Repository navigation
fix(ci): allow Dependabot to receive automated review - #33
Jamie-BitFlight wants to merge 3 commits into
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52b89ed7fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| allowed_bots: 'dependabot[bot]' |
There was a problem hiding this comment.
When this workflow is triggered by a Dependabot PR, allowing the bot only gets execution past the actor check: secrets.CLAUDE_CODE_OAUTH_TOKEN is populated from the Dependabot secret store, not the existing GitHub Actions secret store. Unless the same token has separately been configured as a Dependabot secret, the action will proceed without Claude authentication and these reviews will still fail. Provision and document the same-named Dependabot secret before enabling the bot; GitHub explicitly requires this for workflows used by both Dependabot and human actors in its Dependabot Actions guidance.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Verified from the actual Dependabot review log (job 114302823497): ALL_INPUTS has an empty claude_code_oauth_token, and CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY are empty. This is a real external prerequisite, not only the default secret model. The connector cannot list or provision Dependabot secrets. Keeping this finding unresolved and this PR unmerged until an administrator supplies the same-named Dependabot secret and a real bot-triggered review passes.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c6299e5bcf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ### claude-code-review.yml | ||
|
|
||
| Automated review accepts human contributors and the `dependabot[bot]` actor. Dependabot-triggered runs read Dependabot secrets, so configure `CLAUDE_CODE_OAUTH_TOKEN` under repository Settings → Secrets and variables → Dependabot as well as the Actions secret used by human-triggered runs. Keep the token in GitHub's secret stores. Verify a real Dependabot-triggered review after configuration; a successful human-triggered review does not establish that the bot received credentials. |
There was a problem hiding this comment.
When an administrator follows this README to configure the repository, the Required Secrets section still states that nothing beyond GITHUB_TOKEN is needed, while this paragraph and .github/workflows/claude-code-review.yml:39 require CLAUDE_CODE_OAUTH_TOKEN. These contradictory instructions can leave human or Dependabot reviews unauthenticated; list the token and its required Actions/Dependabot scopes in that section and remove the blanket statement.
Useful? React with 👍 / 👎.
1 participant
Dependency PRs #29 and #30 fail Claude review before inspection: job114302823497 reports
Workflow initiated by non-human actor: dependabot (type: Bot). Configure the supported allowed_bots input for this specific bot, retaining all functional checks.Verified external prerequisite: the same job has an EMPTY claude_code_oauth_token in ALL_INPUTS, and empty CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY. An administrator must configure CLAUDE_CODE_OAUTH_TOKEN in this repository's Dependabot secret store (Settings → Secrets and variables → Dependabot). The connector cannot access or provision that store. Do not paste the token into a PR or conversation.
Workflow documentation now explains this prerequisite. Current main is merged into this branch. Keep this PR unmerged until the credential is supplied and an actual Dependabot-triggered review passes; a human-triggered green run is insufficient.