fix(reusable-ci): drop unsatisfiable permissions elevation on ai-review#10
Conversation
A reusable workflow cannot elevate permissions beyond what the caller grants. The ai-review job declared 'permissions: pull-requests: write' but consumer workflows (e.g. chittyos/chittyentity/.github/workflows/ci.yml) do not grant it on the calling job. Org default is read-only, so GitHub Actions rejects with startup_failure at instantiation — no jobs run, no logs, no annotations. Fix: remove the permissions block. Document in a comment how callers can opt-in to AI-review PR comments by declaring permissions on the calling job. lint/test/security run fine with default read-only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 22 minutes and 29 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Follow-up to #8 (YAML indentation) and #9 (env scope). After both, consumer runs were still 0s startup_failure. Root cause: the ai-review job declared 'permissions: pull-requests: write', but reusable workflows cannot elevate permissions beyond the caller. chittyos/chittyentity's ci.yml doesn't grant it on the calling job, so GitHub rejects the run at instantiation. ci.yml on chittyentity has 100 consecutive failures dating to January 2026 -- it has literally never scheduled a job. This PR removes the permissions block and documents how callers can opt in.