fix: wire gh-fix-ci repo access gate fail-closed

[eleshar]

Bugfix Pull Request

This repository enforces changelog, release, and label automation for all PRs and issues.
See the organisation-wide Automation Governance & Release Strategy for required rules.

Linked issues

Supersedes #3406 (external fork PR, closed as superseded). No open issue; the defect is the dead-code security helper described below.

Context

• Severity/Impact: Medium (security gate missing; agent skill ran gh fetches with no authorisation check)
• Affected versions/environments: develop, gh-fix-ci skill (inspect_pr_checks.py)

Reproduction

• Steps: 1) Inspect security: fix security issue in inspect_pr_checks.py #3406 diff — adds has_repo_access() 2) grep for callers — none 3) Run skill on a repo the user cannot read — fetches proceed.
• Expected vs Actual: expected fail-closed deny; actual no gate at all.

Root Cause

#3406 defined has_repo_access() (viewerPermission via gh repo view) but never wired it into main(); denylist comparison also admitted unknown values.

Fix Summary

• Call has_repo_access() in main() after ensure_gh_available, before resolve_pr/fetch_checks; deny with exit 1.
• Harden parsing: fail-closed on exception/non-zero rc; allowlist READ/TRIAGE/WRITE/MAINTAIN/ADMIN (rejects NONE/empty/null/unknown, case-insensitive).
• New --skip-access-check escape hatch for offline use.
• CHANGELOG [Unreleased] Fixed entry.

Verification

• Tests added/updated to cover the bug
• Manual verification steps (browsers/devices)
• Negative/edge cases checked

Executed 11 mocked checks, all pass: 5 known levels (incl. lowercase) allow; NONE/empty/null/unknown/non-zero-rc/exception deny; main() exits 1 without calling resolve_pr when denied; --skip-access-check bypasses. py_compile clean.

Risk & Rollback

• Risk level: Low
• Rollback plan: revert single commit 7ebf7d9

Changelog

Fixed

• gh-fix-ci Repo Access Gate — Wired the viewerPermission read-access check into inspect_pr_checks.py so the skill aborts fail-closed for users without read access; added --skip-access-check for offline use. (security: fix security issue in inspect_pr_checks.py #3406)

---

Checklist (Global DoD / PR)

• All AC met and demonstrated
• Tests added/updated (unit/E2E as appropriate)
• Accessibility checklist completed (where relevant): N/A — CLI script, no UI
• Docs/readme/changelog updated (if user-facing)
• Security checklist completed (where relevant):
  • Untrusted input validated and sanitised
  • Output escaped for its rendering context
  • Privileged actions enforce nonce and capability checks
  • No secrets/sensitive data introduced; OWASP risks reviewed
• Code/design reviews approved
• CI green; linked issues closed; release notes prepared (if shipping)

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: lightspeedwp/.github/.coderabbit.yml

Review profile: CHILL

Plan: Advanced

Run ID: c9bb7a20-0644-4efb-b6fe-d6b3446b1ff4

📥 Commits

Reviewing files that changed from the base of the PR and between 26c6d00 and 7ebf7d9.

📒 Files selected for processing (2)

• CHANGELOG.md
• agents/testing-agent/skills/local/plugin-provided/openai-marketplace/github/skills/gh-fix-ci/scripts/inspect_pr_checks.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eleshar]

Applied review nitpick: has_repo_access() now allowlists known levels (READ/TRIAGE/WRITE/MAINTAIN/ADMIN) instead of denylisting NONE/empty. Verified: unknown values (e.g. jq null, unexpected strings) now deny; 13 mocked checks pass. Commit b6e9d53.

[eleshar]

Rebased to a clean single commit on current develop (dropped stale fork-merge history and the unrelated README-regen commit, which lives on its own branch). Conflicts resolved; diff is now only the gate + CHANGELOG entry.

[github-actions]

📋 Changelog Quality Validation

Summary

Metric	Count
✅ Passing	73
⚠️ Warnings	0
❌ Failing	1
🆕 New failures in this PR	1
📦 Pre-existing failures	0

Status

❌ Validation FAILED - This PR introduces 1 new changelog failure(s). Please fix them before merging.
Pre-existing failures (0) are reported for visibility and do not block this PR.

How to Fix

Reproduce the exact PR check locally (from the repository root):

cd .github/validation/changelog
node bin/validate.js --changelog-path ../../../CHANGELOG.md --trigger pr_submission --pr-number 3430 --branch fix/gh-fix-ci-repo-access-gate --output text

Only new failures introduced by this PR block merging; pre-existing Unreleased failures do not block. See Changelog Quality Audit for the rule reference.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[github-actions]

PR Template Routing

Branch Type: fix
Scope: gh-fix-ci-repo-access-gate
Template: pr_bug.md
Labels Applied: type:bug,area:ci

This PR was automatically routed based on the branch naming strategy.