ci: fail PRs over 1500 lines of python changes#6209
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR Size Check workflow gains a new ChangesPython Churn Limit Enforcement
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/pr-size.yml (1)
3-11:⚠️ Potential issue | 🟠 Major | ⚡ Quick winHarden token scope with explicit workflow/job permissions.
python-diff-sizeonly needs repository read access, but the workflow currently relies on default token permissions. Add explicit least-privilege permissions at workflow level and keeppr-size’s write override scoped only to that job.Suggested patch
name: PR Size Check on: pull_request: types: [opened, synchronize, reopened] +permissions: + contents: read + jobs: pr-size: runs-on: ubuntu-latest permissions: pull-requests: write @@ python-diff-size: runs-on: ubuntu-latest + permissions: + contents: readAlso applies to: 34-35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-size.yml around lines 3 - 11, The workflow currently relies on default token permissions without explicit declarations, which violates the principle of least privilege. Add a `permissions` block at the workflow root level (before the `jobs` section) with read-only access to the repository (contents: read), while keeping the existing `pull-requests: write` permission override in the `pr-size` job. This ensures the workflow has minimal permissions at the top level, with only the specific job that needs write access to pull requests having that elevated permission.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-size.yml:
- Around line 44-47: The base variable on line 44 is being set by interpolating
github.base_ref (a branch name) directly into a shell command, which creates a
shell injection vulnerability. Replace the github.base_ref interpolation with
the immutable base commit SHA from the GitHub event payload using
github.event.pull_request.base.sha instead, as this provides a fixed-format,
safe value that cannot contain special shell characters.
---
Outside diff comments:
In @.github/workflows/pr-size.yml:
- Around line 3-11: The workflow currently relies on default token permissions
without explicit declarations, which violates the principle of least privilege.
Add a `permissions` block at the workflow root level (before the `jobs` section)
with read-only access to the repository (contents: read), while keeping the
existing `pull-requests: write` permission override in the `pr-size` job. This
ensures the workflow has minimal permissions at the top level, with only the
specific job that needs write access to pull requests having that elevated
permission.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 19d14373-d7f5-409d-9578-9055f220328c
📒 Files selected for processing (1)
.github/workflows/pr-size.yml
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/pr-size.yml (1)
39-41: ⚡ Quick winDisable persisted checkout credentials for least-privilege hardening.
At Line 39,
actions/checkoutshould setpersist-credentials: falseso the token is not left in local git config for later steps.Suggested patch
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-size.yml around lines 39 - 41, The `actions/checkout` action in the pr-size.yml workflow is missing security hardening for credential handling. Add `persist-credentials: false` to the `with` section of the checkout action (alongside the existing `fetch-depth: 0`) to ensure the authentication token is not persisted in the local git configuration after checkout completes, following the principle of least-privilege access.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/pr-size.yml:
- Around line 39-41: The `actions/checkout` action in the pr-size.yml workflow
is missing security hardening for credential handling. Add `persist-credentials:
false` to the `with` section of the checkout action (alongside the existing
`fetch-depth: 0`) to ensure the authentication token is not persisted in the
local git configuration after checkout completes, following the principle of
least-privilege access.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0099930d-74e1-4895-b4c3-2333e7c627b2
📒 Files selected for processing (1)
.github/workflows/pr-size.yml
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 474496f. Configure here.
2 participants
Adds a
python-diff-sizejob to the existing PR Size Check workflow that fails when a PR's.pychurn (added + deleted) exceeds 1500 lines..pyfiles,origin/<base>...HEAD, skips binaries.The existing
pr-size-labeleronly labels XS–XL on total diff and never fails; this is the Python-specific hard gate.Follow-up after merge: add the
python-diff-sizecheck to rulesetmain(id 2686846), alongsidelint/tests (3.x), to make it block merges.Note
Low Risk
CI-only workflow change with no runtime or application code impact; merge blocking depends on making the new check required in branch rules.
Overview
Adds a
python-diff-sizejob to the PR Size Check workflow that fails the check when added + deleted lines across*.pyfiles exceed 1500, complementing the existing labeler job which only assigns size labels and never blocks merges.The job checks out full history, uses a three-dot
base...headdiff (aligned with GitHub’s “Files changed” view), sums line churn viagit diff --numstat, and on failure emits a workflow error plus a sorted per-file breakdown. It runs on every PR open/sync/reopen with read-onlycontentspermission and no extra dependencies.Reviewed by Cursor Bugbot for commit 4068fa3. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit