ci: stop recurring Release + security workflow failures on main#47
Conversation
Two workflows have been failing on every push to main since #34 landed. security.yml — startup_failure The fix in #34 replaced `secrets: inherit` with an explicit `SEMGREP_APP_TOKEN: ${{ ... }}` mapping to address zizmor's `secrets-inherit` warning. The upstream reusable workflow at `resq-software/.github/.github/workflows/security-scan.yml` does not declare a `workflow_call.secrets:` contract, and GitHub Actions rejects callers that try to pass named secrets to a workflow with no declared secrets surface — the run terminates as `startup_failure` before any job starts. Revert to `secrets: inherit` and pin the rationale in a comment. Add `.github/zizmor.yml` to ignore the `secrets-inherit` finding on `security.yml` only, with a TODO pointing to the upstream workflow update needed to make explicit secret passing valid again. publish.yml — `Release` failure `python-semantic-release` pushes the version-bump commit + tag back to main directly. The `default-branch-baseline` ruleset (id 15191038) requires every change to main to come through a PR; bypass mode is `pull_request`, so even bypass actors cannot push directly. The bot's push is rejected with remote: error: GH013: Repository rule violations found remote: - Changes must be made through a pull request. remote: - Required status check "required" is expected. Drop the `push: branches: [main]` trigger so the workflow no longer fires on every commit. `workflow_dispatch` remains, so releases can still be cut manually from the Actions tab or with `gh workflow run Release.yml`. Long-term, restore automation by either adding a bot to ruleset bypass with `bypass_mode: always` or restructuring to a PR-based release flow (semantic-release with `commit: false, push: false` + `peter-evans/create-pull- request`). The workflow file's header comment captures both paths.
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a zizmor configuration file to manage GitHub Actions security linting, specifically ignoring secrets-inherit for the security workflow. Feedback suggests moving the configuration file to the repository root for automatic discovery and updating the ignore pattern to use the full relative path for security.yml to ensure the rule is correctly applied.
1 participant
Summary
Two workflows have been failing on every push to
mainsince #34 landed. Both are structural issues, not regressions in product code. This PR stops the noise and documents the path back to automation.securityworkflow —startup_failureThe fix in #34 replaced
secrets: inheritwith an explicitSEMGREP_APP_TOKENmapping to clear zizmor'ssecrets-inheritwarning (#43). But the upstream reusable workflow atresq-software/.github/.github/workflows/security-scan.ymldoes not declare aworkflow_call.secrets:contract, and GitHub Actions rejects any caller that tries to pass named secrets to a workflow with no declared secrets surface — the run terminates asstartup_failurebefore any job starts. That's why the security scan hasn't run onmainsince #34 merged, which is also why zizmor alerts #29-#43 haven't auto-closed even though the underlying findings are gone.Fix:
secrets: inheritwith a comment explaining why..github/zizmor.ymlignoring thesecrets-inheritrule only onsecurity.yml, pointing at the upstream limitation. As soon as the upstream workflow declares its secrets, drop the ignore and switch back to explicitSEMGREP_APP_TOKEN.Releaseworkflow —failurepython-semantic-releasepushes the version-bump commit + tag straight tomain. Thedefault-branch-baselineruleset (id 15191038) requires every change tomainto come through a PR; bypass mode ispull_request, so even bypass actors must use a PR. The bot's push is rejected withGH013: Repository rule violations.Fix:
push: branches: [main]trigger so the workflow stops auto-running on every commit.workflow_dispatchremains.publish.ymldocuments the two long-term paths back to automation:resq-swPAT tobypass_actorson ruleset 15191038 withbypass_mode: always.semantic-releasewithcommit: false, push: false+peter-evans/create-pull-request).Validation
The 1 remaining
high(cache-poisoninginapi-docs.yml:99) is unrelated to recurring-CI failures and tracked separately in #48.Expected behavior after merge
securityworkflow runs successfully on the next push tomain. Zizmor alerts chore(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 in the github-actions group #29-ci: add docstring coverage gate via interrogate #42 auto-close on that run. Alert ci(api-docs): sync workflow from resq-software/docs #43 stays closed because the SARIF report no longer contains it (suppressed via.github/zizmor.yml).Releaseworkflow stops appearing in the failures list. Releases are cut manually viagh workflow run Release.ymluntil one of the two restoration paths lands.