fix: validate operational endpoints for CI - #833
Merged
Conversation
|
Warning Review limit reached
More reviews will be available in 11 minutes and 27 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (31)
📝 WalkthroughWalkthrough
Changesops check 커맨드, diagnostics provider 주입, ops-smoke 템플릿
Sequence Diagram(s)sequenceDiagram
rect rgba(173, 216, 230, 0.5)
note over ops-smoke.ts: 토큰 가드 검증
ops-smoke.ts->>createCrocoApp: 앱 기동 (CROCO_DIAGNOSTICS_EXPOSURE=token)
ops-smoke.ts->>api-server /diagnostics: 인증 없는 요청
api-server /diagnostics-->>ops-smoke.ts: 403 Forbidden
end
rect rgba(144, 238, 144, 0.5)
note over ops-smoke.ts: ops check 계약 검증
ops-smoke.ts->>runOpsCheck: target, token, fetch
runOpsCheck->>api-server: /health, /ready, /diagnostics 병렬 호출
api-server-->>runOpsCheck: OpsEndpointSnapshot[] (httpStatus, required)
runOpsCheck->>runOpsCheck: summarizeOpsStatus (healthy/unhealthy)
runOpsCheck-->>ops-smoke.ts: OpsStatusReport
ops-smoke.ts->>ops-smoke.ts: summary != healthy → exit 1
ops-smoke.ts->>ops-smoke.ts: healthy → JSON 출력
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Benchmark Results❌ Some benchmarks failed Gate failures
Updated: 2026-06-17T14:05:16.836Z · Commit: 52ae185 |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/troubleshooting/diagnostics.md`:
- Line 91: The redaction key list in the diagnostics.md documentation at line 91
is incomplete and does not match the actual SENSITIVE_KEY_PATTERN implementation
in the code. Update the `details` redaction description to include all patterns:
add `access[-_]?key` (covering accessKey, access_key, access-key variants),
`dsn`, and replace the vague "env URL 계열" reference with specific URL pattern
variants like `database[-_]?url`, `redis[-_]?url`, `mongo[-_]?url`, and
`postgres[-_]?url` to accurately reflect all keys that are actually redacted by
the code's pattern matching logic.
- Around line 54-62: The response contract documentation for the `/ready` and
`/health/ready` endpoints in the table contains an incorrect type annotation.
The `results` field is documented as `HealthCheckResult[]` but according to the
implementation in HealthCheckService.ts, it should be `HealthIndicatorResult[]`.
Update both rows for the `/ready` and `/health/ready` endpoints in the table to
correct the response contract by replacing `HealthCheckResult[]` with
`HealthIndicatorResult[]` in the response contract column.
In
`@packages/create-croco-app/templates/saas/apps/api-server/src/demo/ops-smoke.ts`:
- Around line 15-17: The error being thrown in the diagnostics status validation
check uses a generic Error class instead of an RFC 7807 Problem subclass.
Replace the generic Error instantiation in the throw statement (where checking
deniedDiagnostics.status) with an appropriate Problem-based error subclass to
maintain consistency with the project's error handling guidelines. Ensure the
error message describing the unexpected status code is preserved in the Problem
instance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: dfdb7e77-15a0-4c73-a937-fc842191c08c
📒 Files selected for processing (17)
.changeset/ops-check-contract.mddocs/troubleshooting/diagnostics.mdpackages/cli/README.mdpackages/cli/src/commands/ops.tspackages/cli/src/index.tspackages/cli/src/tests/opsStatus.spec.tspackages/create-croco-app/src/helpers/croco-ranges.tspackages/create-croco-app/src/tests/e2e-generation.spec.tspackages/create-croco-app/src/tests/templates-build.spec.tspackages/create-croco-app/templates/saas/README.md.hbspackages/create-croco-app/templates/saas/apps/api-server/package.json.hbspackages/create-croco-app/templates/saas/apps/api-server/src/demo/ops-smoke.tspackages/create-croco-app/templates/saas/package.json.hbspackages/docs/src/content/docs/api/transports-http/src/type-aliases/DiagnosticsEndpointOptions.mdpackages/transports-http/src/libs/CrocoApp.tspackages/transports-http/src/libs/operationalEndpoints.tspackages/transports-http/src/tests/OperationalEndpoints.spec.ts
kang-heewon
force-pushed
the
issue-826-ops-check
branch
3 times, most recently
from
June 17, 2026 13:12
c410124 to
9f5f44e
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/cli/src/libs/ops.ts`:
- Around line 258-271: The isEndpointUnhealthy function currently treats status
and summary conditions (status === "down" or "error" or "unhealthy", or summary
=== "issues_detected") as unhealthy regardless of whether the endpoint is
required or optional. This causes optional endpoints with these status
conditions to incorrectly escalate to unhealthy status. Refactor the logic in
isEndpointUnhealthy to only check and return unhealthy based on these status and
summary conditions when endpoint.required is true. For optional endpoints, only
return unhealthy if endpoint.ok is false and it is marked as required. This
ensures that optional endpoints with diagnostic issues do not trigger non-zero
exit status.
In `@packages/create-croco-app/templates/saas/apps/api-server/src/app.ts`:
- Around line 32-40: The rateLimitHttpMiddleware currently applies the same rate
limit policy (100 requests per 60 seconds) to all endpoints including
operational ones like /ops/health and /ops/diagnostics, which can cause
cascading failures during traffic spikes when health probes get rate-limited.
Modify the rateLimitHttpMiddleware configuration to either exclude these
operational endpoints from rate limiting entirely or apply a separate, more
lenient policy to them. Check the rateLimitHttpMiddleware function signature and
options to see if it supports path-based exclusion or different policies per
path, then update the middleware configuration to handle /ops/health and
/ops/diagnostics separately from the global API rate limit policy.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: ed6d7ad3-3e18-4e86-af96-9c409e49f1fb
📒 Files selected for processing (27)
.changeset/ops-check-contract.mddocs/troubleshooting/diagnostics.mdpackages/cli/README.mdpackages/cli/package.jsonpackages/cli/src/commands/ops.tspackages/cli/src/index.tspackages/cli/src/libs/ops.tspackages/cli/src/ops.tspackages/cli/src/tests/opsStatus.spec.tspackages/cli/tsup.config.tspackages/create-croco-app/src/helpers/croco-ranges.tspackages/create-croco-app/src/tests/e2e-generation.spec.tspackages/create-croco-app/src/tests/templates-build.spec.tspackages/create-croco-app/templates/saas/README.md.hbspackages/create-croco-app/templates/saas/apps/api-server/package.json.hbspackages/create-croco-app/templates/saas/apps/api-server/src/app.tspackages/create-croco-app/templates/saas/apps/api-server/src/demo/ops-smoke.tspackages/create-croco-app/templates/saas/apps/api-server/src/saasDemo.tspackages/create-croco-app/templates/saas/package.json.hbspackages/docs/src/content/docs/api/transports-http/src/classes/ErrorHandler.mdpackages/docs/src/content/docs/api/transports-http/src/type-aliases/DiagnosticsEndpointOptions.mdpackages/transports-http/src/libs/CrocoApp.tspackages/transports-http/src/libs/ErrorHandler.tspackages/transports-http/src/libs/operationalEndpoints.tspackages/transports-http/src/tests/CrocoApp.spec.tspackages/transports-http/src/tests/OperationalEndpoints.spec.tsscripts/create-croco-app-generated-smoke.mts
kang-heewon
force-pushed
the
issue-826-ops-check
branch
from
June 17, 2026 13:39
9f5f44e to
a7c53ca
Compare
kang-heewon
force-pushed
the
issue-826-ops-check
branch
from
June 17, 2026 14:00
a7c53ca to
5d8246d
Compare
Member
Author
|
CI/review follow-up:
Remaining blocker: the CodeRabbit status check is failing with "Prepaid credits exhausted — enable the review add-on", and the latest CodeRabbit review still leaves the PR review decision as CHANGES_REQUESTED, so GitHub reports mergeStateStatus=BLOCKED. |
kang-heewon
dismissed stale reviews from coderabbitai[bot] and coderabbitai[bot]
June 17, 2026 16:14
All CodeRabbit review threads have been addressed and resolved. CodeRabbit cannot refresh because its status reports prepaid credits exhausted; required branch checks validate and docs-sync-check are passing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #826.
Summary
@croco/cliexposescroco ops check <url>as a CI-oriented operational contract for health, readiness, and token-protected diagnostics, with optional metrics probing and stable JSON output.The HTTP operations surface supports app-provided diagnostics providers without dropping the default runtime/container/event providers, and redaction covers nested provider/env-like secret keys such as access keys, database URLs, DSNs, connection strings, and webhook secrets.
The generated SaaS preset includes an
ops:smokepath that proves diagnostics remain guarded without a token and that the operational endpoints pass through the CLI check. The generated-app smoke now installs local packed Croco packages for the affected unpublished workspace ranges, so CI validates the PR code instead of falling back to npm-published versions.Verification
git diff --check- passed.pnpm check- passed.pnpm test --filter=@croco/cli- passed.pnpm test --filter=@croco/transports-http- passed.pnpm test --filter=@croco/diagnostics-core- passed.pnpm test --filter=create-croco-app- passed.pnpm typecheck --filter=@croco/cli --filter=@croco/transports-http --filter=create-croco-app- passed.pnpm create-croco-app:smoke- passed; the SaaS generated app returned healthyhealth,ready, anddiagnosticsendpoint results throughops:smoke.pnpm test199/199 tasks and fullpnpm typecheck198/198 tasks.Self-review gates
@croco/cli/opsis a dedicated subpath export for the pure ops check API, avoiding command-module side effects for generated runtime smoke code. Diagnostics remain token-protected by policy, the smoke first verifies unauthenticated diagnostics is forbidden, and the existing changeset covers the affected packages. The added SaaS template dependency is the existing internal@croco/ratelimit-corepackage needed by the transport security validation path.Risk
Low.
ops statuskeeps its existing health/ready behavior and metrics default, whileops checkis the stricter CI surface that requires diagnostics by default. The generated-app path is covered by both template assertions and a full generated workspace smoke run.Summary by CodeRabbit
릴리스 노트
New Features
ops check명령으로 운영 엔드포인트 계약 검증 지원 추가/metrics엔드포인트 추가Documentation