fix: Prevent bot self-trigger infinite loops in all workflows #28
Bartender
Reference in New Issue
Block a user
Delete Branch "hotfix/prevent-bot-self-trigger"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
CRITICAL FIX: Bot was triggering itself causing 10+ duplicate runs
Problem:
Solution:
Changes:
Impact:
Note: If bot username changes from 'Bartender', all three workflow files must be updated.
📋 Pull Request Summary
This PR introduces a critical safeguard to the AI bot workflows by preventing the bot from triggering itself through its own comments, thereby avoiding infinite loops and duplicate workflow runs. It also updates documentation to reflect these changes and adds new commands to the ai-comment-reply workflow triggers.
Type: 🔀 Mixed
Changes
✅ Added:
github.event.comment.user.login != 'Bartender') in all three AI bot workflow fileschangelog,explain-diff) to ai-comment-reply.yml triggers📝 Modified:
Files Affected
.gitea/workflows/ai-chat.yml- Added condition to ignore bot's own comments to prevent infinite workflow loops.gitea/workflows/ai-comment-reply.yml- Added condition to ignore bot's own comments and expanded command triggers.gitea/workflows/ai-issue-triage.yml- Added condition to ignore bot's own comments to prevent infinite loopsCLAUDE.md- Updated workflow command list and added detailed documentation on bot self-trigger preventionREADME.md- Added critical instructions for updating bot username in workflows to prevent infinite loopsImpact
🟡 Scope: Medium
These changes address a critical stability issue by preventing infinite workflow triggers caused by the bot commenting on its own messages. This improves reliability and reduces unnecessary resource consumption. The documentation updates ensure maintainers understand how to properly configure the bot username to avoid this problem.
AI Code Review - Inline Comments
[HIGH] Security
The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. If the bot username changes, this hardcoded string will cause the safeguard to fail, potentially leading to infinite workflow triggers and resource exhaustion.
Recommendation: Parameterize the bot username using a repository secret or environment variable to avoid hardcoding. Alternatively, add a centralized config or documentation reminder to update all workflow files when changing the bot username.
[HIGH] Security
The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. This creates a maintenance risk and potential security issue if the bot username changes and the condition is not updated.
Recommendation: Use a variable or secret for the bot username instead of hardcoding. Ensure documentation clearly states the need to update this value in all workflows when renaming the bot.
[HIGH] Security
The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. This hardcoding risks infinite loop triggers if the bot username changes and the condition is not updated.
Recommendation: Replace the hardcoded username with a variable or secret. Add automated checks or documentation to ensure all workflow files are updated when the bot username changes.
[LOW] Maintainability
The documentation clearly explains the need to update the bot username in all workflow files to prevent infinite loops. However, this manual step is error-prone and could be missed during bot renaming.
Recommendation: Consider centralizing the bot username in a single config file or environment variable referenced by all workflows to reduce duplication and risk of inconsistent updates.
[LOW] Maintainability
The README includes a critical step to update the bot username in all workflow files to prevent infinite loops. This is helpful but relies on manual updates.
Recommendation: Add a note or script to automate or verify that the bot username is consistent across all workflow files to reduce human error.
AI Code Review
This PR adds critical safeguards to the GitHub/Gitea workflow YAML files to prevent infinite loops caused by the bot triggering itself via its own comments. It also updates documentation to clearly explain this requirement and the need to update the bot username in multiple places if changed. The changes are well-scoped, address a significant operational risk, and improve maintainability and clarity of the workflows.
Summary
Review Findings
.gitea/workflows/ai-chat.yml:18- The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. If the bot username changes, this hardcoded value will cause the safeguard to fail, potentially leading to infinite workflow triggers..gitea/workflows/ai-comment-reply.yml:18- The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. This creates a maintenance risk and potential security issue if the bot username changes and the condition is not updated..gitea/workflows/ai-issue-triage.yml:13- The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. This hardcoding risks failure of the safeguard if the bot username changes and the condition is not updated.CLAUDE.md:210- The documentation clearly explains the need to update the bot username in all workflow files to prevent infinite loops. However, this manual step is error-prone and could be automated or improved.README.md:484- The README adds a critical step to update the bot username in all workflow files to prevent infinite loops. This is a helpful addition but could be enhanced with examples or links to the exact lines/files.Overall Severity:
HIGHAI Recommendation: Changes Requested
📋 Pull Request Summary
This PR introduces a critical safeguard to the AI bot workflows by preventing the bot from triggering itself via its own comments, thereby avoiding infinite loop executions. It also updates documentation to reflect the new commands supported and provides clear instructions for updating the bot username in workflows to maintain this protection.
Type: 🔀 Mixed
Changes
✅ Added:
changelog,explain-diff) to ai-comment-reply.yml documentation📝 Modified:
Files Affected
.gitea/workflows/ai-chat.yml- Added condition to ignore bot's own comments to prevent infinite workflow loops.gitea/workflows/ai-comment-reply.yml- Added condition to ignore bot's own comments to prevent infinite workflow loops.gitea/workflows/ai-issue-triage.yml- Added condition to ignore bot's own comments to prevent infinite workflow loopsCLAUDE.md- Updated AI workflow documentation with new commands and detailed instructions on bot self-trigger preventionREADME.md- Added critical instructions for updating bot username in workflows to prevent infinite loopsImpact
🟡 Scope: Medium
These changes affect all AI bot-related workflows and documentation, preventing infinite workflow executions caused by the bot triggering itself. This improves system stability and reduces unnecessary resource consumption, while clarifying setup steps for maintainers.
AI Code Review - Inline Comments
[HIGH] Security
The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. If the bot username changes, this hardcoded value will cause the safeguard to fail, potentially leading to infinite workflow triggers.
Recommendation: Parameterize the bot username using a workflow environment variable or repository secret to avoid hardcoding. Alternatively, document clearly and enforce updating all workflow files when the bot username changes.
[HIGH] Security
The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. This creates a maintenance risk and potential security issue if the bot username changes and the condition is not updated.
Recommendation: Use a centralized configuration or environment variable for the bot username to avoid hardcoding. Ensure documentation clearly instructs updating all workflow files if the bot username changes.
[HIGH] Security
The bot username 'Bartender' is hardcoded in the workflow condition to prevent infinite loops. This hardcoding risks failure of the safeguard if the bot username changes and the condition is not updated.
Recommendation: Avoid hardcoding the bot username by using environment variables or repository secrets. Maintain clear documentation and enforce updating all workflow files when the bot username changes.
[LOW] Maintainability
The documentation clearly explains the need to update the bot username in all workflow files to prevent infinite loops. However, this manual step is error-prone and could be automated or improved.
Recommendation: Consider adding a centralized configuration or templating mechanism for the bot username to reduce manual updates and risk of errors. Alternatively, add automated tests or CI checks to verify the username consistency across workflow files.
[LOW] Readability
The README adds a critical step to update the bot username in all workflow files to prevent infinite loops. This is a helpful addition but could be enhanced with examples or links to the exact lines/files.
Recommendation: Add direct links or file paths with line numbers to the README instructions to improve developer experience and reduce errors during bot username changes.