fix: pin gavel - #337
Conversation
WalkthroughThe test workflow now references the Gavel GitHub Action by commit instead of the mutable ChangesWorkflow security
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test.yml:
- Line 36: Update the comment on the flanksource/gavel workflow step to
accurately describe the pinned dependency, replacing “main” with the pinned
commit SHA prefix or the intended explicit release tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: fa2479a5-d4e6-4cb7-9faf-5bcc5f5aefe2
📒 Files selected for processing (1)
.github/workflows/test.yml
| uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | ||
|
|
||
| - uses: flanksource/gavel@main | ||
| - uses: flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0 # main |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow line context:"
if [ -f .github/workflows/test.yml ]; then
nl -ba .github/workflows/test.yml | sed -n '30,42p'
else
echo ".github/workflows/test.yml not found"
fi
echo
echo "All uses references in workflow:"
rg -n "uses:|gavel" .github/workflows/test.yml || true
echo
echo "Resolve flanksource/gavel main tag object/target:"
if command -v gh >/dev/null 2>&1; then
for ref in "43a9189b99e71ed928f418e01cd34aa797c2c0e0" "main"; do
echo "--- $ref"
gh api "repos/flanksource/gavel/git/matches/$ref" -q '.[].sha' 2>/dev/null || true
done
gh api repos/flanksource/gavel/git/ref/tags/main 2>/dev/null || true
tag_obj="$(gh api repos/flanksource/gavel/git/ref/tags/main -q '.object.sha' 2>/dev/null || true)"
if [ -n "$tag_obj" ]; then
echo "tag object:"
gh api "repos/flanksource/gavel/git/tags/$tag_obj" 2>/dev/null || true
fi
else
echo "gh CLI not available"
fi
echo
echo "Read-only check: workflow contains pinned SHA with # main comment:"
python3 - <<'PY'
from pathlib import Path
p=Path(".github/workflows/test.yml")
if p.exists():
lines=[(i+1,l.strip()) for i,l in enumerate(p.read_text().splitlines())]
for i,l in lines:
if "flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0 # main" in l:
print(f"line {i}: {l}")
else:
print("missing")
PYRepository: flanksource/commons
Length of output: 220
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow line context:"
if [ -f .github/workflows/test.yml ]; then
awk '{printf "%5d\t%s\n", NR, $0}' .github/workflows/test.yml | sed -n '30,42p'
else
echo ".github/workflows/test.yml not found"
fi
echo
echo "All uses references in workflow:"
grep -n "uses:\|gavel" .github/workflows/test.yml || true
echo
echo "Read-only structural check: workflow contains pinned SHA with # main comment:"
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/test.yml")
target = "flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0 # main"
for i, line in enumerate(p.read_text().splitlines(), 1):
if target in line.strip():
print(f"line {i}: {line.strip()}")
PRIVATED
for i, line in enumerate(p.read_text().splitlines(), 1):
stripped=line.strip()
if "flanksource/gavel@" in stripped:
print(f"gavel ref at line {i}: {stripped}")
PY
echo
echo "Remote gavel refs/tags/main availability:"
python3 - <<'PY'
import urllib.request, json
ref_url = "https://api.github.com/repos/flanksource/gavel/git/ref/tags/main"
try:
with urllib.request.urlopen(ref_url, timeout=20) as r:
print(r.status)
data = json.load(r)
print(data)
except Exception as e:
print(type(e).__name__, e)
PY
echo
echo "Remote pinned SHA availability:"
python3 - <<'PY'
import urllib.request, json
sha = "43a9189b99e71ed928f418e01cd34aa797c2c0e0"
url = f"https://api.github.com/repos/flanksource/gavel/git/matches/{sha}"
try:
with urllib.request.urlopen(url, timeout=20) as r:
print(r.status)
data = json.load(r)
print(data)
except Exception as e:
print(type(e).__name__, e)
# Also show HEAD/main commit if easily available without raw content
main_url = "https://api.github.com/repos/flanksource/gavel/git/refs/heads/main"
try:
with urllib.request.urlopen(main_url, timeout=20) as r:
data = json.load(r)
print("HEAD main object:", data.get("object"))
except Exception as e:
print(type(e).__name__, e)
PYRepository: flanksource/commons
Length of output: 1639
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Remote gavel refs/tags/main object:"
python3 - <<'PY'
import urllib.request, json
url = "https://api.github.com/repos/flanksource/gavel/git/ref/tags/main"
try:
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print("status", r.status)
print("object", data.get("object"))
if data.get("object", {}).get("type") == "tag":
tag_url = "https://api.github.com/repos/flanksource/gavel/git/tags/" + data["object"]["sha"]
with urllib.request.urlopen(tag_url, timeout=20) as tr:
tdata = json.load(tr)
print("tag object", tdata)
print("dereferenced commit", tdata.get("object", {}).get("sha"))
except Exception as e:
print(type(e).__name__, e)
PY
echo
echo "Remote commit SHA availability:"
python3 - <<'PY'
import urllib.request, json
sha = "43a9189b99e71ed928f418e01cd34aa797c2c0e0"
url = "https://api.github.com/repos/flanksource/gavel/git/commits/" + sha
try:
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print("status", r.status)
print("sha", data.get("sha"))
print("commit_message", data.get("commit", {}).get("message", "").splitlines()[0])
except Exception as e:
print(type(e).__name__, e)
PYRepository: flanksource/commons
Length of output: 514
🌐 Web query:
flanksource gavel main tag commit 43a9189b99e71ed928f418e01cd34aa797c2c0e0
💡 Result:
The git commit hash 43a9189b99e71ed928f418e01cd34aa797c2c0e0 is not found in the flanksource/gavel GitHub repository [1]. A review of the repository's commit history, release tags, and associated pull requests does not show this specific commit hash [1][2][3]. The flanksource/gavel project is a tool written primarily in Go that provides a gavel command-line interface for managing git commits, among other features [1]. Official releases for the repository currently extend up to at least v0.0.52 [3]. The provided commit hash does not correspond to any known activity or branch within this repository [1].
Citations:
- 1: https://github.com/flanksource/gavel
- 2: https://github.com/flanksource/gavel/releases
- 3: https://github.com/flanksource/gavel/releases/tag/v0.0.52
🌐 Web query:
github flanksource gavel commit 43a9189b99e71ed928f418e01cd34aa797c2c0e0
💡 Result:
The commit hash 43a9189b99e71ed928f418e01cd34aa797c2c0e0 is not associated with the official flanksource/gavel repository [1]. A comprehensive search of commit history, pull requests, and releases within that repository does not return this specific hash [1][2][3][4][5][6][7][8][9][10][11][12][13][14]. It is possible this commit hash belongs to a different project or a fork not indexed in the provided results, as similar hashes appear in other contexts unrelated to the flanksource/gavel codebase [15][16][17][18][19][20].
Citations:
- 1: https://github.com/flanksource/gavel
- 2: flanksource/gavel@414d694
- 3: flanksource/gavel@23462da
- 4: flanksource/gavel@bec0766
- 5: flanksource/gavel@6686a89
- 6: flanksource/gavel@30f0003
- 7: flanksource/gavel@v0.0.42...v0.0.43
- 8: flanksource/gavel@v0.0.41...v0.0.42
- 9: flanksource/gavel@v0.0.44...v0.0.45
- 10: flanksource/gavel@3a9550d
- 11: flanksource/gavel@77ac6a5
- 12: feat: add org CI status, test outline, oxlint, auto-merge, procfile supervision, and React UI gavel#59
- 13: feat: add AI-powered fixing, MCP server, and fixture testing enhancements gavel#52
- 14: feat(commit,ui,lint,config): Add multi-commit splitting, linter enablement config, and UI improvements - Add CommitAll (-A) flag to split staged changes into multiple AI-planned commits with optional max limit - Add linter enablement configuration to allow opt-in/opt-out of specific linters like jscpd - Implement IsLinterEnabled() helper and MergeLintConfig() support for linter settings - Fix LintIgnoreRule to match violations by file path alone - Update UI serve command to accept positional arguments for multiple result files instead of --results-file flag - Update documentation with new commit and UI serve examples - Clean up unused go.sum dependencies gavel#30
- 15: https://optimistic.etherscan.io/address/0x43e9b91132dd166243659303236273aa9d9a4c8d
- 16: https://etherscan.io/address/0x43aABa3F6449656041Fb894f7a3DC59A31cEfB51
- 17: https://etherscan.io/address/0x43a48F99d1C9B7c1D0AeEfCb159f49E325bb413A
- 18: https://etherscan.io/address/0x43a9094c7887e52ae2a4ae837e18c837f3697ed7
- 19: https://optimistic.etherscan.io/address/0x43a1aa93e959a19fe8137115fcd6281cb4cdda7d
- 20: danielcopper/romm-gavel@f57f2e8
🌐 Web query:
site:github.com/flanksource/commons gavel@
💡 Result:
Gavel is a specialized CI/CD tool, distributed as a GitHub Action (flanksource/gavel), designed to execute, monitor, and report on testing and linting processes within a repository [1][2][3]. It is primarily used in GitHub Actions workflows to streamline CI/CD feedback by providing integrated test summaries, artifact generation (such as JSON and HTML result files), and automated pull request comments [1][2][4][3]. When integrated into a workflow, it typically replaces standard, unformatted go test output, allowing for more structured reporting and better visibility into test performance and linting outcomes [2][3]. Key features and use cases include: - CI/CD Integration: It is invoked in GitHub Actions using uses: flanksource/gavel@<version> [1][3]. - Automated Reporting: It supports outputting results in multiple formats, including JSON, HTML, and Markdown summaries, and can automatically post these results as comments on pull requests [1][2][4][3]. - Configuration: It can be configured via a .gavel.yaml file to manage settings, such as ignoring specific files or detections, which helps reduce noise from false positives [5]. - Error Handling: It includes flags like fail-on-error, allowing developers to control whether the CI pipeline should fail based on the tool's execution results [1][3]. There is no indication that "gavel@" refers to an email domain; rather, it appears to be a misinterpretation of the GitHub Action syntax (e.g., flanksource/gavel@main or flanksource/gavel@v<version>), where the "@" symbol denotes a specific version, branch, or tag reference for the action [1][2][3].
Citations:
- 1: https://github.com/flanksource/commons/blob/516bc6d9fdbff0b693df701ae444ce29f617919f/.github/workflows/test.yml
- 2: https://github.com/flanksource/commons/pull/308/files
- 3: https://github.com/flanksource/commons/pull/309/files
- 4: refactor(http): replace digest auth dependency and enhance logging #311
- 5: https://github.com/flanksource/commons/pull/310/files
🌐 Web query:
"flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0"
💡 Result:
flanksource/gavel is a CLI toolkit designed for testing, linting, AI-powered code review, and CI automation [1]. The repository, hosted on GitHub, is written primarily in Go [1]. The specific commit reference 43a9189b99e71ed928f418e01cd34aa797c2c0e0 corresponds to a historical state of the main branch in the flanksource/gavel repository. Key capabilities of the Gavel tool include: - Fixture-based testing using markdown files with command blocks, tables, and CEL assertions [2]. - AI-powered code review and automated repair of lint violations [3]. - Integration with the Model Context Protocol (MCP) to allow AI assistants to interact safely with Gavel commands [3]. - CI/CD workflow management, including migration tools for GitHub Actions [2], organization-wide CI status reporting [4], and automated PR handling [4][3]. - Process supervision (e.g., Procfile support) for managing local development environments [4]. - Support for various linters, including integration of oxlint [4]. The project supports agentic workflows via the "Agent Skills" specification, enabling compatibility with various AI assistants such as Claude Code, VS Code Copilot, Cursor, and the Gemini CLI [2]. As of August 2026, the project remains actively developed with frequent releases [5][6].
Citations:
- 1: https://github.com/flanksource/gavel
- 2: https://github.com/flanksource/gavel/blob/main/.agents/skills/README.md
- 3: feat: add AI-powered fixing, MCP server, and fixture testing enhancements gavel#52
- 4: feat: add org CI status, test outline, oxlint, auto-merge, procfile supervision, and React UI gavel#59
- 5: https://github.com/flanksource/gavel/releases
- 6: https://github.com/flanksource/gavel/releases/tag/v0.0.52
Align the workflow comment with the pinned SHA.
Line 36 pins flanksource/gavel to a commit SHA, but # main still describes a mutable branch. Use the commit prefix or an explicit release tag if that is the intended dependency.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yml at line 36, Update the comment on the
flanksource/gavel workflow step to accurately describe the pinned dependency,
replacing “main” with the pinned commit SHA prefix or the intended explicit
release tag.
Gavel summary
Totals: 463 passed · 0 failed · 3 skipped · 15.1s |
|
🎉 This PR is included in version 1.54.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
2 participants
Summary by CodeRabbit