ci: add silent-close shim to altimate-qa watchdog (migration item 12)#1930
Conversation
Cross-repo notification shim that fires a `repository_dispatch` to
AltimateAI/altimate-qa whenever a PR closes here, so the silent-close
watchdog can react in seconds instead of waiting up to 5 minutes for
its cron tick.
What this is
------------
- Triggers on `pull_request: closed` events.
- Sends `event_type=pr-closed` with `{repo, pr_number, closed_by,
was_merged, title}` payload to AltimateAI/altimate-qa.
- Self-disables (warning, exit 0) if `AUTOPILOT_DISPATCH_TOKEN` is
not set on this repo. Never fails the PR.
Why
---
Reference incident: 2026-04-29 12:24 UTC silent bulk-close (47 PRs in
90s, 6 fix PRs lost). The watchdog already existed but ran on a 5-min
cron — up to 5 minutes of fix-PR loss before the reopener fired. This
shim closes that gap to ~20s end-to-end.
The receiving end is altimate-qa PR #366
(feat/silent-close-webhook-shims): adds a `repository_dispatch`
trigger to silent-close-watchdog.yml and a `--single-pr` fast path in
the reopener script.
Setup needed
------------
After merge: add `AUTOPILOT_DISPATCH_TOKEN` (PAT or App token with
`repo` scope on AltimateAI/altimate-qa) to this repo's Actions
secrets at github.com/AltimateAI/<repo>/settings/secrets/actions.
Until that's done the workflow runs but exits early — no harm.
Test plan
---------
- [ ] After merge + secret set: force-close a test PR here, observe
a dispatch run on altimate-qa within ~20s
- [ ] Confirm the cron sweep on altimate-qa still runs (5-min
schedule unchanged) so partial rollouts don't break detection
Reference: AltimateAI/altimate-qa templates/cross-repo-shims/README.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
WalkthroughAdds a new GitHub Actions workflow that monitors pull request closure events and dispatches a repository event to the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/silent-close-shim.yml:
- Around line 17-20: Change the workflow trigger from pull_request to
pull_request_target so repository secrets like AUTOPILOT_DISPATCH_TOKEN are
available for fork PRs; update the on: pull_request block (the event that
currently prevents secrets for fork-origin PRs) to on: pull_request_target and
keep the existing dispatch step that uses AUTOPILOT_DISPATCH_TOKEN unchanged so
the fast-close dispatch (the job that runs the dispatch using
AUTOPILOT_DISPATCH_TOKEN) will run for fork PRs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a08cfaec-6b51-4d4d-a1d0-bd5918546add
📒 Files selected for processing (1)
.github/workflows/silent-close-shim.yml
| on: | ||
| pull_request: | ||
| types: [closed] | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For GitHub Actions, are repository secrets available to workflows triggered by pull_requestfrom forks whentypes: [closed]is used, and doespull_request_target provide access to those secrets for the same event?
💡 Result:
No, repository secrets are not available to workflows triggered by pull_request from forks, even when types: [closed] is used. Yes, pull_request_target provides access to those secrets for the same event.
Citations:
- 1: https://docs.github.com/actions/security-guides/using-secrets-in-github-actions
- 2: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
- 3: https://stackoverflow.com/questions/76952023/how-to-make-github-actions-safely-access-secrets-for-prs-created-from-forks
- 4: https://www.paulserban.eu/blog/post/pullrequest-vs-pullrequesttarget-the-github-actions-trigger-hiding-a-security-nightmare/
- 5: https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md
🏁 Script executed:
cat -n .github/workflows/silent-close-shim.ymlRepository: AltimateAI/vscode-dbt-power-user
Length of output: 3028
pull_request trigger disables the shim for fork PRs due to missing secrets
On line 17 and line 37, this workflow depends on a secret (AUTOPILOT_DISPATCH_TOKEN) during a pull_request event. For fork-origin PRs, repository secrets are unavailable, causing lines 44–47 to skip dispatch and lose the fast-close signal for those PRs.
Suggested change
-on:
- pull_request:
- types: [closed]
+on:
+ pull_request_target:
+ types: [closed]Since this job does not checkout or execute PR code, pull_request_target is a low-risk way to restore coverage and ensure secrets are available for fork PRs.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| pull_request: | |
| types: [closed] | |
| on: | |
| pull_request_target: | |
| types: [closed] | |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/silent-close-shim.yml around lines 17 - 20, Change the
workflow trigger from pull_request to pull_request_target so repository secrets
like AUTOPILOT_DISPATCH_TOKEN are available for fork PRs; update the on:
pull_request block (the event that currently prevents secrets for fork-origin
PRs) to on: pull_request_target and keep the existing dispatch step that uses
AUTOPILOT_DISPATCH_TOKEN unchanged so the fast-close dispatch (the job that runs
the dispatch using AUTOPILOT_DISPATCH_TOKEN) will run for fork PRs.
Bundle Size Reportdarwin-arm64: 74.2 MB
linux-x64: 75.9 MB
win32-x64: 76.8 MB
|
✅ Tests — All Passed |
2 participants
Summary
Cross-repo notification shim that fires
repository_dispatchto AltimateAI/altimate-qa whenever a PR closes here, so the silent-close watchdog can react in seconds instead of waiting up to 5 minutes for its cron tick.What this does
pull_request: closedevents.event_type=pr-closedwith{repo, pr_number, closed_by, was_merged, title}payload to AltimateAI/altimate-qa.AUTOPILOT_DISPATCH_TOKENsecret is not set on this repo. Never fails the PR.Why
Reference incident: 2026-04-29 12:24 UTC silent bulk-close (47 PRs in 90s, 6 fix PRs lost). The watchdog already exists in altimate-qa but ran on a 5-min cron — up to 5 minutes of fix-PR loss before the reopener fired. This shim closes that gap to ~20s end-to-end.
The receiving end is altimate-qa PR #366 which adds the
repository_dispatchtrigger tosilent-close-watchdog.ymland a--single-prfast path to the reopener script. That PR should land before this one is wired up (until it does, the dispatch is a no-op on the receiving end).Setup needed (after merge)
Add
AUTOPILOT_DISPATCH_TOKENsecret to this repo's Actions settings:github.com/AltimateAI/<this-repo>/settings/secrets/actionsToken must have
reposcope onAltimateAI/altimate-qaso the dispatch endpoint accepts it. PAT or App token both work.Test plan
AUTOPILOT_DISPATCH_TOKENsecret hereReference
templates/cross-repo-shims/README.mdin altimate-qa🤖 Generated with Claude Code
Summary by CodeRabbit