Add upstream release watcher (workload-identity auth) - #6
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Swap static ANTHROPIC_API_KEY for OIDC/WIF: add id-token: write and the anthropic_federation_* inputs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
WalkthroughAdds a scheduled and manual workflow that detects newer upstream XGBoost releases, prepares header diffs and checksums, invokes Claude for constrained repository edits, and creates a labeled version-specific pull request. ChangesUpstream release automation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant GitHubActions
participant XGBoost
participant Claude
participant GitHubPR
Scheduler->>GitHubActions: Trigger weekly or manual workflow
GitHubActions->>XGBoost: Fetch latest release and headers
XGBoost-->>GitHubActions: Return release tag and header files
GitHubActions->>GitHubActions: Compare versions and check open PRs
GitHubActions->>Claude: Provide diff, checksums, and edit constraints
Claude->>GitHubActions: Write repository edits and PR body
GitHubActions->>GitHubPR: Create labeled version-specific pull request
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/upstream-release.yml:
- Around line 19-22: Add issues: write to the workflow permissions and update
the label-management commands around gh label create to surface failures instead
of swallowing them with || true. Verify label creation succeeds with the default
GITHUB_TOKEN before allowing create-pull-request to rely on the dependencies and
upstream-release labels.
- Around line 57-69: Update the “Skip if an update PR is already open” step to
pass the latest-version value through its env block, then construct BRANCH from
the quoted shell environment variable instead of directly interpolating the
GitHub Actions expression in run. Preserve the existing branch value and PR
lookup behavior; do not address the separate concurrency suggestion.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e5902e0c-a5c9-41c4-81f4-13dc82a293a4
📒 Files selected for processing (1)
.github/workflows/upstream-release.yml
| permissions: | ||
| id-token: write # fetch the GitHub OIDC token for Anthropic WIF | ||
| contents: write # minimum GitHub allows for creating a PR branch | ||
| pull-requests: write # open/update the PR |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Label creation may silently fail, breaking the labels applied to the final PR.
permissions: (lines 19-22) grants contents, pull-requests, and id-token, but not issues. Repository label management (gh label create, lines 173-174) is exposed under the Issues API, and per community reports even issues: write on GITHUB_TOKEN does not reliably allow creating/updating labels — only a PAT/App token with broader repo write access does. Since the failures here are swallowed by || true, if label creation fails the dependencies/upstream-release labels won't exist, and create-pull-request (line 185) referencing those same label names could then fail or silently drop them, undermining a stated goal of the workflow (labeled PR).
Recommend: add issues: write to permissions: and re-verify gh label create succeeds with the default GITHUB_TOKEN, or drop the || true temporarily to surface the real failure mode before relying on it silently.
#!/bin/bash
# Check whether GITHUB_TOKEN with issues:write can manage repo labels (background reading)
gh api graphql -f query='{ __type(name: "Repository") { name } }' >/dev/null 2>&1; echo doneAlso applies to: 168-186
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/upstream-release.yml around lines 19 - 22, Add issues:
write to the workflow permissions and update the label-management commands
around gh label create to surface failures instead of swallowing them with ||
true. Verify label creation succeeds with the default GITHUB_TOKEN before
allowing create-pull-request to rely on the dependencies and upstream-release
labels.
Source: Linters/SAST tools
| - name: Skip if an update PR is already open | ||
| id: existing | ||
| if: steps.versions.outputs.update == 'true' | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| set -euo pipefail | ||
| BRANCH="chore/xgboost-${{ steps.versions.outputs.latest }}" | ||
| if gh pr list --state open --head "$BRANCH" --json number --jq '.[0].number' | grep -q '[0-9]'; then | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "skip=false" >> "$GITHUB_OUTPUT" | ||
| fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Direct ${{ }} expansion into shell string (script injection pattern).
BRANCH="chore/xgboost-${{ steps.versions.outputs.latest }}" interpolates a GitHub Actions expression directly into the run: script rather than through an env var, which is exactly the anti-pattern zizmor flags. latest is derived from the upstream dmlc/xgboost release tag name; while that's a trusted repo today, embedding ${{ }} directly in shell risks arbitrary command injection if that string ever contains shell metacharacters (e.g. via a compromised/malicious upstream tag). The very next step (lines 74-76) already uses the safer pattern (env: + "$VAR") — apply it here too.
🔒 Proposed fix
- name: Skip if an update PR is already open
id: existing
if: steps.versions.outputs.update == 'true'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ LATEST: ${{ steps.versions.outputs.latest }}
run: |
set -euo pipefail
- BRANCH="chore/xgboost-${{ steps.versions.outputs.latest }}"
+ BRANCH="chore/xgboost-${LATEST}"
if gh pr list --state open --head "$BRANCH" --json number --jq '.[0].number' | grep -q '[0-9]'; thenSeparately: this check-then-create pattern also has a benign TOCTOU race against concurrent runs (weekly schedule overlapping a manual dispatch) — consider adding a workflow-level concurrency: group keyed on the job to fully close it.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Skip if an update PR is already open | |
| id: existing | |
| if: steps.versions.outputs.update == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| BRANCH="chore/xgboost-${{ steps.versions.outputs.latest }}" | |
| if gh pr list --state open --head "$BRANCH" --json number --jq '.[0].number' | grep -q '[0-9]'; then | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "skip=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Skip if an update PR is already open | |
| id: existing | |
| if: steps.versions.outputs.update == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| LATEST: ${{ steps.versions.outputs.latest }} | |
| run: | | |
| set -euo pipefail | |
| BRANCH="chore/xgboost-${LATEST}" | |
| if gh pr list --state open --head "$BRANCH" --json number --jq '.[0].number' | grep -q '[0-9]'; then | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "skip=false" >> "$GITHUB_OUTPUT" | |
| fi |
🧰 Tools
🪛 zizmor (1.26.1)
[info] 64-64: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/upstream-release.yml around lines 57 - 69, Update the
“Skip if an update PR is already open” step to pass the latest-version value
through its env block, then construct BRANCH from the quoted shell environment
variable instead of directly interpolating the GitHub Actions expression in run.
Preserve the existing branch value and PR lookup behavior; do not address the
separate concurrency suggestion.
Source: Linters/SAST tools
1 participant
Adds a weekly (and manual) watcher that opens a PR when the upstream library
publishes a newer release than the one pinned in
build.rs. Claude reviews theupstream C API header diff and edits the crate;
peter-evans/create-pull-requestopens the PR. The only remote write is the PR itself.
Auth: Anthropic workload identity federation (OIDC) — no stored API key.
Before this can run, add repo secrets:
ANTHROPIC_FEDERATION_RULE_ID,ANTHROPIC_ORGANIZATION_ID,ANTHROPIC_SERVICE_ACCOUNT_ID(+
ANTHROPIC_WORKSPACE_IDif the federation rule spans multiple workspaces).Note: the federation rule subject should match this repo\x27s default branch once merged.
🤖 Generated with Claude Code
Summary by CodeRabbit