feat(ci): add upstream repository dispatch trigger for doc-sync bot (#320)#515
Open
ravencore06 wants to merge 1 commit into
Open
feat(ci): add upstream repository dispatch trigger for doc-sync bot (#320)#515ravencore06 wants to merge 1 commit into
ravencore06 wants to merge 1 commit into
Conversation
ravencore06
requested review from
chaitanyaenr,
paigerube14 and
shahsahil264
as code owners
✅ Deploy Preview for krkn-chaos ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Review Summary by QodoAdd upstream repository dispatch trigger for doc-sync bot
WalkthroughsDescription• Add repository_dispatch workflow to listen for upstream repository merges • Trigger doc-sync bot preparation when upstream PRs merge • Automatically invoke search index rebuild via native CI • Establish foundation for future LLM-based documentation generation Diagramflowchart LR
upstream["Upstream Repo<br/>krkn/krkn-hub/krknctl"]
dispatch["repository_dispatch<br/>upstream_pr_merged"]
trigger["upstream-doc-trigger.yml<br/>Workflow"]
llm["Doc Sync Bot<br/>LLM Script"]
rebuild["rebuild-docs-index.yml<br/>Workflow"]
upstream -- "PR Merged" --> dispatch
dispatch --> trigger
trigger --> llm
trigger --> rebuild
File Changes1. .github/workflows/upstream-doc-trigger.yml
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
24 rules 1. Run Doc Sync Bot stub
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+25
to
+29
| # (This is where your future LFX Mentorship LLM Python script will run) | ||
| - name: Run Doc Sync Bot (Stub) | ||
| run: | | ||
| echo "LLM Agent parses changes here and generates markdown files." | ||
|
|
There was a problem hiding this comment.
1. run doc sync bot stub 📎 Requirement gap ≡ Correctness
The new upstream trigger workflow does not actually evaluate documentation impact; it only echoes a placeholder message. This fails the requirement to run an evaluation step when upstream merges occur, so doc-sync decisions cannot be made automatically.
Agent Prompt
## Issue description
The workflow is triggered but does not evaluate whether upstream changes require documentation updates.
## Issue Context
Compliance requires a post-merge trigger for upstream repos that includes a concrete evaluation step (not a stub) to determine doc impact.
## Fix Focus Areas
- .github/workflows/upstream-doc-trigger.yml[18-29]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+25
to
+36
| # (This is where your future LFX Mentorship LLM Python script will run) | ||
| - name: Run Doc Sync Bot (Stub) | ||
| run: | | ||
| echo "LLM Agent parses changes here and generates markdown files." | ||
|
|
||
| # Triggering the neighboring workflow directly using your CI expertise! | ||
| - name: Trigger Native Search Index Rebuild | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| echo "Triggering rebuild-docs-index.yml..." | ||
| gh workflow run rebuild-docs-index.yml |
There was a problem hiding this comment.
2. No draft pr creation 📎 Requirement gap ≡ Correctness
The new workflow never creates a draft PR in krkn-chaos/website with generated documentation changes. Without a PR creation step and a clear summary of changes, documentation updates cannot be proposed in a reviewable way.
Agent Prompt
## Issue description
The workflow does not open a draft PR containing generated doc updates, nor does it produce review-friendly attribution/summary in a PR body.
## Issue Context
Compliance requires automatically proposing doc updates via a draft PR and making that PR review-friendly by linking to the upstream trigger and summarizing changed documentation.
## Fix Focus Areas
- .github/workflows/upstream-doc-trigger.yml[25-36]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+4
to
+13
| on: | ||
| repository_dispatch: | ||
| types: [upstream_pr_merged] | ||
|
|
||
| jobs: | ||
| prepare-doc-sync: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| actions: write |
There was a problem hiding this comment.
3. Unrestricted dispatch trigger 🐞 Bug ⛨ Security
The workflow runs for any repository_dispatch event of type upstream_pr_merged without validating sender or client_payload.repository, so any caller who can dispatch this event can trigger privileged CI work (including starting other workflows). This increases abuse risk and makes future “doc sync bot” steps unsafe to add without additional guards.
Agent Prompt
## Issue description
`upstream-doc-trigger.yml` accepts any `repository_dispatch` with type `upstream_pr_merged` and proceeds without validating the sender identity or ensuring the payload repo is one of the intended upstream repositories. Because this job also has `actions: write`, a dispatch caller can cause chained workflow runs.
## Issue Context
This workflow is intended to be triggered only by known upstream repos (krkn, krkn-hub, krknctl, etc.). Currently the payload is only echoed and never used to gate execution.
## Fix Focus Areas
- .github/workflows/upstream-doc-trigger.yml[4-36]
## Suggested fix
1. Add a job-level `if:` guard (or an early validation step that exits non-zero) that:
- Fails when `github.event.client_payload.repository` is missing.
- Allows only an explicit allowlist of upstream repositories.
- Optionally allows only an explicit allowlist of dispatch senders (e.g., a bot user) via `github.event.sender.login`.
2. Consider splitting into two jobs so only the job that calls `gh workflow run` gets `actions: write`.
Example pattern (illustrative):
- `if: contains(fromJson('["krkn-chaos/krkn","krkn-chaos/krkn-hub","krkn-chaos/krknctl"]'), github.event.client_payload.repository)`
- Validation step using `set -euo pipefail` and emitting `::error::` on unexpected sender/repo.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
ci: fix qodo security and permission issues Signed-off-by: ravencore06 <srinidhisadhanala@gmail.com>
github-actions
Bot
removed
the
needs-dco
Author
|
Hello @rh-rahulshetty, @chaitanyaenr, @paigerube14, and @shahsahil264, Here is a summary of the key enhancements introduced in this Pull Request for the Doc Sync Bot (#320): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As part of my LFX Mentorship application for the Automated Doc Sync Bot (Issue #320), I noticed that before we even run an LLM to generate documentation, the system first needs a reliable way to know when upstream code actually changes.
Instead of jumping straight to the LLM generation script, this PR lays the CI/CD groundwork. It adds a
repository_dispatchworkflow that listens for upstream merges from repos likekrkn,krkn-hub, andkrknctlto trigger the future bot.Furthermore, instead of relying on external Netlify webhooks, I integrated this natively with our existing architecture. It automatically triggers the neighboring
.github/workflows/rebuild-docs-index.ymlaction using theghCLI.Since I recently fixed the search index build script to report skipped files in PR #439, this setup guarantees that whenever the future AI bot generates new markdown, the site's search index will automatically and cleanly rebuild using our native CI.