Conversation
WalkthroughAdds a new GitHub Actions workflow that runs on pull_request_target (opened) and posts a greeting comment to the PR author using peter-evans/create-or-update-comment@v4 without checking out the repository. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor PR_Author as PR Author
participant GH as GitHub
participant WF as Workflow (pull_request_target)
participant ACT as peter-evans/create-or-update-comment@v4
participant API as GitHub PR API
PR_Author->>GH: Open Pull Request
GH-->>WF: Trigger on pull_request_target (opened)
WF->>ACT: Run action with issue-number = PR number<br/>body = "Hi @login! Thank you for the contribution."
ACT->>API: Create or update PR comment
API-->>ACT: Comment created/updated
ACT-->>WF: Step complete
WF-->>GH: Job complete
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/pull-request-comment.yml (2)
8-9: Tighten permissions to the minimum required.create-or-update-comment works with either issues: write or pull-requests: write. For clarity, grant the minimal scope explicitly (issues: write is the direct API used to create PR comments). (github.com, docs.github.com)
-permissions: - pull-requests: write +permissions: + issues: writeAlternative (also OK): keep pull-requests: write. Do not grant extra scopes.
23-24: Nit: Consider a richer, future-proof welcome message.Optionally include links (CONTRIBUTING, CI status hints) or a reaction. Example:
- Add reactions:
reactions: '+1'- Use a template file body for easier edits later.
This is purely optional polish. (github.com)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/pull-request-comment.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/pull-request-comment.yml
17-17: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🔇 Additional comments (1)
.github/workflows/pull-request-comment.yml (1)
3-7: Ensure PR Comment Workflow Supports Forked Pull RequestsWe’ve confirmed the workflow is currently triggered on the
pull_requestevent and includes both a checkout step and thecreate-or-update-commentaction, which means:
- With
on: pull_request, theGITHUB_TOKENwill be read-only when a PR originates from a fork, causing the comment step to fail with “Resource not accessible by integration.”- Switching to
pull_request_targetallows write permissions on forks, since the workflow runs in the context of the base branch.Please confirm whether you need to support commenting on PRs opened from forks. If so, update the trigger and carefully handle the checkout step (so you don’t inadvertently run untrusted code):
-on: - pull_request: - types: - - opened +on: + pull_request_target: + types: + - openedSecurity note: either remove the checkout step or guard it to avoid checking out PR author’s code when using
pull_request_target.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.github/workflows/pull-request-comment.yml (1)
12-15: Nice: addressed earlier feedback (no checkout, updated to v4).You’ve removed the unnecessary checkout and are on the latest major of the peter-evans action, resolving prior review notes.
🧹 Nitpick comments (1)
.github/workflows/pull-request-comment.yml (1)
13-18: Make the comment idempotent and skip bot-authored PRs.Re-running the workflow (manual re-run, transient failure) will post duplicates. Also, you likely don’t want to greet bots (Dependabot, Renovate).
Apply this diff to dedupe via a marker and avoid bot PRs:
- name: Create or Update Comment - uses: peter-evans/[email protected] + if: ${{ github.event.pull_request.user.type != 'Bot' }} + uses: peter-evans/[email protected] with: issue-number: ${{ github.event.pull_request.number }} + body-includes: "[auto-pr-greeting]" + edit-mode: replace body: | - Hi @${{ github.event.pull_request.user.login }}! Thank you for the contribution. + [auto-pr-greeting] + Hi @${{ github.event.pull_request.user.login }}! Thank you for the contribution.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/pull-request-comment.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/pull-request-comment.yml (1)
3-7: Good choice of event; safe as no repo code is executed.Using pull_request_target (types: opened) is appropriate for commenting on PRs from forks. With no checkout or script execution, you avoid the common RCE pitfalls of this event.
| name: Add Comment to PR | ||
|
|
||
| on: | ||
| pull_request_target: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Harden the GITHUB_TOKEN scope (least privilege).
pull_request_target grants a broad, write-scoped token by default. This job only needs to read contents and write an issue-style comment. Restrict permissions at the workflow root.
Apply this diff to set minimal permissions:
name: Add Comment to PR
+permissions:
+ contents: read
+ pull-requests: read
+ issues: write🤖 Prompt for AI Agents
In .github/workflows/pull-request-comment.yml lines 1-4, the workflow uses
pull_request_target which grants a broad GITHUB_TOKEN scope; restrict
permissions at the workflow root by adding a permissions block that grants only
what's needed (e.g., contents: read and issues: write — or pull-requests: write
if you use the Pull Requests API) so the job can read repository contents and
post an issue-style PR comment without broad write permissions.
|
|
||
| steps: | ||
| - name: Create or Update Comment | ||
| uses: peter-evans/[email protected] |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Pin the third-party action to a commit SHA.
Using a floating tag (even v4.0.0) risks supply-chain drift. Pin to the exact commit for v4.0.0 and optionally add an allowlist comment.
Apply this diff after resolving the release’s commit SHA:
- uses: peter-evans/[email protected]
+ # v4.0.0 (pin to immutable commit for supply-chain safety)
+ uses: peter-evans/create-or-update-comment@<commit-sha-for-v4.0.0>Use one of the commands below to retrieve the exact commit SHA for v4.0.0:
🏁 Script executed:
#!/bin/bash
# Get the commit SHA for the v4.0.0 tag (select the commit, not the tag object)
git ls-remote https://github.com/peter-evans/create-or-update-comment refs/tags/v4.0.0 | awk 'END{print $1}'Length of output: 151
Pin GitHub Action to immutable commit SHA
The peter-evans/[email protected] reference should be pinned to the exact commit to prevent supply-chain drift.
• File: .github/workflows/pull-request-comment.yml
Line: 14
Suggested diff:
- uses: peter-evans/[email protected]
+ # v4.0.0 (pin to immutable commit for supply-chain safety)
+ uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: peter-evans/[email protected] | |
| - name: Comment on PR | |
| # v4.0.0 (pin to immutable commit for supply-chain safety) | |
| uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| body: | | |
| Hi @${{ github.event.pull_request.user.login }}! Thank you for the contribution. |
1 participant
Description
Related Issue
Type of Change
Checklist
Additional Notes
N/A
Summary by CodeRabbit