docs: clarify token privilege scoping#1101
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new 'Privilege Scoping' section to the Layer5 Cloud tokens documentation to clarify that API tokens are identity-scoped. The review feedback suggests updating this new section to use the second-person perspective ('you', 'your') to maintain consistency with the rest of the document, and provides a code suggestion to resolve this.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
965cc21 to
ce55e68
Compare
|
@leecalcote @sudhanshutech @Bhumikagarggg , could you please take a look and review it when you have a chance? |
|
🚀 Preview deployment: https://docs.layer5.io/pr-preview/pr-1101/
|
0fc9826 to
47e95f8
Compare
b410a1d to
9f4a651
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR adds an artifact-producing workflow for pull request previews, updates deployment and cleanup to consume those artifacts, and documents that API tokens inherit account privileges without fine-grained token-specific scopes. ChangesArtifact-based PR preview pipeline
Token privilege documentation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant BuildPRPreview
participant ArtifactStorage
participant PreviewDeployment
participant GhPages
PullRequest->>BuildPRPreview: trigger preview build
BuildPRPreview->>ArtifactStorage: upload public/ artifact
ArtifactStorage->>PreviewDeployment: provide completed preview artifact
PreviewDeployment->>GhPages: deploy preview
PreviewDeployment->>PullRequest: comment preview URL
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@content/en/cloud/concepts/identity-and-security/tokens.md`:
- Around line 27-29: Update the API token privilege description in the
identity-and-security tokens documentation to state that tokens inherit the
requesting user’s roles and permissions within the organization and environment
selected by the request context. Clarify that users may have different access
levels across organizations and that a token does not grant uniform access to
every organization, while preserving the existing explanation that
token-specific privilege scopes are unsupported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c5188968-5f6c-4d91-a6a4-97ee686dc09e
📒 Files selected for processing (1)
content/en/cloud/concepts/identity-and-security/tokens.md
|
@coderabbitai I have updated the documentation to clarify that the token inherits privileges for the specified organization and environment. Also, fixed the actions/checkout 'pull_request_target' security error by setting 'allow-unsafe-pr-checkout: true'. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Changed files ---'
git diff --name-status HEAD^ HEAD
printf '%s\n' '--- Tokens documentation diff ---'
git diff HEAD^ HEAD -- content/en/cloud/concepts/identity-and-security/tokens.md 2>/dev/null || true
printf '%s\n' '--- Token documentation context ---'
if [ -f content/en/cloud/concepts/identity-and-security/tokens.md ]; then
nl -ba content/en/cloud/concepts/identity-and-security/tokens.md | sed -n '1,240p'
fi
printf '%s\n' '--- pull_request_target and checkout configuration ---'
rg -n -C 6 --glob '*.yml' --glob '*.yaml' \
'pull_request_target|actions/checkout|allow-unsafe-pr-checkout' .github 2>/dev/null || true
printf '%s\n' '--- Workflow-file diffs ---'
git diff --name-only HEAD^ HEAD | grep -E '^\.github/.*\.(yml|yaml)$' | while IFS= read -r workflow; do
printf '\n--- %s ---\n' "$workflow"
git diff HEAD^ HEAD -- "$workflow"
doneLength of output: 2913 🏁 Script executed: #!/bin/bash
set -u
workflow=".github/workflows/build-and-preview-docs.yml"
echo '--- Workflow diff ---'
git diff HEAD^ HEAD -- "$workflow" || true
echo '--- Current workflow (numbered with awk) ---'
if [ -f "$workflow" ]; then
awk '{printf "%5d %s\n", NR, $0}' "$workflow"
else
echo "Workflow not found: $workflow"
fi
echo '--- Relevant workflow constructs across GitHub Actions files ---'
find .github -type f \( -name '*.yml' -o -name '*.yaml' \) -print 2>/dev/null | while IFS= read -r file; do
awk -v file="$file" '
/pull_request_target|actions\/checkout|allow-unsafe-pr-checkout|^[[:space:]]*permissions:|^[[:space:]]*run:|uses:/ {
printf "%s:%d: %s\n", file, NR, $0
}
' "$file"
doneLength of output: 15806 The Comment image shows the Layer5 Docs Tokens page. Its banner reads “API Tokens are User-Scoped. Not Organization-Scoped”; the visible “Privilege Scoping” text says a token carries the user’s privileges across all environments and organizations they belong to. It also includes the Tokens navigation item, the page table of contents, and an
However, Please keep privileged ✏️ Learnings added
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-and-preview-docs.yml:
- Line 39: Update the workflow job containing allow-unsafe-pr-checkout so
untrusted PR code is never executed by pull_request_target with write-scoped
permissions. Move npm ci and npm run build:preview into an unprivileged
pull_request job, or separate privileged deployment and cleanup steps from the
PR checkout while preserving the existing deployment behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0883060f-300e-49fc-8a55-e2c14a579946
📒 Files selected for processing (2)
.github/workflows/build-and-preview-docs.ymlcontent/en/cloud/concepts/identity-and-security/tokens.md
94c8a4f to
312851b
Compare
|
@coderabbitai Resolved! The PR preview workflow has been refactored to separate the unprivileged build step ('build-pr-preview.yml' on 'pull_request') from the privileged deployment workflow ('build-and-preview-docs.yml' on 'workflow_run'). No untrusted code is executed with write-scoped permissions, and 'allow-unsafe-pr-checkout' has been removed. |
|
Tip For best results, initiate chat on the files or code changes. The Comment image shows the Layer5 Docs Tokens page in a dark theme. It includes the banner “API Tokens are User-Scoped. Not Organization-Scoped” and a “Privilege Scoping” section stating that tokens inherit the user account’s privileges, roles, and permissions, without fine-grained token-specific scopes. The page also shows the Tokens sidebar item, table of contents, and an
🐇 ✅ |
Signed-off-by: Aamod007 <aamodkumar2006@gmail.com>
Signed-off-by: Aamod007 <aamodkumar2006@gmail.com>
312851b to
5e671ae
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (4)
.github/workflows/build-pr-preview.yml (4)
37-45: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winSass is installed before Node is pinned to v20.
"Install Dart Sass (npm)" runs
npm i -g sassbefore "Setup Node" configures Node 20 and updatesPATH. This means the globalsassinstall uses whichever Node/npm ships on the runner image by default, not the pinned version, and the resulting global bin may not even be resolvable once setup-node adjustsPATH. Reorder so Node is set up first for a consistent, reproducible toolchain.♻️ Suggested reorder
- - name: Install Dart Sass (npm) - run: | - npm i -g sass - sass --version - - name: Setup Node uses: actions/setup-node@v4 with: node-version: '20' + + - name: Install Dart Sass (npm) + run: | + npm i -g sass + sass --version🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-pr-preview.yml around lines 37 - 45, Move the “Setup Node” step using actions/setup-node@v4 before the “Install Dart Sass (npm)” step, so npm i -g sass and sass --version run under the pinned Node 20 toolchain.
37-40: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin the Sass version.
npm i -g sassinstalls the latest version with no pin or lockfile, so builds aren't reproducible and can break silently on a new Sass release, as flagged by zizmor's ad-hoc-packages check.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-pr-preview.yml around lines 37 - 40, Update the “Install Dart Sass (npm)” workflow step to install an explicitly pinned Sass version instead of using the unversioned package specifier, while preserving the existing sass --version verification.Source: Linters/SAST tools
26-30: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPersist-credentials not disabled before running untrusted PR build tooling.
This job checks out PR head content and then runs untrusted-controlled build steps (npm install/build, Hugo). By default
actions/checkoutpersists theGITHUB_TOKENcredential in.git/config, which any subsequent process (npm postinstall scripts, Hugo, Sass) can read from disk and exfiltrate. Addpersist-credentials: falsesince no git push happens in this job.🔒️ Suggested fix
- name: Checkout PR code uses: actions/checkout@v6 with: submodules: recursive fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-pr-preview.yml around lines 26 - 30, Update the actions/checkout step in the PR preview workflow to set persist-credentials to false, while preserving the existing recursive submodule and full-history checkout options.Source: Linters/SAST tools
32-35: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueNo checksum verification for the downloaded Hugo
.deb.The Hugo release asset is fetched over HTTPS and installed via
dpkg -iwithout verifying a checksum/signature against the GitHub release. Consider verifyingsha256sumagainst Hugo's published checksums file for supply-chain hardening.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-pr-preview.yml around lines 32 - 35, Update the “Install Hugo CLI” workflow step to download Hugo’s published checksum file, verify the downloaded .deb with sha256sum against the matching release checksum, and only run dpkg -i after verification succeeds.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-and-preview-docs.yml:
- Around line 33-41: Update the “Get PR number” step to read the PR number from
public/PR_NUMBER.txt in the downloaded artifact instead of relying on
github.event.workflow_run.pull_requests[0].number; retain the direct
pull_request event path as appropriate, and ensure the resulting pr_number
output is populated before artifact naming and downstream deploy/comment steps.
- Around line 11-13: Update the workflow-level permissions block to add actions:
read alongside the existing contents and pull-requests permissions, enabling
actions/download-artifact@v4 to access artifacts from another workflow run via
workflow_run.
---
Nitpick comments:
In @.github/workflows/build-pr-preview.yml:
- Around line 37-45: Move the “Setup Node” step using actions/setup-node@v4
before the “Install Dart Sass (npm)” step, so npm i -g sass and sass --version
run under the pinned Node 20 toolchain.
- Around line 37-40: Update the “Install Dart Sass (npm)” workflow step to
install an explicitly pinned Sass version instead of using the unversioned
package specifier, while preserving the existing sass --version verification.
- Around line 26-30: Update the actions/checkout step in the PR preview workflow
to set persist-credentials to false, while preserving the existing recursive
submodule and full-history checkout options.
- Around line 32-35: Update the “Install Hugo CLI” workflow step to download
Hugo’s published checksum file, verify the downloaded .deb with sha256sum
against the matching release checksum, and only run dpkg -i after verification
succeeds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 35e1fba5-376c-4e3b-a345-2df58910cfce
📒 Files selected for processing (3)
.github/workflows/build-and-preview-docs.yml.github/workflows/build-pr-preview.ymlcontent/en/cloud/concepts/identity-and-security/tokens.md
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/build-pr-preview.yml (1)
37-45: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMake Sass installation reproducible and select Node first.
Line 39 installs the mutable latest Sass release before Line 43 selects Node 20. Set up Node first, then consume a pinned Sass version from the project’s locked dependencies.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-pr-preview.yml around lines 37 - 45, Reorder the workflow so the actions/setup-node step configures Node 20 before Sass installation. Update the Install Dart Sass (npm) step to install Sass from the project’s locked dependencies at a reproducible pinned version, rather than using the mutable global latest package, while preserving the sass --version verification.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-and-preview-docs.yml:
- Around line 26-28: Update the workflow job condition around the existing
trigger checks to resolve the associated pull request and query its current
state before proceeding. Gate artifact download, deployment, retention, and
comment steps on the pull request still being open, so delayed workflow_run
completions cannot redeploy a closed PR preview.
In @.github/workflows/build-pr-preview.yml:
- Around line 26-30: Update the “Checkout PR code” step using
actions/checkout@v6 to disable persisted credentials via its checkout
configuration, while preserving recursive submodules and full fetch history.
- Around line 47-49: Remove the unconditional `|| true` from the “Install
dependencies” workflow step so `npm ci` failures cause the job to fail. Preserve
the conditional lockfile check, but ensure dependency installation errors are
surfaced rather than allowing the workflow to continue with incomplete
dependencies.
---
Nitpick comments:
In @.github/workflows/build-pr-preview.yml:
- Around line 37-45: Reorder the workflow so the actions/setup-node step
configures Node 20 before Sass installation. Update the Install Dart Sass (npm)
step to install Sass from the project’s locked dependencies at a reproducible
pinned version, rather than using the mutable global latest package, while
preserving the sass --version verification.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: daba9cd8-9753-4b73-9f45-f4933db832e1
📒 Files selected for processing (3)
.github/workflows/build-and-preview-docs.yml.github/workflows/build-pr-preview.ymlcontent/en/cloud/concepts/identity-and-security/tokens.md
| if: > | ||
| (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || | ||
| (github.event_name == 'pull_request_target' && github.event.action == 'closed') |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
Do not deploy a preview after its PR has closed.
A build can complete after the close-triggered cleanup finishes; this job will then redeploy the closed PR’s preview and leave it until retention pruning. Resolve the PR first, query its current state, and gate artifact download, deployment, retention, and comments on it still being open.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-and-preview-docs.yml around lines 26 - 28, Update
the workflow job condition around the existing trigger checks to resolve the
associated pull request and query its current state before proceeding. Gate
artifact download, deployment, retention, and comment steps on the pull request
still being open, so delayed workflow_run completions cannot redeploy a closed
PR preview.
Signed-off-by: Aamod007 <aamodkumar2006@gmail.com>
|
@coderabbitai Thank you for the detailed review! I have addressed all 5 items:
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- Workflow outlines ---'
for workflow in \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml
do
if [ -f "$workflow" ]; then
echo "--- $workflow ---"
nl -ba "$workflow"
else
echo "Missing: $workflow"
fi
done
echo '--- Current PR diff for the two workflows ---'
git diff "$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD^)" HEAD -- \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml || true
echo '--- Relevant workflow constructs across both files ---'
rg -n -C 4 \
'^(name|on|permissions|jobs):|workflow_run|pull_request_target|pull_request:|actions/download-artifact|actions/github-script|actions/checkout|persist-credentials|npm ci|PR_NUMBER|pull_requests|if:' \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.ymlLength of output: 1342 🏁 Script executed: #!/bin/bash
set -u
for workflow in \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml
do
echo "--- ${workflow} ---"
if [ -f "$workflow" ]; then
sed -n '1,260p' "$workflow"
else
echo "Missing workflow"
fi
done
echo '--- Current PR diff for these workflows ---'
base="$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD^ 2>/dev/null || true)"
if [ -n "$base" ]; then
git diff "$base" HEAD -- \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml || true
else
echo 'Could not determine a diff base.'
fi
echo '--- Security- and behavior-relevant lines ---'
rg -n -C 5 \
'workflow_run|pull_request_target|pull_request:|permissions:|actions: read|actions/download-artifact|run-id:|github.event.workflow_run.id|PR_NUMBER|pull_requests|actions/github-script|state.*open|persist-credentials|npm ci|allow-unsafe-pr-checkout|if:' \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml 2>/dev/null || trueLength of output: 34875 The Comment image shows the Layer5 Docs Tokens page in dark mode. It includes the callout “API Tokens are User-Scoped. Not Organization-Scoped”, a “Privilege Scoping” section explaining identity-scoped token permissions and the lack of fine-grained token-specific scopes, the left navigation with Tokens selected, an On this page panel, and an
The privileged workflow continues to avoid checking out or executing untrusted PR code, and 🐇✨ |
|
Tip For best results, initiate chat on the files or code changes.
Thanks for the thorough follow-up. The unprivileged artifact build, run-ID-based artifact retrieval and PR-number resolution, open-PR guard, credential-free checkout, and strict 🐇 ✅ |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
for workflow in \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml
do
echo "--- ${workflow} ---"
if [ -f "$workflow" ]; then
nl -ba "$workflow"
else
echo "Missing workflow: $workflow"
fi
done
echo '--- Relevant workflow configuration ---'
rg -n -C 4 \
'workflow_run|pull_request_target|pull_request:|permissions:|actions: read|actions/download-artifact|run-id:|github\.event\.workflow_run\.id|PR_NUMBER|pull_requests|actions/github-script|state.*open|persist-credentials|npm ci|allow-unsafe-pr-checkout|if:' \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml || true
echo '--- Diff against merge base ---'
base="$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD^)"
git diff "$base" HEAD -- \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml || trueLength of output: 1342 🏁 Script executed: #!/bin/bash
set -eu
for workflow in \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml
do
echo "--- ${workflow} ---"
if [ -f "$workflow" ]; then
awk '{ printf "%5d %s\n", NR, $0 }' "$workflow"
else
echo "Missing workflow: $workflow"
fi
done
echo '--- Relevant workflow configuration ---'
rg -n -C 4 \
'workflow_run|pull_request_target|pull_request:|permissions:|actions: read|actions/download-artifact|run-id:|github\.event\.workflow_run\.id|PR_NUMBER|pull_requests|actions/github-script|state.*open|persist-credentials|npm ci|allow-unsafe-pr-checkout|if:' \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml 2>/dev/null || true
echo '--- Diff against merge base ---'
base="$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD^ 2>/dev/null || true)"
if [ -n "$base" ]; then
git diff "$base" HEAD -- \
.github/workflows/build-and-preview-docs.yml \
.github/workflows/build-pr-preview.yml || true
else
echo 'Could not determine a merge base.'
fiLength of output: 35608 The Comment image shows the Layer5 Docs Tokens page in dark mode. It includes the “API Tokens are User-Scoped. Not Organization-Scoped” callout, the “Privilege Scoping” section explaining identity-scoped permissions and the absence of fine-grained token-specific scopes, Tokens selected in the sidebar, the On this page table of contents, and an
The privileged workflow does not check out or execute untrusted PR code, and 🐇✨ |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/build-and-preview-docs.yml (1)
16-17: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winConcurrency group keyed on
workflow_run.idno longer serializes deploys per PR.
github.event.workflow_run.idis unique per triggering run, so everyworkflow_run-triggered job gets its own singleton concurrency group — this effectively disables concurrency control for the primary trigger path. Rapid successive pushes to the same PR (each producing a separate build → separateworkflow_run.id) can now run deploy jobs concurrently, racing on the samegh-pagesbranch: both thepr-preview-actiondeploy step and thegit commit/pushin "Prune old PR previews" (lines 134-138) write to that branch, so overlapping runs can hit push conflicts or non-deterministic preview content.This may have been chosen to dodge the forked-PR case where
pull_requests[0].numberis empty (which would otherwise collapse unrelated PRs into the same empty-string group) — butgithub.event.workflow_run.head_shais reliably populated even for forked PRs and avoids both problems: it groups reruns of the same commit together without merging unrelated PRs.♻️ Suggested fix
concurrency: - group: preview-${{ github.event.workflow_run.id || github.event.pull_request.number || github.run_id }} + group: preview-${{ github.event.workflow_run.head_sha || github.event.pull_request.number || github.run_id }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-and-preview-docs.yml around lines 16 - 17, Update the concurrency group expression in the workflow to use github.event.workflow_run.head_sha as the workflow_run-specific key, with the existing pull_request.number and github.run_id fallbacks preserved for other trigger types. This must serialize jobs for the same commit while keeping unrelated forked-PR runs in separate groups.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/build-and-preview-docs.yml:
- Around line 16-17: Update the concurrency group expression in the workflow to
use github.event.workflow_run.head_sha as the workflow_run-specific key, with
the existing pull_request.number and github.run_id fallbacks preserved for other
trigger types. This must serialize jobs for the same commit while keeping
unrelated forked-PR runs in separate groups.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4f1c1ea9-c7db-4ea2-aad9-9100ed3fceef
📒 Files selected for processing (2)
.github/workflows/build-and-preview-docs.yml.github/workflows/build-pr-preview.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/build-pr-preview.yml
1 participant
Description
This PR resolves Issue #378 by explicitly clarifying how API authentication tokens handle privileges in Layer5.
Changes Made
ScreenShot
Closes #378
Summary by CodeRabbit