[shenxianpeng]

Follow-up to #140.

Before: GraphQL requests used api_url.join("/graphql"). The leading / replaces the whole path, so on GitHub Enterprise Server, where the REST API is at https://<host>/api/v3 and GraphQL is at https://<host>/api/graphql, every GraphQL request (fetching existing review threads, resolving or deleting old review comments, hiding outdated reviews) went to https://<host>/graphql and failed.

After: the client reads the GraphQL endpoint from GITHUB_GRAPHQL_URL, which GitHub runners set on both github.com (https://api.github.com/graphql) and GHES (https://<host>/api/graphql). When it is not set, it falls back to https://api.github.com/graphql, the same way GITHUB_API_URL falls back to https://api.github.com.

Runner	GraphQL URL before	GraphQL URL after
github.com	https://api.github.com/graphql	https://api.github.com/graphql (unchanged)
GHES	https://<host>/graphql	https://<host>/api/graphql

How: GithubApiClient stores the parsed GITHUB_GRAPHQL_URL in a graphql_url field, used by all three GraphQL calls in graphql.rs. The unit test ensure_api_url_has_trailing_slash checks the field, and tests/github_pr_reviews.rs points GITHUB_GRAPHQL_URL at the mock server.

Found while testing cpp-linter-action with cpp-linter 1.15.0 (cpp-linter/cpp-linter-action#501).

Summary by CodeRabbit

• Bug Fixes
  • Improved GitHub integration when retrieving, closing, or hiding outdated review comments.
  • Added support for correctly connecting to GraphQL endpoints across GitHub.com, GitHub Enterprise, and local server configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a149e1c0-7bf4-4b57-850c-b46fdea8b295

📥 Commits

Reviewing files that changed from the base of the PR and between 9606bf3 and 32193f8.

📒 Files selected for processing: 3

• src/client/github/graphql.rs
• src/client/github/mod.rs
• src/client/github/specific_api.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The GitHub API client now derives and stores a GraphQL URL from its normalized REST API URL. Review-comment retrieval, closure, and outdated-review hiding use the configured URL.

Changes: GitHub GraphQL endpoint

Layer / File(s)	Summary
Derive and store the GraphQL URL src/client/github/mod.rs, src/client/github/specific_api.rs	GithubApiClient stores a GraphQL URL derived from the normalized API URL. The derivation selects the endpoint for GitHub Enterprise Server URLs ending in /v3/ and for other URLs. Tests cover github.com, GitHub Enterprise Server, and a local HTTP host.
Use the configured GraphQL URL src/client/github/graphql.rs	Review-comment retrieval, closure, and outdated-review hiding use the configured GraphQL URL.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: 2bndy5

Merge Risk: ⚪ Minimal · up to 32193

No concrete correctness, availability, or integration risk was identified in the current implementation.

Security architecture risk: 🟡 Moderate · up to 32193

The endpoint remains on the configured GitHub host. However, enabling these operations on Enterprise Server also activates cleanup logic that treats copyable comment text as bot identity. When cleanup runs with sufficient permissions, a participant could cause the bot to resolve another reviewer’s discussion.

Retained concerns

• Medium · security · inferred: The repaired GHES endpoint activates a cleanup path that trusts a comment-body prefix rather than authenticated bot authorship. A participant able to reply to an unresolved human review thread can copy the bot marker into an unmatched reply. Cleanup selects that reply and subsequently resolves the whole thread using the bot’s token when its permissions allow. This ownership weakness is pre-existing on github.com but becomes effective on GHES through this change.

Security review details

Security Blast Radius

• inferred — For a cleanup invocation, queried node identities are scoped to the configured repository and current PR. The ownership concern can affect marker-bearing discussions throughout that PR, subject to the bot token’s mutation permissions. The endpoint change does not itself provide cross-host access or additional token privileges.

Security Findings and Attack Paths

• inferred — A review participant can copy the marker exposed in generated comments and prepend it to a reply in a human discussion. The query requests no author identity, and selection checks only the prefix and thread state. An unmatched selected reply leaves keep_thread false, leading to a mutation with the enclosing thread ID. With an eligible cleanup invocation and a token authorized to resolve that thread, this turns participant-controlled text into a privileged discussion-state change.

Trust Boundaries and Controls

• observed — Cleanup requires PR context and GITHUB_TOKEN, skips locked PRs, and normally skips closed PRs. Reuse requires matching body, path, line positions, and active review state. These controls limit execution and duplicate reuse but do not establish bot authorship. Defaulting deletion to false still permits whole-thread resolution.

Hardening Proposals

• proposed — Bind cleanup eligibility to authenticated bot/app authorship in addition to the marker, and define an explicit policy for mixed human/bot discussions before resolving an entire thread.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage		Docstring coverage is 87.50% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 3 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the main change: GraphQL requests now use the configured GraphQL endpoint. It does not mention GitHub Enterprise Server URL derivation, but it remains concise and directly…

Full details: Title check

Explanation

The title clearly identifies the main change: GraphQL requests now use the configured GraphQL endpoint. It does not mention GitHub Enterprise Server URL derivation, but it remains concise and directly related to the changeset.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 96.90%. Comparing base (9606bf3) to head (db790b8).

Files with missing lines	Patch %	Lines
src/client/github/specific_api.rs	88.88%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #143      +/-   ##
==========================================
- Coverage   96.94%   96.90%   -0.05%     
==========================================
  Files          16       16              
  Lines        1769     1778       +9     
==========================================
+ Hits         1715     1723       +8     
- Misses         54       55       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[2bndy5]

So much cleaner with GITHUB_GRAPHQL_URL env var.