fix(ci): clarify selective E2E scorecards#3735
Merged
jyaunches merged 1 commit intoMay 19, 2026
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR makes the nightly-e2e scorecard dispatch-aware (parses workflow_dispatch inputs, identifies selective dispatch, conditionally omits trend fetching, and annotates run mode/requested jobs), refocuses the validation test to internal workflow consistency, and shortens ChangesSelective E2E Dispatch Support
Sequence DiagramsequenceDiagram
participant GitHubEvent as GitHub Event
participant Scorecard as Scorecard Script
participant GitHubAPI as GitHub API
participant Output as Scorecard Output
GitHubEvent->>Scorecard: github.event_name, inputs.jobs
alt github.event_name == 'workflow_dispatch'
Scorecard->>Scorecard: parse inputs.jobs -> requestedJobs
Scorecard->>Scorecard: isSelectiveDispatch = requestedJobs < allNightlyJobs
alt isSelectiveDispatch
Scorecard->>Output: prepend "Run mode: selective dispatch"
Scorecard->>Output: include requestedJobs list
Scorecard->>Output: "trend not shown"
else manual full run
Scorecard->>Output: prepend "Run mode: manual full run"
Scorecard->>GitHubAPI: fetch recent scheduled completed runs (trend)
GitHubAPI->>Scorecard: recent run data
Scorecard->>Output: add trend label (stable/improving/degrading)
end
else scheduled run
Scorecard->>Output: prepend "Run mode: scheduled full nightly"
Scorecard->>GitHubAPI: fetch recent scheduled completed runs (trend)
GitHubAPI->>Scorecard: recent run data
Scorecard->>Output: add trend label (stable/improving/degrading)
end
Scorecard->>Output: add job counters (run/pass/fail/cancel/skipped)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/nightly-e2e.yaml:
- Line 2319: The embedded workflow input is not escaped and may break JS
parsing; change the interpolation that sets requestedJobsRaw (variable
requestedJobsRaw) to serialize the input safely before embedding by replacing
the direct '${{ inputs.jobs }}' insertion with a JSON-escaped form (use the
existing safe pattern `${{ toJSON(inputs.jobs) }}`) so the resulting
single-quoted JS string cannot be broken by quotes or backslashes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f814b290-e5ee-46fe-8970-2e8778121357
📒 Files selected for processing (3)
.coderabbit.yaml.github/workflows/nightly-e2e.yamltest/validate-e2e-coverage.test.ts
772e8e9 to
c85bf37
Compare
cv
approved these changes
May 18, 2026
c85bf37 to
020ca85
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/nightly-e2e.yaml (1)
2334-2334:⚠️ Potential issue | 🟠 Major | ⚡ Quick winEscape
inputs.jobsbefore embedding into JavaScript.Line 2334 directly injects workflow input into a JS single-quoted string. A quote/backslash in dispatch input can break script parsing and fail the scorecard step.
🔧 Proposed fix
- const requestedJobsRaw = isDispatch ? '${{ inputs.jobs }}'.trim() : ''; + const requestedJobsRaw = isDispatch ? (${{ toJSON(inputs.jobs) }} || '').trim() : '';#!/bin/bash set -euo pipefail # Verify unsafe direct interpolation and safe toJSON pattern usage. rg -n -C2 "\\$\\{\\{\\s*inputs\\.jobs\\s*\\}\\}" .github/workflows/nightly-e2e.yaml rg -n -C2 "toJSON\\(inputs\\.jobs\\)" .github/workflows/nightly-e2e.yaml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/nightly-e2e.yaml at line 2334, The injected workflow input in the assignment to requestedJobsRaw uses a raw single-quoted interpolation and can be broken by quotes/backslashes in inputs.jobs; update the expression that sets requestedJobsRaw (the isDispatch ? '${{ inputs.jobs }}'.trim() : '' branch) to use GitHub Actions' toJSON escaping (e.g., ${{ toJSON(inputs.jobs) }}) so the value is safely escaped for embedding in JavaScript and remove the surrounding literal quotes so .trim() operates on the properly escaped string.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/nightly-e2e.yaml:
- Line 2334: The injected workflow input in the assignment to requestedJobsRaw
uses a raw single-quoted interpolation and can be broken by quotes/backslashes
in inputs.jobs; update the expression that sets requestedJobsRaw (the isDispatch
? '${{ inputs.jobs }}'.trim() : '' branch) to use GitHub Actions' toJSON
escaping (e.g., ${{ toJSON(inputs.jobs) }}) so the value is safely escaped for
embedding in JavaScript and remove the surrounding literal quotes so .trim()
operates on the properly escaped string.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 700bebf9-c96e-43c8-af16-355072fe7f3e
📒 Files selected for processing (3)
.coderabbit.yaml.github/workflows/nightly-e2e.yamltest/validate-e2e-coverage.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- .coderabbit.yaml
- test/validate-e2e-coverage.test.ts
06a2aa7 to
271bacd
Compare
271bacd to
c9c2371
Compare
This was referenced May 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Summary by CodeRabbit
Improvements
Chores
Tests