chore(ci): opt in to the PR-Agent third reviewer (pilot)#104
Conversation
Adds the caller for cuioss-organization's reusable-pr-agent-review.yml (v0.14.0), making this repo one of the two pilot repos for the org's third automated reviewer — open-source PR-Agent on Google Gemini, beside CodeRabbit and Sourcery. This is the Java/Maven half of the pilot. Nothing is configured here: review tuning is central in cuioss/pr-agent-settings, and the org skip rules (dependabot[bot], cuioss-release-bot[bot], the skip-bot-review label, fork PRs) live in the reusable workflow's job-level if: guard. Co-Authored-By: Claude <noreply@anthropic.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @cuioss-oliver, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository: cuioss/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
v0.14.1 carries the published-review fail-closed gate: PR-Agent's action exits 0 even when every model call fails, so v0.14.0 would report a green check with no review posted. Co-Authored-By: Claude <noreply@anthropic.com>
v0.15.0 moves the reviewer from AI Studio to Gemini on Vertex AI with Workload Identity Federation: keyless, and it draws on the GCP free-trial credits. The caller must grant id-token: write so the job can mint the OIDC token the federation exchanges for short-lived GCP credentials. Co-Authored-By: Claude <noreply@anthropic.com>
v0.15.1 drops the AI Studio passthrough: with GEMINI_API_KEY deleted it advertised a fallback route that could not work. REVIEW_APP_ID and REVIEW_APP_PRIVATE_KEY are now the reviewer's only secrets. Co-Authored-By: Claude <noreply@anthropic.com>
v0.15.2 keys the fail-closed gate on the reviewer step's structured output rather than a published comment: a clean review publishes nothing by design, which the previous gate wrongly treated as failure. Co-Authored-By: Claude <noreply@anthropic.com>
Maps REVIEW_APP_ID and REVIEW_APP_PRIVATE_KEY explicitly instead of secrets: inherit — those two are the whole requirement now that Vertex AI is keyless, and inherit exposed every secret this repo can see to the called workflow. CodeRabbit finding on this PR. v0.15.3 also gates command-triggered runs (/review and friends) on author_association: an issue_comment event runs with full secrets and the OIDC token even for a fork's PR, so the trigger is now restricted to OWNER/MEMBER/COLLABORATOR. Co-Authored-By: Claude <noreply@anthropic.com>
1 participant
Adds the caller for
cuioss-organization'sreusable-pr-agent-review.yml(v0.14.0), making this the Java/Maven half of the pilot for the org's third automated reviewer — open-source PR-Agent on Google Gemini, beside CodeRabbit and Sourcery. Nothing is replaced.Nothing is configured here by design:
.pr_agent.toml), merged beneath any repo-local config and re-read every run.dependabot[bot],cuioss-release-bot[bot], theskip-bot-reviewlabel, and fork PRs — live in the reusable workflow's job-levelif:guard, because PR-Agent's ownignore_pr_*settings are read only by its webhook servers and are inert in GitHub Action mode./reviewruns automatically./describeand/improveare off.The reviewer is security-weighted (
require_security_review, security-focused extra instructions), filling the gap left by the retired consumer tier of Gemini Code Assist. This repo is in the pilot because it exercises a different language and footprint from plan-marshall, and itsclaude.ymlgives a side-by-side reviewer comparison.This PR is a live test:
pull_requestworkflows run from the head branch, so the reviewer should post one comment fromcuioss-review-bot[bot]headed## PR Reviewer Guide 🔍.