Fix grumpy-reviewer checkout (PR-branch fetch fails: not a git repository) - #16617
Merged
Conversation
The grumpy-reviewer workflow shipped in #16616 set `checkout: false`, but the imported agent uses local-file tools (read/search), so gh-aw injects a "Checkout PR branch" step (git fetch +refs/pull/N/head). With no base checkout there is no .git, so that step fails on every PR: fatal: not a git repository (or any of the parent directories): .git The process '/usr/bin/git' failed with exit code 128 Removing `checkout: false` restores the base actions/checkout (persist-credentials: false) before the PR-branch fetch. Verified end-to-end via `gh aw trial` (agent job succeeds, grumpy inline review comments produced). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Deploying care-preview with
|
| Latest commit: |
e1cdc46
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://64acfe99.care-preview-a7w.pages.dev |
| Branch Preview URL: | https://grumpy-reviewer-checkout-fix.care-preview-a7w.pages.dev |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
WalkthroughChangesGrumpy Reviewer workflow
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🎭 Playwright Test ResultsStatus: ⏭️ Skipped No test-related files were changed in this PR. Tests are skipped when changes don't affect:
Run: #10554 |
bodhish
approved these changes
Jul 31, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes the failing grumpy-reviewer agentic workflow by ensuring the agent job runs inside a valid git repository before gh-aw’s injected “Checkout PR branch” fetch step.
Changes:
- Removed
checkout: falsefrom the workflow source so the compiled workflow performs a baseactions/checkoutfirst. - Regenerated the compiled workflow (
.lock.yml), which now includes “Checkout repository” (withpersist-credentials: false) before “Checkout PR branch”.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/grumpy-reviewer.md | Removes the checkout: false override so checkout is enabled (default), allowing PR-branch fetch to succeed. |
| .github/workflows/grumpy-reviewer.lock.yml | Compiled output updated to include base checkout + git credential configuration prior to PR-branch checkout. |
Comment on lines
33
to
36
| # Actions GITHUB_TOKEN, and gh-aw injects the needed write scopes into the | ||
| # separate safe-output jobs while this agent job stays read-only. | ||
| permissions: read-all | ||
| # No local clone is needed: the agent reads the PR diff and changed files through | ||
| # the GitHub API. Disabling checkout removes the "pwn request" attack surface that | ||
| # comes from checking out untrusted fork code under pull_request_target. | ||
| checkout: false | ||
| imports: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
grumpy-revieweragentic workflow added in #16616 is failing on every PR it triggers on. Example runs ondevelop: #16612, #16610, #16579 — all fail at the Checkout PR branch step with:This is not a token problem — the
activationjob (which validatesCOPILOT_GITHUB_TOKEN) passes in ~19s. The failure is in theagentjob.Cause
#16616 shipped the workflow with
checkout: false. That was based on the assumption that the agent reads everything through the GitHub API. But the importedgrumpy-revieweragent uses local-file tools (read/search), so gh-aw injects a Checkout PR branch step that runsgit fetch origin +refs/pull/N/head. Withcheckout: falsethere is no baseactions/checkout, so there is no.gitdirectory and the fetch aborts with exit 128.Fix
Remove
checkout: falsefrom.github/workflows/grumpy-reviewer.mdand recompile. The compiledagentjob now runs the baseCheckout repository(actions/checkout,persist-credentials: false) before the injectedCheckout PR branchfetch, so the PR head is fetched into a valid git repo.Two files change: the source
.md(4 lines removed) and the generated.lock.yml(gh aw compile, v0.80.9).Security note
Enabling checkout under
pull_request_targetbrings back the compiler's advisory "pwn request" warning. It's acceptable here: the agent job is read-only (permissions: read-all), never executes untrusted PR code (only reads files + calls the GitHub MCP / Copilot inference in gh-aw's firewalled sandbox), and every write is confined to the separate permission-scoped safe-output jobs.Testing
Verified end-to-end with
gh aw trial(simulatinggithub.repository = ohcnetwork/care_fe, real PR trigger context). The full run is green:activation✓ →agent✓ (2m26s) →detection✓ →safe_outputs✓. The agent checked out the PR, reviewed the changed lines, and produced grumpy-but-constructive inline review comments plus a consolidatedCOMMENTreview (captured as safe-outputs, not posted to any real PR).Compile: 0 errors, 1 advisory warning (the pwn note above). No app build/test run — workflow config only.
Summary by CodeRabbit