feat(cursor-review): optional dedicated bot identity for review posting (BE-1812)#13
Conversation
…ng (BE-1812) Post the consolidated review + per-finding line comments under an optional dedicated GitHub App identity (e.g. cloud-code-bot[bot]) instead of the shared github-actions[bot], so the threads are distinct and queryable. - Declare optional workflow_call secrets BOT_APP_ID + BOT_APP_PRIVATE_KEY. - Conditionally mint an app token (actions/create-github-app-token@v2) when set. - Post review uses steps.bot_token.outputs.token || secrets.GITHUB_TOKEN. Red-safe: with no creds the mint step is skipped and posting stays github-actions[bot] -- zero behavior change for any consumer. Dedup keys on the review body marker and triggerer attribution already handles a bot actor, so no companion edits were needed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 40 minutes and 48 seconds. Learn how PR review limits work. To continue reviewing without waiting, enable usage-based billing in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
… secrets-if workaround App IDs aren't secret, and the org already stores cloud-code-bot's as the APP_ID *variable* (+ CLOUD_CODE_BOT_PRIVATE_KEY secret), used by several cloud workflows. Make bot_app_id a workflow_call input instead of a secret; this also lets the mint step gate on 'if: inputs.bot_app_id != ""' directly, removing the detect-step that only existed because 'secrets' is not a valid step-if context. Bump create-github-app-token v2 -> v3 to match cloud's existing pin. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The reusable workflow is consumed open-source; the example caller comments named Comfy's specific bot + secret names. Swap them for generic placeholders (REVIEW_BOT_APP_ID / REVIEW_BOT_PRIVATE_KEY) so consumers plug in their own App. The interface (bot_app_id / BOT_APP_PRIVATE_KEY) was already identity-agnostic; this is comments only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…llers (BE-1814) (#32) * ci(bump-callers): wire cloud-code-bot review identity into flagged callers (BE-1814) Story 1.3 of BE-1800: fan out the optional bot-identity wiring the reusable cursor-review.yml gained in Story 1.1 (PR #13) through the caller-bump workflow instead of hand-editing each consumer. - New idempotent helper .github/cursor-review/wire-bot-identity.py injects bot_app_id: ${{ vars.APP_ID }} under with: and BOT_APP_PRIVATE_KEY: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} under secrets:, preserving comments/formatting (line-based, not a YAML round-trip). - bump-cursor-review-callers.yml gains a per-caller wire_bot flag (4th field); flagged only for repos that already hold the creds (cloud, mcp-server, comfy-inapp-agent, Comfy-iOS). Others stay github-actions[bot] (non-breaking). - Skip check is now content-based so a wiring-only change still opens a PR. - Unit tests for the helper run under the existing test-cursor-review-scripts CI. * feat(bump-callers): teach the shared bumper the wire_bot field (BE-1814) main refactored bump-cursor-review-callers.yml to a JSON caller variable + shared bump-callers.sh while this branch was adding wire_bot support to the old hardcoded-CALLERS version. Re-implement the capability on the new architecture instead of reviving the old one: bump-callers.sh now accepts an optional wire_bot field per caller entry and an optional WIRE_BOT_SCRIPT env (set only by bump-cursor-review-callers.yml, pointing at wire-bot-identity.py), so the identity wiring folds into the same content-equality staging pass as the SHA rewrite.
1 participant
Implements BE-1812 (hunks 1+2 of the BE-1800 approach): the cursor-review reusable workflow can post under an optional dedicated bot identity instead of the shared
github-actions[bot], so its review threads become distinct and queryable.Change — one file,
.github/workflows/cursor-review.ymlworkflow_callsecrets:BOT_APP_ID,BOT_APP_PRIVATE_KEY(bothrequired: false).Detect bot identitystep + a conditionalactions/create-github-app-token@v2mint step before Post review.${{ steps.bot_token.outputs.token || secrets.GITHUB_TOKEN }}.post-review.pyis untouched — the comment author follows whatever token it gets.Safe to merge now (red-safe / no-op until configured)
With no creds supplied, the mint step is skipped and posting stays
github-actions[bot]— zero behavior change for every consumer, including OSS callers. It posts under the new identity only once the App + org secrets exist (BE-1813) and callers pass them through (BE-1814).Two usual footguns were already handled here, so no companion edits:
Pin style matches the file (bare tags). Caller passthrough is the separate BE-1814.
Refs BE-1812 · parent BE-1800.