chore(pr-agent): repoint the reusable pin to the fixed SHA - #84
Conversation
The pinned SHA predates ed47221e and 32af9cef, both already on wave-foundation origin/main. Without the per-attempt timeout budget from 32af9cef a slow review consumes the 15-minute job ceiling, which GitHub renders as `cancelled` and which continue-on-error structurally cannot trap — so the lane looks configured and silently does not run. 100 of the fleet's callers already use @main; this adopts that convention.
|
Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
|
ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Warning Review limit reachedNext included review available in 53 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 93 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Comment |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_773dc6ff-bf26-47dd-8f46-d8c3edc51bca) |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis one-line workflow change adopts the current first-party reusable PR-agent implementation, bringing in its failure-classification and per-attempt timeout fixes while matching the fleet's existing File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — Although the repository diff is a one-line SHA update, the new reusable workflow materially changes secret-bearing PR automation through routing defaults, fork gating, retries, timeouts, and failure handling. The resulting CI and security-sensitive behavior warrants human review. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
|
Note Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by September 1. Add seats for more headroom. Code Review ✅ ApprovedUpdates the PR-agent workflow caller to reference OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
@main trips the fleet zizmor `unpinned-uses` ratchet (baseline 0): claude-workstation workflow-lint failed with "This PR ADDS a workflow-security finding". Pinning to 32af9cef — the last commit touching reusable-pr-agent.yml, and the one that ADDS the per-attempt timeout budget — keeps SHA-pinning intact while still carrying both fixes (ed47221e, 32af9cef) the previous pin lacked.
|
Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_a3fb4677-b1a4-4099-937a-019887764cfd) |
yakimoto
changed the title
wave-foundation#1273 merged, which added a `lane version` step to the reusable that annotates the resolved lane SHA and warns when a caller pins behind 32af9cef. Bumping from 32af9cef to 4ac59c8c picks that up, so this caller lands current instead of one commit stale on merge. Still SHA-pinned — @main trips the zizmor unpinned-uses ratchet (baseline 0).
|
Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_c332270d-0970-4945-b36e-a787362d320f) |
1 participant
What this changes
Repoints this repo's
pr-agentcaller from a pinned SHA ofwave-av/wave-foundation/.github/workflows/reusable-pr-agent.ymlto@main.Why
The pinned SHA predates two fixes that are already merged on
wave-foundationorigin/main:ed47221e(2026-08-22) — honest failure classification; the lane had been reporting a rate limitfor causes that were not rate limits.
32af9cef(2026-08-24) — ports four fixes the public mirror received, including the per-attempttimeout-minutesstep budget.Without the second one, a slow router call with
auto_reviewandauto_improveboth enabled canconsume the entire 15-minute job ceiling. GitHub renders that as
cancelled, and the reusable'sbounded retry is structurally unable to catch it, because
continue-on-errordoes not trap acancellation. The observable result is a review lane that looks configured and silently does not
run.
Evidence
Measured 2026-08-25 across the fleet, reading each repo's
origin/main:reusable-pr-agent.yml@mainOn the
pull_requestbucket, callers on stale pins cancelled far more often than callers on currentlogic.
claude-workstation(pinned51be84ea) cancelled 19 of 24;wave-console(@main)cancelled 1 of 8. That control is n=1 on the current-logic side and is corroboration rather than
proof — the mechanism above is what carries the finding.
Reproduce the caller inventory:
Why
@mainand not a newer SHA@mainis what 100 of the fleet's callers already use, so this is the existing convention ratherthan a new posture. The supply-chain argument for SHA-pinning is strong for third-party actions and
much weaker for a first-party reusable workflow inside the same org, which is why the fleet settled
where it did. Pinning to a fresh SHA would reintroduce exactly this drift the next time the lane is
fixed.
Blast radius
One line, in one workflow file. No change to triggers, concurrency, permissions, secrets, or any
job-level gate. If the lane misbehaves the revert is the same one line.
Verification
.github/workflows/pr-agent.ymlparses as YAML after the change, and the diff is the pin line only.Nothing here proves the lane now succeeds — that is only observable on the next
pull_requestrunafter merge, and the receipt to look for is a review that either posts or ends with an explicit
timeout annotation, instead of a bare
cancelled.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by Sourcery
Refresh the pr-agent reusable workflow reference to consume the latest upstream fixes and reduce silent cancellations of review runs.
Enhancements:
CI:
Note
Low Risk
Single-line CI dependency pin with no application or secret-handling changes; blast radius is limited to the PR-agent workflow behavior.
Overview
Updates the pinned revision of
wave-av/wave-foundation/.github/workflows/reusable-pr-agent.ymlused by the localpr-agentcaller from150ffae…to4ac59c8….Nothing else in the workflow changes—triggers, concurrency, permissions, and
OPENAI_KEYwiring stay the same. The intent is to pick up upstream reusable-lane fixes (clearer failure reporting and per-step timeout handling) so PR review jobs are less likely to hit the job ceiling and show up as unexplainedcancelledruns.Reviewed by Cursor Bugbot for commit 717df77. Bugbot is set up for automated code reviews on this repo. Configure here.