[issue-810] updated push-trigger.yml to fix github action build issue

[Prafulrakhade]

Summary by CodeRabbit

• Chores
  • Updated automated code-quality analysis configuration.
  • Retained existing authentication and notification settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b3a1a05f-0bbd-406c-afc2-c878e5eba589

📥 Commits

Reviewing files that changed from the base of the PR and between b856f90 and 0f6cdb6.

📒 Files selected for processing (1)

• .github/workflows/push-trigger.yml

---

Walkthrough

The sonar-analysis job in the push-trigger workflow removes SONAR_URL and PROJECT_KEY while retaining the SONAR_TOKEN, ORG_KEY, and SLACK_WEBHOOK_URL secrets.

Changes

Sonar workflow configuration

Layer / File(s)	Summary
Remove redundant Sonar fields .github/workflows/push-trigger.yml	The sonar-analysis job no longer supplies SONAR_URL or PROJECT_KEY; its existing secrets remain configured.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

Two fields drift away,
Secrets still guard the sonar gate,
The workflow runs light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is clearly related to the workflow change and correctly frames it as a GitHub Action build fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Mahesh-Binayak]

@CodeRabbit how can coderabbit approve this PR ? does it have write access ?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="mosip/mosip-compliance-toolkit-ui"

echo "Repository installation:"
gh api "repos/${repo}/installation" \
  --jq '{app_slug: .app_slug, app_name: .app_name, permissions: .permissions, repository_selection: .repository_selection}' \
  || echo "Unable to read the repository installation (this endpoint may require repository administration access)."

Length of output: 824

---

@Mahesh-Binayak CodeRabbit can approve #811 when someone posts this as a top-level PR comment:

`@coderabbitai` approve

It needs the CodeRabbit GitHub App to have Pull requests: Read and write permission for mosip/mosip-compliance-toolkit-ui. A repository/org administrator can grant this from:

GitHub → Settings → Integrations → GitHub Apps → CodeRabbit → Configure → Repository permissions

The permission check could not be completed because the GitHub API credential returned a 401 JWT decoding error, so I cannot confirm that CodeRabbit currently has write access. Please use least privilege: grant only Pull requests: Read and write (and only for the intended repositories), rather than broad repository write access.

🐇🔎

[Mahesh-Binayak]

@CodeRabbit
whats happening now is ,
Coderabbit's review gets a green tick as if its one of the repo owners
and also until we make the change suggested by @CodeRabbit , it wont allow merging .
why is this so ? and how do I change it so that @CodeRabbit is only a commenter and can only suggest changes .

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="mosip/mosip-compliance-toolkit-ui"
pr="811"

echo "== PR review/merge state =="
gh pr view "$pr" --repo "$repo" --json \
  number,baseRefName,mergeStateStatus,reviewDecision,isDraft,reviews,statusCheckRollup \
  --jq '{
    number,
    base: .baseRefName,
    mergeStateStatus,
    reviewDecision,
    isDraft,
    reviews: [.reviews[] | {author: .author.login, state, submittedAt}],
    checks: [.statusCheckRollup[]? | {
      name: (.name // .context),
      status,
      conclusion,
      app: (.workflowName // .detailsUrl // "")
    }]
  }'

echo
echo "== Branch protection for develop (may be absent if rulesets are used) =="
gh api "repos/${repo}/branches/develop/protection" \
  --jq '{
    required_status_checks,
    required_pull_request_reviews,
    enforce_admins,
    restrictions,
    required_linear_history,
    allow_force_pushes,
    allow_deletions
  }' || true

echo
echo "== Repository rulesets that may apply to develop =="
gh api "repos/${repo}/rulesets?includes_parents=true" \
  --jq '[.[] | {
    id, name, target, enforcement,
    conditions,
    rules: [.rules[] | {type, parameters}]
  }]' || true

echo
echo "== CodeRabbit application installation permissions (if caller is authorized) =="
gh api "repos/${repo}/installation" \
  --jq '{app_slug, app_name, permissions, repository_selection}' || true

Length of output: 3144

---

⚙️ CodeRabbit configuration inspected

Length of output: 11038

---

🤖 web_search executed:

CodeRabbit documentation disable automatic PR approval GitHub App reviewer approval configuration

Length of output: 13527

---

@Mahesh-Binayak Yes—this is caused by two separate mechanisms:

1. CodeRabbit is submitting a real GitHub approval. On #811, coderabbitai submitted APPROVED, and your current configuration enables that behavior:

   reviews:
     request_changes_workflow: true

2. A separate CodeRabbit check is present on the PR. If develop branch protection marks that check as required, GitHub will prevent merging until it succeeds—even if all human reviewers approve.

To keep CodeRabbit as comment-only/advisory, update .coderabbit.yaml:

reviews:
  request_changes_workflow: false

This preserves CodeRabbit’s ability to post review comments and suggestions, but disables its approval workflow—including @coderabbitai approve. Do not remove the app’s Pull requests write permission if you still want inline review comments; GitHub requires that permission to create them.

Then, as a repository administrator, open:

GitHub → Settings → Branches → develop protection rule
(or Settings → Rules → Rulesets, if you use rulesets)

Verify and change these items:

• Remove CodeRabbit from Required status checks, if it is listed.
• Do not configure CodeRabbit as a required reviewer.
• If approvals are required, require a human team, named maintainers, or code-owner review. A plain “N approvals required” rule can still count an app approval unless a human/code-owner requirement is also enforced.

For the already-open #811, the existing CodeRabbit approval may remain visible until a new commit invalidates approvals or a maintainer dismisses that review. The configuration change prevents future CodeRabbit approvals.

The branch-protection API was not accessible to the current integration, so I could not confirm whether CodeRabbit is presently a required check. The repository admin can confirm this directly in the branch/ruleset settings above.

🐇‍⬛🔍