Add AI PR review#17
Conversation
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new GitHub Actions workflow is added to automatically review pull requests using an AI service, triggered on pull request events and review comment creation, with configurable repository permissions and concurrency deduplication rules. ChangesAutomated PR Review Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 48 minutes and 39 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ai-pr-reviewer.yml:
- Around line 8-10: The workflow currently triggers on "pull_request" without a
types filter which fires for all PR lifecycle events and also cannot access
repository secrets for forked PRs; change the trigger from pull_request to
pull_request_target and add a narrow types filter (e.g., set the "types" array
to only the events you care about such as opened, reopened, edited, synchronize)
so the workflow runs only on relevant PR events and can access secrets like
OPENAI_API_KEY; keep the existing pull_request_review_comment trigger with its
types: [created] unchanged.
- Line 23: The workflow is using a deprecated, archived action pinned to the
mutable tag "coderabbitai/ai-pr-reviewer@latest"; replace this by either
migrating to the recommended CodeRabbit Pro GitHub App (remove the action
invocation and use the App-based integration) or, if you must continue using the
action, pin the uses entry to the specific commit SHA for the v1.16.2 release
(replace "coderabbitai/ai-pr-reviewer@latest" with the exact commit SHA for
44244a9) and confirm OPENAI_API_KEY is not passed to unmaintained code;
alternatively choose an actively maintained action as a replacement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: af6f71ee-b845-4145-b826-5d162547f624
📒 Files selected for processing (1)
.github/workflows/ai-pr-reviewer.yml
| review: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: coderabbitai/ai-pr-reviewer@latest |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
coderabbitai/ai-pr-reviewer GitHub action status 2025 2026
💡 Result:
The GitHub Action coderabbitai/ai-pr-reviewer is archived and read-only as of December 18, 2025. It is no longer actively maintained. Last code push was on 2025-12-18. The repository remains listed on GitHub Marketplace, but using @latest may pull from the archived state. CodeRabbit now offers a commercial AI code review platform at coderabbit.ai as the recommended alternative.
Citations:
- 1: https://github.com/coderabbitai/ai-pr-reviewer
- 2: https://github.com/coderabbitai/ai-pr-reviewer/tree/main
- 3: https://github.com/marketplace/actions/ai-based-pr-reviewer-summarizer-with-chat-capabilities
- 4: https://github.com/coderabbitai
- 5: https://github.com/coderabbitai/ai-pr-reviewer/pull/526
🏁 Script executed:
# Check if this is a real GitHub action and get information about recent releases
curl -s https://api.github.com/repos/coderabbitai/ai-pr-reviewer 2>/dev/null | jq '.archived, .description, .updated_at, .topics' || echo "API request failed or rate limited"Repository: s091648/scrape-and-analyze
Length of output: 232
🏁 Script executed:
# Try to get release information for v1.16.2
curl -s "https://api.github.com/repos/coderabbitai/ai-pr-reviewer/releases/tags/v1.16.2" 2>/dev/null | jq '.tag_name, .target_commitish, .created_at, .published_at' || echo "Release lookup failed"Repository: s091648/scrape-and-analyze
Length of output: 90
🏁 Script executed:
# Get all releases for the repository, sorted by date
curl -s "https://api.github.com/repos/coderabbitai/ai-pr-reviewer/releases?per_page=20" 2>/dev/null | jq -r '.[] | "\(.tag_name) - commit: \(.target_commitish) - published: \(.published_at)"' | head -20Repository: s091648/scrape-and-analyze
Length of output: 1181
🏁 Script executed:
# Also check git tags directly
curl -s "https://api.github.com/repos/coderabbitai/ai-pr-reviewer/git/refs/tags" 2>/dev/null | jq -r '.[] | .ref' | grep -E 'v1\.' | sort -V | tail -10Repository: s091648/scrape-and-analyze
Length of output: 52
🏁 Script executed:
# Get the main branch commit at the time v1.16.2 was released (2023-09-15)
# We'll check recent commits on main to see if 44244a9 exists
curl -s "https://api.github.com/repos/coderabbitai/ai-pr-reviewer/commits/main" 2>/dev/null | jq -r '.sha' | head -c 8Repository: s091648/scrape-and-analyze
Length of output: 78
🏁 Script executed:
# Check if commit 44244a9 exists in this repository
curl -s "https://api.github.com/repos/coderabbitai/ai-pr-reviewer/commits/44244a9" 2>/dev/null | jq -r '.sha // "NOT_FOUND"'Repository: s091648/scrape-and-analyze
Length of output: 111
🏁 Script executed:
# Get commit log around the release date of v1.16.2 (2023-09-15)
curl -s "https://api.github.com/repos/coderabbitai/ai-pr-reviewer/commits?since=2023-09-14&until=2023-09-16&per_page=5" 2>/dev/null | jq -r '.[] | "\(.sha | .[0:7]) - \(.commit.message | split("\n")[0]) - \(.commit.committer.date)"'Repository: s091648/scrape-and-analyze
Length of output: 130
Pinned to a deprecated, archived action via a mutable @latest tag.
Two compounding issues:
-
Deprecated action:
coderabbitai/ai-pr-revieweris archived and maintained as read-only since December 2025. The project recommends installing the Pro version, which is a total redesign offering significantly better reviews. With the repository archived, no security patches or dependency updates will ever be applied to it. TheOPENAI_API_KEYsecret is exposed to this unmaintained code. -
Mutable
@latesttag: The latest release isv1.16.2at commit44244a9. Pinning to a mutable tag rather than a full commit SHA leaves the workflow open to supply-chain attacks if the tag were ever force-pushed.
Strongly consider migrating to CodeRabbit Pro (a GitHub App install, no workflow needed) or an actively maintained alternative. If staying with this action, at minimum pin to the SHA:
- - uses: coderabbitai/ai-pr-reviewer@latest
+ - uses: coderabbitai/ai-pr-reviewer@44244a9 # v1.16.2🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ai-pr-reviewer.yml at line 23, The workflow is using a
deprecated, archived action pinned to the mutable tag
"coderabbitai/ai-pr-reviewer@latest"; replace this by either migrating to the
recommended CodeRabbit Pro GitHub App (remove the action invocation and use the
App-based integration) or, if you must continue using the action, pin the uses
entry to the specific commit SHA for the v1.16.2 release (replace
"coderabbitai/ai-pr-reviewer@latest" with the exact commit SHA for 44244a9) and
confirm OPENAI_API_KEY is not passed to unmaintained code; alternatively choose
an actively maintained action as a replacement.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
1 participant
Summary by CodeRabbit