Fix Depot governance runs (packages token) - #77
Conversation
…epot only) Depot has no automatic GITHUB_TOKEN; the enforcer install E403d on @wave-av/governance on every Depot run. Mirrors webhook-edge#50.
🤖 CodeAnt AI — Review Status
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the Depot governance workflow to authenticate enforcer package installation with the imported GH_PACKAGES_TOKEN, addressing Depot’s lack of an automatic GITHUB_TOKEN while preserving step-level token scoping. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (9)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe governance workflow now uses ChangesPackage Authentication
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The Depot governance installation now uses the intended package token without introducing a repository-level merge risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
codeant-ai
Bot
added
the
size:XS
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. This changes which credential is placed in the environment for the governance step, so a wrong scope or an untrusted downloaded package could expose the packages token and grant unintended repository-package access. Reverting stops future use, but any token exposure or access performed before the revert would require token rotation and separate cleanup.
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| # Depot has no automatic GITHUB_TOKEN: use the imported packages token. | ||
| NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }} |
There was a problem hiding this comment.
💡 Edge Case: GH_PACKAGES_TOKEN must exist as a secret imported into Depot
This is the only reference to GH_PACKAGES_TOKEN anywhere in the repo, and Depot secret configuration lives outside this checkout (in Depot's project settings), so it can't be verified from the repo whether this secret is actually imported there. If it isn't configured, the step will still fail (empty token in .npmrc), reproducing the same E403 this PR is meant to fix — worth a quick confirmation in Depot's dashboard before merging, or a note in the PR description confirming it's already set up.
Was this helpful? React with 👍 / 👎
|
Note Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom. Code Review 👍 Approved with suggestions 0 closed / 1 findingsSets 💡 Edge Case: GH_PACKAGES_TOKEN must exist as a secret imported into Depot📄 .depot/workflows/governance-enforce.yml:59 This is the only reference to 🤖 Prompt for agentsReview coverageRules No rules evaluated OptionsDisplay: compact → Counting what did not apply, without listing it. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| # Depot has no automatic GITHUB_TOKEN: use the imported packages token. | ||
| NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }} |
There was a problem hiding this comment.
Suggestion: Fork pull request workflows do not receive repository secrets, so GH_PACKAGES_TOKEN is empty and the private package install fails before governance enforcement runs. [api mismatch]
Assessment: 🟠 Major · 🔁 Occurrence: Sometimes
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** .depot/workflows/governance-enforce.yml
**Line:** 59:59
**Comment:**
*Api Mismatch: Fork pull request workflows do not receive repository secrets, so `GH_PACKAGES_TOKEN` is empty and the private package install fails before governance enforcement runs.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This is a small Depot-only CI credential change with no application runtime impact, but its success depends on an externally configured secret whose availability for fork pull requests is unresolved. That dependency could leave governance enforcement failing in the exact scenario the PR intends to fix. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
1 participant
User description
Same class as webhook-edge#50: Depot lacks automatic GITHUB_TOKEN, so the enforcer install E403d. Points .depot copy at imported GH_PACKAGES_TOKEN. .github untouched.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Note
Low Risk
Depot-only CI credential wiring for private package install; no application or governance logic changes.
Overview
Depot runs of governance-enforce were failing when installing
@wave-av/governancefrom GitHub Packages (E403) because Depot does not inject an automaticGITHUB_TOKENlike GitHub Actions.The
.depot/workflows/governance-enforce.ymlcopy now setsNODE_AUTH_TOKENtosecrets.GH_PACKAGES_TOKENfor the isolated npm install step, with a comment documenting why. The.githubworkflow is unchanged.Reviewed by Cursor Bugbot for commit 4f8e6db. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by Sourcery
Bug Fixes:
CodeAnt-AI Description
Restore successful governance checks on Depot runners
What Changed
Impact
✅ Fewer failed Depot governance runs✅ Reliable access to private governance packages💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.