[PR #438] ci(coderabbit-config): refresh the vendored CodeRabbit schema #436

New issue

Open

opened 2026-10-26 22:39:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:39:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/438
Author: @cloud-code-bot[bot]
Created: 10/19/2026
Status: 🔄 Open

Base: main ← Head: ci/refresh-coderabbit-schema

📝 Commits (2)

4ea2b54 ci(coderabbit-config): refresh the vendored CodeRabbit schema
0f058de fix(coderabbit-config): keep a rejecting error the pre-rank islice would drop

📊 Changes

4 files changed (+238 additions, -56 deletions)

View changed files

📝 .github/coderabbit-config/README.md (+6 -5)
📝 .github/coderabbit-config/check_coderabbit_config.py (+55 -9)
📝 .github/coderabbit-config/schema.v2.json (+109 -30)
📝 .github/coderabbit-config/tests/test_check_coderabbit_config.py (+68 -12)

📄 Description

ELI5

This updates our copy of CodeRabbit's settings rulebook to the latest version, which adds new auto-approval settings. The new rules opened a loophole: a config stuffed with many repeated entries could hide a real, file-breaking mistake, so the check would pass a config CodeRabbit refuses to load. This PR also closes that loophole.

Upstream's CodeRabbit config schema has drifted from the copy vendored here, which is what coderabbit-config-validate.yml grades every enrolled repo against.

Added properties (12):

reviews.auto_approvals
reviews.auto_approvals.allow_author_approval
reviews.auto_approvals.enabled
reviews.auto_approvals.max_merge_risk
reviews.auto_approvals.max_security_risk
reviews.auto_approvals.overrides
reviews.auto_approvals.overrides[].enabled
reviews.auto_approvals.overrides[].max_merge_risk
reviews.auto_approvals.overrides[].max_security_risk
reviews.auto_approvals.overrides[].paths
reviews.auto_approvals.overrides[].teams
reviews.review_info

Before merging, check the tightened-cap section above if there is one: a lowered maxLength retroactively invalidates configs nobody has touched, and merging this makes their next PR red. Landing the cleanup alongside is usually the right order.

Note

The invariant unit suite failed against this schema, and the checker has been adapted in this PR. The new reviews.auto_approvals.overrides is an array of closed objects with no maxItems. That broke the premise the suite pinned: the checker's pre-rank islice over iter_errors is FIFO in schema order, so ~150 overrides each carrying an unknown key could push a file-rejecting maxLength error out of the slice. The result was 100 warnings and exit 0 on a config CodeRabbit rejects whole. This was reproduced against the refreshed schema. Now, when the cap is hit, the checker re-collects rejecting errors from a second, equally bounded pass over a copy of the schema that has the strip-only additionalProperties: false removed (outside combinators). The census moved on purpose: explicit went 5 → 7, and both new objects are closed with additionalProperties: false, which is now asserted per member, so no new opener keyword was added. overrides is named as the one array exempt from the maxItems-before-items fact, and every other array still has to satisfy it. The README and checker comments now give the schema's current object counts (seven explicitly closed, 105 by omission).

Merging this touches .github/coderabbit-config/**, which triggers bump-coderabbit-config-callers.yml and rolls the SHA-pinned caller fleet forward.

Opened by the refresh-coderabbit-schema workflow.

Provenance

Verified:

unittest suite for .github/coderabbit-config (pinned requirements, --require-hashes): 101 tests pass at the current head.
New regression test fails with the second pass disabled and passes with it enabled.
CLI end-to-end: 150 overrides with unknown keys plus an over-long path_instructions entry now exit 1; before the fix this exited 0.
check_workflow_pins.py, check_agents_md.py --root . and check-org-repo-literals.sh all exit 0.

Deviations:

Beyond the automated schema refresh, this PR now also changes check_coderabbit_config.py (the rejecting-only second pass), its tests, and README counts.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/438 **Author:** [@cloud-code-bot[bot]](https://github.com/apps/cloud-code-bot) **Created:** 10/19/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `ci/refresh-coderabbit-schema` --- ### 📝 Commits (2) - [`4ea2b54`](https://github.com/Comfy-Org/github-workflows/commit/4ea2b54fe5b7d1bac8d18981f93e4b79dfcb77c9) ci(coderabbit-config): refresh the vendored CodeRabbit schema - [`0f058de`](https://github.com/Comfy-Org/github-workflows/commit/0f058de6b29fc5d7bcf7ee86269f7854f179f26d) fix(coderabbit-config): keep a rejecting error the pre-rank islice would drop ### 📊 Changes **4 files changed** (+238 additions, -56 deletions) <details> <summary>View changed files</summary> 📝 `.github/coderabbit-config/README.md` (+6 -5) 📝 `.github/coderabbit-config/check_coderabbit_config.py` (+55 -9) 📝 `.github/coderabbit-config/schema.v2.json` (+109 -30) 📝 `.github/coderabbit-config/tests/test_check_coderabbit_config.py` (+68 -12) </details> ### 📄 Description ## ELI5 This updates our copy of CodeRabbit's settings rulebook to the latest version, which adds new auto-approval settings. The new rules opened a loophole: a config stuffed with many repeated entries could hide a real, file-breaking mistake, so the check would pass a config CodeRabbit refuses to load. This PR also closes that loophole. Upstream's CodeRabbit config schema has drifted from the copy vendored here, which is what `coderabbit-config-validate.yml` grades every enrolled repo against. **Added properties** (12): - `reviews.auto_approvals` - `reviews.auto_approvals.allow_author_approval` - `reviews.auto_approvals.enabled` - `reviews.auto_approvals.max_merge_risk` - `reviews.auto_approvals.max_security_risk` - `reviews.auto_approvals.overrides` - `reviews.auto_approvals.overrides[].enabled` - `reviews.auto_approvals.overrides[].max_merge_risk` - `reviews.auto_approvals.overrides[].max_security_risk` - `reviews.auto_approvals.overrides[].paths` - `reviews.auto_approvals.overrides[].teams` - `reviews.review_info` **Before merging**, check the tightened-cap section above if there is one: a lowered `maxLength` retroactively invalidates configs nobody has touched, and merging this makes their next PR red. Landing the cleanup alongside is usually the right order. > [!NOTE] > **The invariant unit suite failed against this schema, and the checker has been adapted in this PR.** The new `reviews.auto_approvals.overrides` is an array of closed objects with no `maxItems`. That broke the premise the suite pinned: the checker's pre-rank `islice` over `iter_errors` is FIFO in schema order, so ~150 overrides each carrying an unknown key could push a file-rejecting `maxLength` error out of the slice. The result was 100 warnings and exit 0 on a config CodeRabbit rejects whole. This was reproduced against the refreshed schema. Now, when the cap is hit, the checker re-collects rejecting errors from a second, equally bounded pass over a copy of the schema that has the strip-only `additionalProperties: false` removed (outside combinators). The census moved on purpose: `explicit` went 5 → 7, and both new objects are closed with `additionalProperties: false`, which is now asserted per member, so no new opener keyword was added. `overrides` is named as the one array exempt from the maxItems-before-items fact, and every other array still has to satisfy it. The README and checker comments now give the schema's current object counts (seven explicitly closed, 105 by omission). Merging this touches `.github/coderabbit-config/**`, which triggers `bump-coderabbit-config-callers.yml` and rolls the SHA-pinned caller fleet forward. _Opened by the `refresh-coderabbit-schema` workflow._ ## Provenance **Verified:** - `unittest` suite for `.github/coderabbit-config` (pinned requirements, `--require-hashes`): 101 tests pass at the current head. - New regression test fails with the second pass disabled and passes with it enabled. - CLI end-to-end: 150 `overrides` with unknown keys plus an over-long `path_instructions` entry now exit 1; before the fix this exited 0. - `check_workflow_pins.py`, `check_agents_md.py --root .` and `check-org-repo-literals.sh` all exit 0. **Deviations:** - Beyond the automated schema refresh, this PR now also changes `check_coderabbit_config.py` (the rejecting-only second pass), its tests, and README counts. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 22:39:49 +00:00

bsakaguchi referenced this issue

2026-10-26 22:39:50 +00:00

[PR #436] ci(cursor-review): bump Cursor CLI pin to 2026.10.16-e3cb207 #438