[ci:fix] Resolved issues with changelog bot for fork PRs#632
Merged
nemesifier merged 5 commits intoopenwisp:masterfrom Mar 25, 2026
Merged
[ci:fix] Resolved issues with changelog bot for fork PRs#632nemesifier merged 5 commits intoopenwisp:masterfrom
nemesifier merged 5 commits intoopenwisp:masterfrom
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
🧰 Additional context used🧠 Learnings (6)📓 Common learnings📚 Learning: 2026-03-05T14:23:55.528ZApplied to files:
📚 Learning: 2026-03-24T16:40:15.783ZApplied to files:
📚 Learning: 2026-03-05T09:38:10.320ZApplied to files:
📚 Learning: 2026-02-10T20:38:27.593ZApplied to files:
📚 Learning: 2026-03-05T09:59:22.581ZApplied to files:
🔇 Additional comments (5)
📝 WalkthroughWalkthroughThe PR refactors the changelog bot into a two-workflow, fork-safe pattern: a trigger workflow (.github/workflows/bot-changelog-trigger.yml) that runs on submitted PR reviews, enforces approval and reviewer association, checks PR title for a leading Sequence Diagram(s)sequenceDiagram
actor Reviewer
participant GitHub as GitHub
participant TriggerWF as Trigger Workflow<br/>(bot-changelog-trigger.yml)
participant Artifact as Artifact Storage
participant RunnerWF as Runner Workflow<br/>(bot-changelog-runner.yml)
participant ReusableWF as Reusable Workflow<br/>(reusable-bot-changelog.yml)
participant API as GitHub API
Reviewer ->> GitHub: Submit PR review (approved)
GitHub ->> TriggerWF: Trigger (pull_request_review event)
TriggerWF ->> TriggerWF: Check reviewer association<br/>and parse PR title
alt Title matches & approved
TriggerWF ->> Artifact: Upload pr_number artifact<br/>(changelog-metadata)
end
GitHub ->> RunnerWF: Trigger (workflow_run event) on TriggerWF success
RunnerWF ->> Artifact: Download changelog-metadata
RunnerWF ->> RunnerWF: Validate pr_number is numeric
alt pr_number valid & non-empty
RunnerWF ->> ReusableWF: Invoke with pr_number input + secrets
ReusableWF ->> API: Fetch PR, generate changelog
ReusableWF ->> API: Update PR with changelog
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
coderabbitai
Bot
added
enhancement
github_actions
Contributor
Author
|
@coderabbitai please review |
|
🧠 Learnings used✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
nemesifier
changed the title
nemesifier
changed the title
github-project-automation
Bot
moved this to To do (general)
in OpenWISP Contributor's Board
github-project-automation
Bot
moved this from To do (general)
to In progress
in OpenWISP Contributor's Board
nemesifier
requested changes
Mar 24, 2026
Member
nemesifier
left a comment
nemesifier
left a comment
There was a problem hiding this comment.
Good progress! The workflow_run split is the right approach, the PR number validation is solid, and the create-github-app-token@v2 upgrade aligns with the rest of the bots.
A few things to address before this is ready:
-
Rename
bot-changelog.ymltobot-changelog-trigger.ymlandbot-changelog-run.ymltobot-changelog-runner.yml. The current names do not make the relationship or the trust boundary between the two workflows clear. Theworkflow_runlistener name reference insidebot-changelog-runner.yml, the docs code blocks, and the.. note::callout all need to be updated accordingly. -
The docs are missing a note that
bot-changelog-runner.ymlmust exist on the default branch to be picked up at all. Theworkflow_runlistener is only active when the file lives on the default branch: a contributor adding it only to a feature branch will see it silently do nothing and have no obvious way to debug why.
To speed things up I will push commits addressing these points directly. Please review them and make any adjustments you think are needed.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/developer/reusable-github-utils.rst`:
- Around line 471-475: Replace the phrase "two-step `workflow_run` pattern" with
clearer wording such as "two-workflow pattern" and explicitly mention that the
first workflow is triggered by `pull_request_review` while the second executes
via `workflow_run`, so readers understand the first step is not a `workflow_run`
invocation; update the sentence containing the `workflow_run` and
`pull_request_review` terms to reflect this precise flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c1860b1b-ea72-4618-babe-e4c66ee1be57
📒 Files selected for processing (3)
.github/workflows/bot-changelog-runner.yml.github/workflows/bot-changelog-trigger.ymldocs/developer/reusable-github-utils.rst
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.13 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.10 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.0.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=5.0.0
- GitHub Check: Python==3.10 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=5.0.0
🧰 Additional context used
🧠 Learnings (5)
📓 Common learnings
Learnt from: nemesifier
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:22-24
Timestamp: 2026-03-05T14:23:55.528Z
Learning: In `.github/workflows/reusable-bot-changelog.yml`, the maintainer (nemesifier) has explicitly decided that `github.event.review.author_association == 'COLLABORATOR'` should be allowed (alongside `OWNER` and `MEMBER`) to trigger the changelog bot workflow. The rationale is that the workflow is non-destructive and only posts a PR comment — it cannot make code changes. Do not flag `COLLABORATOR` as a security issue for this workflow.
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:49-49
Timestamp: 2026-03-05T09:38:10.320Z
Learning: In openwisp-utils, PR title prefixes are strictly limited to `[feature]`, `[fix]`, and `[change]` (exact bracketed tags, no scoping/sub-types). The regex `^\[(feature|fix|change)\]` in `.github/workflows/reusable-bot-changelog.yml` is intentional and correct — scoped variants like `[feature/bots]` are not valid and should not be matched.
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/actions/bot-changelog-generator/generate_changelog.py:356-364
Timestamp: 2026-03-05T09:59:22.581Z
Learning: In `.github/actions/bot-changelog-generator/generate_changelog.py`, the `validate_changelog_output` function's purpose is to act as an output safety filter — ensuring no sensitive information or arbitrary LLM-generated text gets posted as a PR comment. It checks that the output starts with a valid tag ([feature]/[fix]/[change]) and contains a correctly structured PR reference pattern. It is NOT intended to strictly validate that the referenced PR number/URL matches the current PR.
Learnt from: stktyagi
Repo: openwisp/openwisp-utils PR: 631
File: .github/workflows/bot-ci-failure.yml:71-74
Timestamp: 2026-03-24T16:40:15.783Z
Learning: In openwisp/openwisp-utils reusable-bot-ci-failure.yml, the auto-retry step uses a custom GitHub App token (generated from APP_ID and PRIVATE_KEY secrets) passed to the gh CLI via the GH_TOKEN environment variable. This token is NOT subject to the workflow's `permissions` block (which only restricts GITHUB_TOKEN). Therefore, having `actions: read` in the reusable workflow's permissions block does NOT break the auto-retry `gh api -X POST` call — it authenticates with the App's own permissions. Do not flag this as a permissions issue.
📚 Learning: 2026-03-05T14:23:55.528Z
Learnt from: nemesifier
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:22-24
Timestamp: 2026-03-05T14:23:55.528Z
Learning: In `.github/workflows/reusable-bot-changelog.yml`, the maintainer (nemesifier) has explicitly decided that `github.event.review.author_association == 'COLLABORATOR'` should be allowed (alongside `OWNER` and `MEMBER`) to trigger the changelog bot workflow. The rationale is that the workflow is non-destructive and only posts a PR comment — it cannot make code changes. Do not flag `COLLABORATOR` as a security issue for this workflow.
Applied to files:
.github/workflows/bot-changelog-trigger.ymldocs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-runner.yml
📚 Learning: 2026-03-05T09:38:10.320Z
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:49-49
Timestamp: 2026-03-05T09:38:10.320Z
Learning: In openwisp-utils, PR title prefixes are strictly limited to `[feature]`, `[fix]`, and `[change]` (exact bracketed tags, no scoping/sub-types). The regex `^\[(feature|fix|change)\]` in `.github/workflows/reusable-bot-changelog.yml` is intentional and correct — scoped variants like `[feature/bots]` are not valid and should not be matched.
Applied to files:
.github/workflows/bot-changelog-trigger.ymldocs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-runner.yml
📚 Learning: 2026-03-05T09:59:22.581Z
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/actions/bot-changelog-generator/generate_changelog.py:356-364
Timestamp: 2026-03-05T09:59:22.581Z
Learning: In `.github/actions/bot-changelog-generator/generate_changelog.py`, the `validate_changelog_output` function's purpose is to act as an output safety filter — ensuring no sensitive information or arbitrary LLM-generated text gets posted as a PR comment. It checks that the output starts with a valid tag ([feature]/[fix]/[change]) and contains a correctly structured PR reference pattern. It is NOT intended to strictly validate that the referenced PR number/URL matches the current PR.
Applied to files:
.github/workflows/bot-changelog-trigger.yml.github/workflows/bot-changelog-runner.yml
📚 Learning: 2026-03-24T16:40:15.783Z
Learnt from: stktyagi
Repo: openwisp/openwisp-utils PR: 631
File: .github/workflows/bot-ci-failure.yml:71-74
Timestamp: 2026-03-24T16:40:15.783Z
Learning: In openwisp/openwisp-utils reusable-bot-ci-failure.yml, the auto-retry step uses a custom GitHub App token (generated from APP_ID and PRIVATE_KEY secrets) passed to the gh CLI via the GH_TOKEN environment variable. This token is NOT subject to the workflow's `permissions` block (which only restricts GITHUB_TOKEN). Therefore, having `actions: read` in the reusable workflow's permissions block does NOT break the auto-retry `gh api -X POST` call — it authenticates with the App's own permissions. Do not flag this as a permissions issue.
Applied to files:
docs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-runner.yml
🔇 Additional comments (2)
.github/workflows/bot-changelog-trigger.yml (1)
1-34: Good split: trigger stays secret-free and deterministic.This workflow correctly gates on approved maintainer reviews, enforces the intended title prefix check, and passes only PR metadata via artifact for the runner.
Based on learnings:
COLLABORATORis intentionally allowed for this non-destructive bot workflow, and the^\[(feature|fix|change)\]prefix check is intentionally strict..github/workflows/bot-changelog-runner.yml (1)
1-51: Runner workflow wiring looks solid.
workflow_runfiltering, artifact retrieval byrun-id, numericpr_numbervalidation, and downstream reusable workflow invocation are all correctly connected.
Addressed review comments
nemesifier
force-pushed
the
fix/bot-changelog
branch
from
ed763cb to
6e9f200
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/bot-changelog-trigger.yml:
- Around line 25-27: In the "Save PR metadata" workflow step, stop interpolating
`${{ github.event.pull_request.number }}` directly in the run command and
instead expose the PR number as an environment variable (following the same
pattern used for PR_TITLE) and then echo that env var in the run step; update
the step named "Save PR metadata" so its environment contains the PR number and
change the run to write the environment variable (e.g., PR_NUMBER) into the
pr_number file.
In `@docs/developer/reusable-github-utils.rst`:
- Line 523: The run step that writes the PR number to the pr_number file uses
direct interpolation of ${{ github.event.pull_request.number }} which could lead
to shell injection; instead set an environment variable (e.g., PR_NUMBER) from
github.event.pull_request.number in the job/step env and then echo the variable
quoted into the file (echo "$PR_NUMBER" > pr_number) so the value is treated as
data, not parsed by the shell; update the step that creates pr_number to use the
env variable and a quoted echo.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a528ecfa-30d1-44f1-954c-4bf8f72a865b
📒 Files selected for processing (3)
.github/workflows/bot-changelog-runner.yml.github/workflows/bot-changelog-trigger.ymldocs/developer/reusable-github-utils.rst
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=5.0.0
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=4.2.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.13 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=5.0.0
- GitHub Check: Python==3.11 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=5.0.0
🧰 Additional context used
🧠 Learnings (5)
📓 Common learnings
Learnt from: nemesifier
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:22-24
Timestamp: 2026-03-05T14:23:55.528Z
Learning: In `.github/workflows/reusable-bot-changelog.yml`, the maintainer (nemesifier) has explicitly decided that `github.event.review.author_association == 'COLLABORATOR'` should be allowed (alongside `OWNER` and `MEMBER`) to trigger the changelog bot workflow. The rationale is that the workflow is non-destructive and only posts a PR comment — it cannot make code changes. Do not flag `COLLABORATOR` as a security issue for this workflow.
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:49-49
Timestamp: 2026-03-05T09:38:10.320Z
Learning: In openwisp-utils, PR title prefixes are strictly limited to `[feature]`, `[fix]`, and `[change]` (exact bracketed tags, no scoping/sub-types). The regex `^\[(feature|fix|change)\]` in `.github/workflows/reusable-bot-changelog.yml` is intentional and correct — scoped variants like `[feature/bots]` are not valid and should not be matched.
Learnt from: stktyagi
Repo: openwisp/openwisp-utils PR: 631
File: .github/workflows/bot-ci-failure.yml:71-74
Timestamp: 2026-03-24T16:40:15.783Z
Learning: In openwisp/openwisp-utils reusable-bot-ci-failure.yml, the auto-retry step uses a custom GitHub App token (generated from APP_ID and PRIVATE_KEY secrets) passed to the gh CLI via the GH_TOKEN environment variable. This token is NOT subject to the workflow's `permissions` block (which only restricts GITHUB_TOKEN). Therefore, having `actions: read` in the reusable workflow's permissions block does NOT break the auto-retry `gh api -X POST` call — it authenticates with the App's own permissions. Do not flag this as a permissions issue.
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/actions/bot-changelog-generator/generate_changelog.py:356-364
Timestamp: 2026-03-05T09:59:22.581Z
Learning: In `.github/actions/bot-changelog-generator/generate_changelog.py`, the `validate_changelog_output` function's purpose is to act as an output safety filter — ensuring no sensitive information or arbitrary LLM-generated text gets posted as a PR comment. It checks that the output starts with a valid tag ([feature]/[fix]/[change]) and contains a correctly structured PR reference pattern. It is NOT intended to strictly validate that the referenced PR number/URL matches the current PR.
📚 Learning: 2026-03-05T14:23:55.528Z
Learnt from: nemesifier
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:22-24
Timestamp: 2026-03-05T14:23:55.528Z
Learning: In `.github/workflows/reusable-bot-changelog.yml`, the maintainer (nemesifier) has explicitly decided that `github.event.review.author_association == 'COLLABORATOR'` should be allowed (alongside `OWNER` and `MEMBER`) to trigger the changelog bot workflow. The rationale is that the workflow is non-destructive and only posts a PR comment — it cannot make code changes. Do not flag `COLLABORATOR` as a security issue for this workflow.
Applied to files:
docs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-trigger.yml.github/workflows/bot-changelog-runner.yml
📚 Learning: 2026-03-05T09:38:10.320Z
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:49-49
Timestamp: 2026-03-05T09:38:10.320Z
Learning: In openwisp-utils, PR title prefixes are strictly limited to `[feature]`, `[fix]`, and `[change]` (exact bracketed tags, no scoping/sub-types). The regex `^\[(feature|fix|change)\]` in `.github/workflows/reusable-bot-changelog.yml` is intentional and correct — scoped variants like `[feature/bots]` are not valid and should not be matched.
Applied to files:
docs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-trigger.yml.github/workflows/bot-changelog-runner.yml
📚 Learning: 2026-03-24T16:40:15.783Z
Learnt from: stktyagi
Repo: openwisp/openwisp-utils PR: 631
File: .github/workflows/bot-ci-failure.yml:71-74
Timestamp: 2026-03-24T16:40:15.783Z
Learning: In openwisp/openwisp-utils reusable-bot-ci-failure.yml, the auto-retry step uses a custom GitHub App token (generated from APP_ID and PRIVATE_KEY secrets) passed to the gh CLI via the GH_TOKEN environment variable. This token is NOT subject to the workflow's `permissions` block (which only restricts GITHUB_TOKEN). Therefore, having `actions: read` in the reusable workflow's permissions block does NOT break the auto-retry `gh api -X POST` call — it authenticates with the App's own permissions. Do not flag this as a permissions issue.
Applied to files:
docs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-runner.yml
📚 Learning: 2026-03-05T09:59:22.581Z
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/actions/bot-changelog-generator/generate_changelog.py:356-364
Timestamp: 2026-03-05T09:59:22.581Z
Learning: In `.github/actions/bot-changelog-generator/generate_changelog.py`, the `validate_changelog_output` function's purpose is to act as an output safety filter — ensuring no sensitive information or arbitrary LLM-generated text gets posted as a PR comment. It checks that the output starts with a valid tag ([feature]/[fix]/[change]) and contains a correctly structured PR reference pattern. It is NOT intended to strictly validate that the referenced PR number/URL matches the current PR.
Applied to files:
docs/developer/reusable-github-utils.rst.github/workflows/bot-changelog-trigger.yml.github/workflows/bot-changelog-runner.yml
🔇 Additional comments (8)
docs/developer/reusable-github-utils.rst (2)
471-476: Wording has been corrected.The documentation now correctly describes this as a "two-workflow pattern" with the first workflow triggered by
pull_request_reviewand the second executing viaworkflow_run. This is accurate and addresses the prior feedback.
591-602: Excellent documentation of critical coupling requirements.These notes about the strict
namecoupling between trigger and runner workflows, and the requirement for both files to exist on the default branch, are essential for users setting this up. This will prevent common pitfalls when adopting the two-workflow pattern..github/workflows/bot-changelog-trigger.yml (2)
1-14: Workflow structure correctly implements the fork-safe trigger pattern.The workflow correctly:
- Triggers on
pull_request_review: submittedwhich doesn't require secrets- Gates on
approvedstate with allowed author associations (OWNER, MEMBER, COLLABORATOR)- Has no
permissionsblock, which is appropriate since this workflow doesn't need elevated permissionsBased on learnings, allowing
COLLABORATORis intentional since the workflow is non-destructive.
16-23: Title prefix check matches the documented convention.The case-insensitive regex
^\[(feature|fix|change)\]correctly enforces the strict prefix requirement. Based on learnings, scoped variants like[feature/bots]are intentionally not matched..github/workflows/bot-changelog-runner.yml (4)
3-7: Workflow trigger correctly watches for the trigger workflow by exact name.The
workflows: ["Changelog Bot Trigger"]matches thename:inbot-changelog-trigger.ymlexactly. This coupling is critical and documented in the RST file.
9-13: Permissions are appropriately scoped.The permissions block correctly includes:
actions: read- needed for downloading artifacts from the triggering runcontents: read- needed for checkout in the reusable workflowpull-requests: writeandissues: write- needed for posting commentsBased on learnings, the custom GitHub App token used by the reusable workflow is not subject to this permissions block, so
actions: readwon't interfere with any App-authenticated API calls.
22-40: Robust artifact handling with proper validation.The implementation correctly:
- Uses
continue-on-error: trueon download to gracefully handle cases where the trigger didn't upload an artifact (non-noteworthy PRs)- Validates PR number is strictly numeric with
^[0-9]+$regex before using it- Only proceeds if download succeeded via
steps.download.outcome == 'success'This prevents both silent failures and potential injection attacks.
42-51: Reusable workflow invocation matches expected interface.The call to
reusable-bot-changelog.ymlcorrectly passes:
pr_numberinput (string type matches the reusable workflow's declaration)- All three required secrets:
GEMINI_API_KEY,OPENWISP_BOT_APP_ID,OPENWISP_BOT_PRIVATE_KEYThe conditional
if: needs.fetch-metadata.outputs.pr_number != ''ensures the reusable workflow only runs when a valid PR number was extracted.
nemesifier
approved these changes
Mar 24, 2026
Contributor
Author
|
@coderabbitai review the changes, and approve if everything aligns |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainLet me gather the file contents before reviewing. 🏁 Script executed: Length of output: 26134
Documentation ✅
Everything aligns. Approving the PR. [approve] 🧠 Learnings used |
Contributor
Author
|
looks good to me, now the naming of files give better clarity. |
github-project-automation
Bot
moved this from In progress
to Done
in OpenWISP Contributor's Board
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist
Reference to Existing Issue
Closes #630
Description of Changes
The pull_request_review event blocks secret access for fork PRs. I Split the workflow into two steps workflow_run pattern (same approach used by the CI failure bot):