fix: keep independent CI checks off the critical path - #1567
Conversation
|
Warning Review limit reached
Next review available in: 41 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughCI가 ChangesCI 검증 및 실행 흐름
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ChangesJob
participant ValidateJob
participant EcosystemAdvisory
participant DocsSyncCheck
participant ArtifactStore
ChangesJob->>ValidateJob: profile 및 base 출력 전달
ChangesJob->>EcosystemAdvisory: profile 조건 전달
ChangesJob->>DocsSyncCheck: 변경 감지 결과 전달
ValidateJob->>ArtifactStore: 검증 및 생성 앱 실패 아티팩트 업로드
EcosystemAdvisory->>ArtifactStore: 자문 결과 및 실패 아티팩트 업로드
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Benchmark Results✅ All benchmarks passed
Updated: 2026-07-27T15:29:26.630Z · Commit: 6e77ce2 |
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTurbo 캐시 복원 스텝이 5개 job에 동일하게 중복됩니다.
path,key공식,restore-keys폴백 체인, 액션 SHA까지 완전히 동일한 블록이 반복되므로, composite action(예:.github/actions/restore-turbo-cache/action.yml)으로 추출하면 향후 캐시 키 전략 변경 시 한 곳만 수정하면 됩니다.
.github/workflows/ci.yml#L65-74:validatejob의 캐시 복원 스텝을 composite action 호출로 교체..github/workflows/ci.yml#L469-478:ecosystem-advisoryjob의 동일 스텝을 같은 composite action 호출로 교체..github/workflows/ci.yml#L535-544:windows-scaffoldjob의 동일 스텝을 같은 composite action 호출로 교체..github/workflows/ci.yml#L603-611:docs-sync-checkjob의 동일 스텝을 같은 composite action 호출로 교체..github/workflows/ci.yml#L635-644:docs-buildjob의 동일 스텝을 같은 composite action 호출로 교체.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 1, Extract the duplicated Turbo cache restore step from the validate, ecosystem-advisory, windows-scaffold, docs-sync-check, and docs-build jobs into a shared composite action at .github/actions/restore-turbo-cache/action.yml, preserving the existing path, key formula, restore-keys fallback chain, and action SHA. Replace each inline cache block with a call to the shared composite action so future cache-strategy changes are centralized.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 450-459: Update the Checkout step in the ecosystem-advisory job to
disable persisted credentials by configuring persist-credentials as false,
matching the existing validate and changes jobs and resolving the zizmor
artipacked warning.
- Around line 450-514: ecosystem-advisory 작업이 기본 권한을 상속하지 않도록 job 수준에 최소 권한을
명시하세요. 해당 job 정의에 permissions 블록을 추가하고 저장소 읽기와 아티팩트 업로드에 필요한 actions 권한만 허용하도록
contents: read 및 actions: read를 설정하세요.
- Around line 140-144: Update the workflow steps that directly interpolate
needs.changes.outputs.profile or base inside run scripts, including the audit
policy, security summary, validation, and summary/archive sections. Pass these
outputs through each step’s env mapping, then reference the resulting PROFILE
and BASE_REF shell variables in the script while preserving the existing
behavior.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Line 1: Extract the duplicated Turbo cache restore step from the validate,
ecosystem-advisory, windows-scaffold, docs-sync-check, and docs-build jobs into
a shared composite action at .github/actions/restore-turbo-cache/action.yml,
preserving the existing path, key formula, restore-keys fallback chain, and
action SHA. Replace each inline cache block with a call to the shared composite
action so future cache-strategy changes are centralized.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9f06851e-a6a0-48e6-95ae-27665234be88
📒 Files selected for processing (6)
.github/workflows/benchmark.yml.github/workflows/ci.yml.github/workflows/pr-review-companion.yml.github/workflows/release.ymlscripts/tests/ci-workflow.spec.tsscripts/tests/verification-policy.spec.ts
|
@coderabbitai resolve |
✅ Action performedComments resolved and changes approved. |
Superseded by CodeRabbit approval on current head a0b965e after all actionable findings were addressed.
Outcome
CI now classifies the verification profile before the blocking validation job, runs ecosystem advisory smoke and API documentation drift checks independently of the blocking profile, and limits the Windows scaffold lane to relevant pull-request changes while retaining it for trunk and manual runs.
Turbo task state is restored across CI, benchmark, release, and PR review workflows with immutable, job-scoped cache keys. The Windows scaffold build no longer forces cache misses. Blocking verification, security scans, evidence uploads, and release verification remain intact.
Verification
pnpm verify:repo— 22/23 applicable repository gates passed; one was not applicableReview gates
Residual risk
The first hosted run is expected to be cold. Runtime improvement and cache hit rates should be evaluated over several subsequent CI runs; the verification manifest itself remains serial because its tracked-file guards and evidence artifacts share mutable workspace state.
Summary by CodeRabbit