Create Renovate Repair PR Workflow#431
Conversation
📝 WalkthroughWalkthroughA new GitHub Actions workflow automates creation of "repair" draft PRs when Renovate PRs fail CI. The workflow discovers eligible Renovate PRs, validates branch patterns, computes deterministic repair branch names, checks for existing repairs, and creates draft PRs with empty retrigger commits or logs existing repairs to prevent duplicates. ChangesRenovate Repair PR Workflow
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/create-renovate-repair-pr.yml:
- Around line 31-44: The workflow currently creates the GitHub App token
unconditionally in the step with id "app-token" (uses:
actions/create-github-app-token) even for workflow_run events that aren’t PRs;
update the job condition to gate workflow_run paths by adding
github.event.workflow_run.event == 'pull_request' to the existing if check,
perform the read-only PR existence/eligibility lookup using the default
GITHUB_TOKEN before any app token creation, and move the "app-token" step so it
only runs on the branch-push / PR-create path (i.e., when the PR lookup shows an
eligible Renovate PR) to avoid minting the app token for non-PR workflow_run
failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9337d101-6ff6-431c-b1f6-eaa79e60730f
📒 Files selected for processing (1)
.github/workflows/create-renovate-repair-pr.yml
| if: >- | ||
| github.event_name == 'workflow_dispatch' || | ||
| github.event.workflow_run.conclusion == 'failure' | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| actions: read | ||
| steps: | ||
| - name: GitHub App トークンの生成 | ||
| id: app-token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | ||
| with: | ||
| app-id: ${{ secrets.GHA_APP_ID }} | ||
| private-key: ${{ secrets.GHA_APP_PRIVATE_KEY }} |
There was a problem hiding this comment.
Delay GitHub App token creation until after the PR is proven eligible.
lint and Test Install Scripts also run on push to main, so failed non-PR runs still reach this job and mint the app token before the workflow discovers there is no target Renovate PR. Please gate workflow_run paths on github.event.workflow_run.event == 'pull_request' and do the read-only PR lookup with the default GITHUB_TOKEN; only create the app token on the branch-push / PR-create path.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 41-41: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/create-renovate-repair-pr.yml around lines 31 - 44, The
workflow currently creates the GitHub App token unconditionally in the step with
id "app-token" (uses: actions/create-github-app-token) even for workflow_run
events that aren’t PRs; update the job condition to gate workflow_run paths by
adding github.event.workflow_run.event == 'pull_request' to the existing if
check, perform the read-only PR existence/eligibility lookup using the default
GITHUB_TOKEN before any app token creation, and move the "app-token" step so it
only runs on the branch-push / PR-create path (i.e., when the PR lookup shows an
eligible Renovate PR) to avoid minting the app token for non-PR workflow_run
failures.
| SAFE_BRANCH=$(printf '%s' "$HEAD_BRANCH" | sed -E 's|^renovate/||; s|[^A-Za-z0-9._-]+|-|g' | cut -c1-80) | ||
| REPAIR_BRANCH="renovate-repair/pr-${PR_NUMBER}-${SAFE_BRANCH}" | ||
| EXISTING_PR=$(gh pr list \ | ||
| --repo "${{ github.repository }}" \ | ||
| --state open \ | ||
| --head "$REPAIR_BRANCH" \ | ||
| --json number,url \ | ||
| --jq '.[0].url // empty') |
There was a problem hiding this comment.
Stale repair branches will block later retries.
REPAIR_BRANCH is deterministic, but duplicate detection only looks for an open PR. If a previous repair PR was closed or merged and its branch still exists, the later git push origin "${REPAIR_BRANCH}" on Line 193 becomes a non-fast-forward update because this job recreates the branch from HEAD_BRANCH. Please also handle an existing remote branch here, or generate a new branch name when the ref is already present.
tqer39
force-pushed
the
feat/renovate-repair-pr-workflow
branch
from
4b1ff37 to
27967ba
Compare
github-actions
Bot
changed the title
1 participant
📒 変更の概要
create-renovate-repair-pr.ymlワークフローを追加しました。このワークフローは、Renovate PR の CI が失敗した場合に修正 PR を自動生成するためのものです。⚒ 技術的詳細
workflow_dispatchとworkflow_runのイベントに基づいてトリガーされます。⚠ 注意点