[kixelated]

Completes Read-only CI and deletes its quest.

Summary

• CI check on the setup page (cloudflare/src/github/ci.ts). The setup page at /projects/github/<owner>/<repo>, which a maintainer uses to enable and later pause contributions, now has a "Pull-request CI" panel. So does that page's form for a repository without Quest files, which opens the setup pull request (moq-dev/quest#431), since merging it enables contributions. It reports:

  • a default GITHUB_TOKEN that can write;
  • repository secrets, and organization secrets shared with the repository, listed by name;
  • environments that hold secrets and let a branch GitHub doesn't report as protected deploy (no policy; "protected branches" while no branch is protected; or selected patterns naming a wildcard or an unprotected branch).

  It only warns: enabling still works and jobs still run. A failed read shows up as its own warning, and an installation that hasn't accepted the new permissions gets a warning naming them. The whole check is capped at 30 reads so the page fits Workers Free's 50 subrequests, and it says when it stopped early.

• App permissions. The manifest adds Administration, Secrets, Actions, and Environments, all read-only. They join the setup-page token only when the installation has granted them (#withInstallation's new optional scope). No other operation's token changes. GITHUB.md's permissions table and operator setup list them, and existing registrations add them as an operator step.

• Trust by stage. cloudflare/GITHUB.md gains a table covering intake, job creation, routing, devShell, agent run, publication, CI, review, and land. It says what each stage trusts and why. A new "Read-only pull-request CI" section states the rule and the check, replacing the old one-paragraph rule.

• Runner contradiction fixed. cloudflare/README.md and the root README now agree. kix routes untrusted heads only to Linux runners whose owner declared vm: true at POST /api/runners, and kix doesn't verify that claim. quest runner login never declares it, so such jobs wait for a runner that does; a runner that declares it without being able to build in a VM is still sent the job, and quest runner fails it rather than run it.

• SETUP.md recommends read-only pull-request CI next to its advice about drafts.

• Pilot condition moved. The requirement that pilot repositories pass the check before contributors are invited moves to Operator setup, with what gh api showed on 2026-11-02. The moq-dev org shares DISCORD_WEBHOOK with both pilots. moq-dev/moq has 18 repository secrets. Its environments name only protected branches, merge-queue branches, and tags.

• The seeded dev GitHub fake (cloudflare/dev/github.ts) grants the new permissions and models a clean repository, so just worker-seeded shows the panel.

Choices made without asking

• Administration (read) is the only App permission that can read the default workflow token setting, so the check requests it. Only the setup page's token carries it.
• Selected-branch policies pass only when each branch pattern is a literal protected branch, or gh-readonly-queue/<protected>/*, the merge queue's own branches. Wildcards are reported, because a same-repository PR head, which kix iterates, can be any unprotected branch. Tag patterns pass, because kix never writes tags.
• "Protected" means what GitHub reports on the branch: rulesets or classic protection. This matches GitHub's own "Protected branches only" deployment option.
• Required reviewers on an environment don't count as a limit. A reviewer approves a deployment, not the code on a job branch.
• Organization secrets shared with the repository are reported alongside repository secrets. They reach same-repository branches the same way, and moq-dev shares one with both pilots.
• Workflow files aren't parsed. The panel reminds the maintainer that jobs asking for write permissions:, and pull_request_target/workflow_run jobs that check out a PR head, fall under the same rule.

Suggested follow-ups

• Workflow-file check. Read .github/workflows and flag jobs that pull_request or unfiltered push triggers when they request write permissions:, reference secrets outside an environment, or are pull_request_target/workflow_run jobs that check out the PR head. The default-token setting doesn't cover a job's own permissions: block.
• Classic protection in the review rule. Now that the App has Administration (read), landing could read classic branch protection's review settings instead of keeping its own check (cloudflare/src/github/review.ts). That widens the landing token's scope, so it needs its own decision.

Review

mechanical fix by codex / Codex: Merged base and re·solved the import conflict preserving CI and review helpers; passed bun run build, bun run check, bun run test at root and bun run check, bun run test in cloudflare. (head bae858f)

• Reviewer: Codex, gpt-6.1-sol, medium effort (quest review)
• Reviewed head: 48f7533; the current head 53fb287 adds only a conflict-free merge of origin/main (moq-dev/quest#432, moq-dev/quest#411, moq-dev/quest#410), which the guide exempts.
• New session, run from a local alias branch because the PR branch is checked out in another worktree.
• Round 1 (597c5f3, after merging main's setup PR, moq-dev/quest#431): one finding, fixed in 48f7533. A repository without Quest files hit NoQuestFiles before the CI check ran, so the setup-PR form showed no CI warnings even though merging that PR enables contributions. previewProject now runs the check on the same token and throws NoQuestFiles carrying its warnings, and QuestSetupPage renders the shared CIPanel. Tests cover both the warning on that page (projects.test.ts) and the dev fake's clean result (setup.test.ts). GITHUB.md names that page too.
• Round 2 (48f7533, which also merged moq-dev/quest#407 without conflict): no findings.
• 597c5f3 merged origin/main by hand. Its one conflict was quest/m1/kix/README.md's Required list, where main had finished the setup-PR quest and this PR finishes its own, so both lines go. The rest merged cleanly, and the PR's added and removed lines are unchanged.
• Earlier sessions: 5fa3ef1 had no findings (it fixed CodeRabbit's finding on what an unverified vm: true runner does; quest runner fails such a job at src/runner/job.ts:194). 8d48990's hand merge of head approvals (moq-dev/quest#402) and runner review checks (moq-dev/quest#417) had no findings. On 445647f, protected branches read only the first page (fixed with lookups by name); branch lookups could exceed the subrequest budget (fixed with one 30-read budget).

Local checks: just check and just test pass on 53fb287.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 21f60681-b3f1-41fd-93c2-a8eb402f7dcb

Walkthrough

The project preview now checks GitHub Actions workflow permissions, repository and organization secrets, and environment deployment policies. It reports findings on the setup page without blocking the contribution form or jobs. The GitHub App requests additional read permissions for these checks. Documentation also updates CI setup guidance and describes runner trust constraints.

Merge Risk: Low · previous review 8d489

The runner guidance may benefit from clarifying what happens after an incorrect VM declaration. This bounded documentation concern does not appear to block merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly summarizes the main changes: warnings for writable pull-request CI and documentation of trust by stage.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description is specific and on-topic. It names the files touched (cloudflare/src/github/ci.ts, GITHUB.md, the setup page, the manifest, the dev fake) and explains the Read-only CI check, its App p…

Full details: Description check

Explanation

The description is specific and on-topic. It names the files touched (cloudflare/src/github/ci.ts, GITHUB.md, the setup page, the manifest, the dev fake) and explains the Read-only CI check, its App permissions, the trust-by-stage table, the runner README fix, and the pilot-condition move. Its content matches the raw summary and the objectives, so the check passes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 6 functions across 5 files. (6 skipped: 6 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4a19707e-0fd1-4e92-bdad-3503c20c1e13

Commits

Reviewing files that changed from the base of the PR and between 0b6fa16 and 8d48990.

Files selected for processing: 13

• README.md
• SETUP.md
• cloudflare/GITHUB.md
• cloudflare/README.md
• cloudflare/dev/github.ts
• cloudflare/github-app-manifest.json
• cloudflare/src/github/ci.ts
• cloudflare/src/github/service.ts
• cloudflare/src/projects.tsx
• cloudflare/test/projects.test.ts
• quest/m0/kix/operator-setup.md
• quest/m1/kix/README.md
• quest/m1/kix/ci-read-only.md

Files with no reviewable changes: 2

• quest/m1/kix/README.md
• quest/m1/kix/ci-read-only.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR

[moq-bot]

quest land watch: the merge queue removed this pull request at 53fb287 because it conflicts with main (merge_conflict).

The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs.

(written by quest land watch)

[moq-bot]

quest land watch: armed auto-merge on this pull request at bae858f, so it joins the back of the merge queue once its required checks pass, with the land fixer's fix (codex / Codex): Merged base and re·solved the import conflict preserving CI and review helpers; passed bun run build, bun run check, bun run test at root and bun run check, bun run test in cloudflare..

(written by quest land watch)