Skip to content

feat: assert that every target repository will actually start a review - #21

Merged
MarketDataApp merged 9 commits into
mainfrom
ci/assert-callers-will-activate
Sep 22, 2026
Merged

MarketDataApp merged 9 commits into
mainfrom
ci/assert-callers-will-activate

fix: the user-account audit silently skipped ref validation entirely

b192a8a
Select commit
Loading
Failed to load commit list.
marketdata-code-review / Code review failed Sep 22, 2026 in 0s

⛔ Blocked

This change adds a CLI and scheduled workflow that audit whether configured repositories can trigger code reviews, with API-backed state checks and extensive tests. The pinned-ref validation only proves that review.yml exists, so the audit can still report success for an unusable reusable workflow.

Annotations

Check failure on line 794 in reviewbot/cli.py

See this annotation in the file changed.

@marketdata-code-review marketdata-code-review / Code review

Validate pinned workflows are reusable

The resolver reduces the pinned file to a boolean, so a ref containing `review.yml` without `on: workflow_call` is accepted even though GitHub cannot invoke it. Fetch and parse the pinned content and reject invalid or non-reusable workflows, as the local-call path already does.

Check notice on line 18 in .github/workflows/audit-callers.yml

See this annotation in the file changed.

@marketdata-code-review marketdata-code-review / Code review

Remove dated incident narrative

The new production comments and module docstring repeat dated incident history that belongs in the pull request or commit message. Keep the durable constraint in code and remove the date and historical narrative.