chore: reusable trunk-upgrade #52
Conversation
Walkthrough
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.gitignore (1)
43-43: Good fix on recursive tmp glob; consider a tiny hardeningSwitching from "/.tmp" to "/*.tmp" uses the correct Git ignore semantics for recursive matching. Optionally, add a root-level pattern for maximal compatibility with tools that may not treat "**" as matching zero directories.
**/*.backup **/*.tmp +*.tmp **/*.temp.github/workflows/trunk-upgrade.yaml (1)
23-23: Pin the action to a commit SHA for supply-chain safetyTags can be retagged; pinning the action to a specific commit SHA is a common hardening step (you already do this for actions/checkout).
- uses: masterpointio/github-action-trunk-upgrade@v0.1.0 + uses: masterpointio/github-action-trunk-upgrade@<commit-sha> +# Replace <commit-sha> with the exact commit for v0.1.0 and keep a comment with the version for readability.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
.github/CODEOWNERS(1 hunks).github/workflows/trunk-upgrade.yaml(1 hunks).gitignore(1 hunks)
🔇 Additional comments (2)
.github/workflows/trunk-upgrade.yaml (2)
28-28: Reviewers alignment with CODEOWNERS is cleanSetting reviewers to @masterpointio/masterpoint-open-source matches the updated CODEOWNERS and reduces duplication. Nice consistency.
25-27: Verify secrets configuration and reduce PAT usageI attempted to list the repository- and organization-level secrets but received HTTP 403 errors due to insufficient permissions. Please manually confirm the following:
- The secrets
MP_BOT_APP_IDandMP_BOT_APP_PRIVATE_KEYare present at the repo or org level and accessible by this workflow.- The
MASTERPOINT_TEAM_PATsecret exists only if strictly necessary, and is configured as a fine-grained, repository-scoped PAT.Best practice: prefer using the GitHub App installation token (via your App ID and private key) instead of a long-lived PAT to minimize blast radius. If a PAT is required for specific endpoints, ensure it’s scoped with the narrowest permissions possible.
|
|
||
| # These owners will be the default owners for everything | ||
| * @masterpointio/masterpoint-open-source @masterpoint-team | ||
| * @masterpointio/masterpoint-open-source |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Default owners simplification looks right; please verify team slug and access
Removing a redundant team entry reduces noise. Confirm that @masterpointio/masterpoint-open-source is an org team with repo access, so CODEOWNERS can request reviews successfully.
You can verify with GitHub CLI:
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ORG="masterpointio"
TEAM_SLUG="masterpoint-open-source"
REPO="masterpointio/terraform-module-template"
# 1) Team exists
gh api /orgs/$ORG/teams/$TEAM_SLUG >/dev/null && echo "Team exists: $ORG/$TEAM_SLUG"
# 2) Team has repo access (any level)
gh api /orgs/$ORG/teams/$TEAM_SLUG/repos/$REPO >/dev/null && echo "Team has access to $REPO"Length of output: 336
Fix invalid team slug in CODEOWNERS
Our verification script returned 404 errors when checking both the team’s existence and its repo access, which means the entry in your .github/CODEOWNERS file will not work as-is:
- File:
.github/CODEOWNERS
Line: 7
Entry:- * @masterpointio/masterpoint-open-source
Please address this critical issue:
- Confirm the exact GitHub team slug (it may differ from
masterpoint-open-source). - If the team doesn’t exist yet, create it under
masterpointioand grant it access tomasterpointio/terraform-module-template. - Update the CODEOWNERS entry with the correct slug once established, for example:
- * @masterpointio/masterpoint-open-source + * @masterpointio/<correct-team-slug>
Until this is fixed, CODEOWNERS reviews cannot be requested as intended.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
.github/CODEOWNERS around line 7: the team slug
"@masterpointio/masterpoint-open-source" is invalid and caused 404s; verify the
correct GitHub team slug under the masterpointio org (it may differ), or if the
team does not exist create the team under masterpointio, grant it access to the
masterpointio/terraform-module-template repo (with required permission level),
then update the CODEOWNERS entry on line 7 to use the exact confirmed slug
(e.g., @masterpointio/<correct-slug>) so CODEOWNERS resolution succeeds.
1 participant
what
why
references
Summary by CodeRabbit