 (report-mode + outputs). Bump the suite's reusable refs from the pre-release branch SHA to the v1.18.0 tag, so the action-pinning check passes.
* feat: add Security Suite workflow (one-stop, ruleset-enforceable) Single entry point that fans out to the org security scanners (bumblebee, betterleaks, pinact) plus an inline zizmor GitHub Actions static-analysis job. Designed to run as an organization required workflow so every repo gets the same gate with no per-repo workflow file. zizmor runs warn-only during rollout. Part of geolonia-operations#196. * feat: aggregate scanners into one Security Suite comment Run the scanners in report-mode: summary (quiet) and add a report job that posts a single consolidated comment with a status table for all four checks, instead of one comment per scanner. Temporarily references the report-mode reusables at the #72 branch SHA; bump to the release tag once #72 ships. Part of geolonia-operations#196. * fix: grant reusable-call jobs the permissions the reusables declare A called reusable can only downgrade the caller's GITHUB_TOKEN, not elevate it. Reducing the summary-mode caller jobs to contents:read made the reusables' declared pull-requests/issues:write exceed the grant, causing a workflow startup_failure. Grant the declared permissions. * fix: pass --repo to gh pr comment in the report job The report job has no checkout, so gh pr comment cannot infer the repo from git context. Pass --repo explicitly (the gh api calls already do). * chore: pin Security Suite reusables to v1.18.0 #72 released as v1.18.0 (report-mode + outputs). Bump the suite's reusable refs from the pre-release branch SHA to the v1.18.0 tag, so the action-pinning check passes. * fix: dedup suite comment lookup (gh --slurp is incompatible with --jq) The marker lookup used 'gh api --paginate --slurp --jq', but --slurp cannot be combined with --jq, so the call always errored, got swallowed by '|| true', and the report job posted a new comment every run instead of updating in place. Use plain --paginate + .[]. * fix: address CodeRabbit review on the report job - concurrency group per PR so overlapping runs cannot double-post - comment lookup is strict (real API errors fail the job; empty = no match) instead of masking failures with || true - posting degrades gracefully (warn, not fail) when the token is read-only on fork PRs, so the suite does not fail just to comment
What
Adds a
report-modeinput plusworkflow_calloutputs to the two scanner reusables that post PR comments (reusable-bumblebee-scan.yml,reusable-secret-leak-check.yml):report-mode(string, default"comment") —commentkeeps today's behavior exactly (post / update the PR comment, open tracking issues).summarymakes the reusable stay quiet and only expose its results.status(ok/warn/fail/error) andtotal(finding count).Why
Today each scanner posts its own bare PR comment (and the text shows literal
OK/Xinstead of a status glyph). The goal is one consolidated "Security Suite" comment with a status table. This PR is the prerequisite: it lets the suite call each scanner insummarymode and aggregate the outputs into a single comment.pinactposts no comment (it is a pure gate), so it needs no change. The suite reads its pass/fail from the job result.Backward compatible
Default
report-mode: commentmeans every existing caller behaves identically. Only the Security Suite (geolonia-operations#196) will passreport-mode: summary.Next (separate PR, after this releases)
Because a required workflow must reference reusables by a released ref, the suite work lands after this is tagged: bump
security-suite.ymlto the new release and add areportjob that posts the consolidated comment from these outputs.Part of geolonia-operations#196. Umbrella: geolonia-operations#195.
Validation
actionlintclean on both files.