Repository navigation
Meter CI autofix usage (UM-1593) - #1702
Conversation
Bump the autofix caller pins to the metering-enabled reusables and forward USAGE_INGEST_TOKEN in the same change. Refs UM-1593. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Code Review Completed! 🔥The code review was successfully completed based on your current configurations.
|
| Options | Enabled |
|---|---|
| Bug | ✅ |
| Performance | ✅ |
| Security | ✅ |
| Business Logic | ✅ |
|
Business Rules ValidationTask: 5773430482 — Provision Canonical iOS Records to Unblock Widget Fix Delivery FindingsMUST_FIX: PR scope does not match the task scopeRequirement: "The owner approved these active bundle IDs on October 9: Usage Monitor app: MUST_FIX: No evidence of canonical Usage Monitor app bundle ID in this PR diffRequirement: "Usage Monitor app: MUST_FIX: No evidence of Widget extension bundle ID in this PR diffRequirement: "Widget extension: MUST_FIX: No evidence of Local Monitor app bundle ID in this PR diffRequirement: "Local Monitor app: SUGGESTION: No evidence of hosted-ship script guard or
|
![kody-ai[bot]](https://avatars.githubusercontent.com/in/413034?s=60&v=4){kind=small}
| (github.event_name == 'pull_request_review' && | ||
| github.event.review.user.type == 'Bot' && | ||
| github.event.pull_request.head.repo.full_name == github.repository) | ||
| uses: Simple-With-Us/congress-trading-shared/.github/workflows/codex-autofix-reusable.yml@825f8ee008d6ce104107f2a7267c14d370e6013e | ||
| uses: Simple-With-Us/congress-trading-shared/.github/workflows/codex-autofix-reusable.yml@31659885f58f08e129b6dc092f3493d7cdb74a11 |
There was a problem hiding this comment.
Permission intersection failure in claude-code-autofix.yml: the workflow grants only contents: write, pull-requests: write at workflow level while codex-autofix-reusable.yml@31659885 declares a metering step (id: usage, exposed via outputs.usage) requiring actions: read. A called workflow cannot raise the caller's permissions, so the metering step's requirement is intersected with no caller grant and fails with HTTP 403 from the Actions API. Add actions: read to a job-level permissions: block on the autofix job, matching what kody-fleet-autofix.yml already applies.
permissions:
contents: write
pull-requests: write
concurrency:
group: pr-autofix-${{ github.repository }}-${{ github.event.pull_request.number || github.event.inputs.pr }}
cancel-in-progress: false
jobs:
autofix:
if: >-
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'pull_request_review' &&
github.event.review.user.type == 'Bot' &&
github.event.pull_request.head.repo.full_name == github.repository)
permissions:
contents: write
pull-requests: write
actions: read
uses: Simple-With-Us/congress-trading-shared/.github/workflows/codex-autofix-reusable.yml@31659885f58f08e129b6dc092f3493d7cdb74a11Prompt for LLM
File .github/workflows/claude-code-autofix.yml:
Line 24 to 27:
Permission intersection failure in claude-code-autofix.yml: the workflow grants only `contents: write, pull-requests: write` at workflow level while codex-autofix-reusable.yml@31659885 declares a metering step (`id: usage`, exposed via `outputs.usage`) requiring `actions: read`. A called workflow cannot raise the caller's permissions, so the metering step's requirement is intersected with no caller grant and fails with HTTP 403 from the Actions API. Add `actions: read` to a job-level `permissions:` block on the `autofix` job, matching what kody-fleet-autofix.yml already applies.
Suggested Code:
permissions:
contents: write
pull-requests: write
concurrency:
group: pr-autofix-${{ github.repository }}-${{ github.event.pull_request.number || github.event.inputs.pr }}
cancel-in-progress: false
jobs:
autofix:
if: >-
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'pull_request_review' &&
github.event.review.user.type == 'Bot' &&
github.event.pull_request.head.repo.full_name == github.repository)
permissions:
contents: write
pull-requests: write
actions: read
uses: Simple-With-Us/congress-trading-shared/.github/workflows/codex-autofix-reusable.yml@31659885f58f08e129b6dc092f3493d7cdb74a11
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
1 participant
Refs UM-1593
Meter CI autofix usage (UM-1593)
Summary
Wires CI usage metering into the repository's three autofix workflows. Each workflow now passes a
USAGE_INGEST_TOKENsecret to its reusable workflow and pins to a newer reusable workflow revision that performs the metering. Theautofix.ymlcaller additionally requestsactions: read, which the metering step relies on.Changes
.github/workflows/autofix.ymlactions: readto the job'spermissionsblock.pr-autofix-reusable.ymlreference from2e671004…tob634b511….USAGE_INGEST_TOKENinto the reusable workflow..github/workflows/claude-code-autofix.ymlcodex-autofix-reusable.ymlreference from825f8ee0…to31659885….USAGE_INGEST_TOKENinto the reusable workflow..github/workflows/kody-fleet-autofix.ymlkody-autofix-reusable.ymlreference fromfea7cd12…to31659885….USAGE_INGEST_TOKENinto the reusable workflow.Functional impact
Autofix runs (PR autofix, Claude/Codex review autofix, and Kody fleet autofix) can now report their usage to the metering backend using the shared ingest token, so agent usage from CI autofix activity is captured alongside other usage sources.
Review notes (from automated review)
.github/workflows/claude-code-autofix.ymldoes not grantactions: read, while the pinnedcodex-autofix-reusable.yml@31659885metering step is expected to require it, by symmetry with the autofix reusable workflow updated in this PR.