Repository navigation
fix(ci): give a manual run of scan-and-report.yml its inputs - #287
Conversation
Run 42862049822, the first run of this file by workflow_dispatch, failed at "Run scan": "a value is required for '<TARGET>' but none was supplied". The fetch and build steps of #286 passed in that run. repo_path and fail_on_severity are declared under workflow_call only. A workflow_dispatch run has its own inputs context, so both were empty strings: the scan had no target, and the severity gate would then reject the empty threshold. The step before #286 had the same defect, because it expanded the same empty input. Declare both inputs under workflow_dispatch with the same names and defaults. The expressions in the steps do not change, so an explicit bad value from a caller is still refused. Refs #276 Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 24 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Follow-up to #286. Refs #276.
What failed
Run 42862049822 was the first run of
scan-and-report.ymlbyworkflow_dispatch. It ran on the #286 branch before the merge.a value is required for '<TARGET>' but none was supplied.Cause
repo_pathandfail_on_severityare declared underworkflow_callonly. Aworkflow_dispatchrun has its owninputscontext, so both values were empty strings.fail_on_severity must be one of ...).The step before #286 expanded the same empty input, so this path did not work before #286 either. #286 did not cause it. The first manual run showed it.
Change
Declare both inputs under
workflow_dispatch, with the same names and the same defaults (.andnone).The expressions in the steps do not change. An explicit bad value from a caller is still refused.
Evidence: hosted run 42863864116 on
2e99fb8Added after the merge. The run was a
workflow_dispatchon this branch.scanner source: hyperpolymath/panic-attack@2e99fb87abd35f756ed2bfafa045e954dcd7cde2, the commit under test.REPO_PATH: ., thenReport saved to: scan-result.json.none.Bad credentials.The last step is not part of this change. The
VERISIMDB_PATsecret of this repository is set, and GitHub refuses it. The step fails loudly by design. The owner must replace or remove that secret.This run shows the second acceptance criterion of #276: a run of this workflow in its own repository builds the commit under test.
Not shown
The external caller case of #276. That still needs a caller that pins a commit with #286, for example echidna's
security-scan.yml.🤖 Generated with Claude Code
https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6