[HemSoft]

Set it Free Loop — Deployment

Version: 2.0.0
Tier: review
Source SHA: 2fa3dd4cf999c7dc1bafce641a9e7ca41764758a
Engine policy: codex-gpt-55-high

Components deployed

• labels
• governance
• sfl-pr-review

What is the Set it Free Loop?

The Set it Free Loop is a continuous
quality improvement operating model for software repositories. See the
CATALOG
for all available workflows.

Before merging

• Run .\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo> if labels are not yet configured
• For each .md workflow: verify gh aw compile .github/workflows/<name>.md succeeds
• Trigger a workflow manually to confirm output
• Review sfl.json manifest in the repo root

---

Summary by cubic

Deploys Set it Free Loop v2.0.0 to the review tier and simplifies auth in the sfl-pr-review workflow by removing the GitHub App dependency, adding guard policies, and using standard repo secrets for tokens.

• Refactors
  • Replace GitHub App token generation with GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN fallback.
  • Add MCP guard policies for github and safeoutputs (min integrity, allowed repos, sink visibility).
  • Remove github-app config from the workflow and drop SFL_APP_PRIVATE_KEY from required/redacted secrets.
  • Update deployment metadata (sfl.json, lockfile) for HemSoft/set-it-free-loop@2fa3dd4.

^{Written for commit 8177ee8. Summary will update on new commits.}

Note

Deploy Set it Free Loop review tier v2.0.0 with token fallback and MCP guard policies

• Removes the runtime GitHub App token generation step from sfl-pr-review.lock.yml; token now sources from a secrets fallback chain: GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN.
• Adds guard-policies to the MCP gateway config: an allow-only policy (min-integrity + repos) and a write-sink policy (accept-all with configurable sink-visibility via GH_AW_SINK_VISIBILITY).
• Removes the SFL_APP_PRIVATE_KEY secret requirement and its corresponding SECRET_SFL_APP_PRIVATE_KEY export, along with the tools.github.github-app config in sfl-pr-review.md.
• Updates sfl.json with new deployedAt timestamp and sourceSha.

^{Macroscope summarized 8177ee8.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Security
  • Updated repository authentication and access controls.
  • Added safeguards for repository integrity and approved repository access.
  • Improved visibility into protected output destinations.
• Maintenance
  • Refreshed deployment metadata and provenance information.
  • Updated workflow configuration to use available repository credentials.

Walkthrough

The generated review workflow now uses repository secrets for GitHub authentication, adds MCP guard and safe-output policies, removes private-key redaction, and records updated deployment provenance.

Changes

Workflow security and deployment metadata

Layer / File(s)	Summary
Repository token authentication .github/workflows/sfl-pr-review.lock.yml	Removed GitHub App token generation. MCP and Copilot now use configured repository token secrets.
MCP guard and sink policies .github/workflows/sfl-pr-review.lock.yml	Added repository integrity, repository allow-list, and safe-output sink policies.
Deployment provenance .github/workflows/sfl-pr-review.lock.yml, .github/workflows/sfl-pr-review.md, sfl.json	Updated generated hashes, deployment source commit, deployment timestamp, and source SHA.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• HemSoft/gh-x#3: Updates the same generated workflow and deployment metadata with authentication and guard-policy changes.
• HemSoft/gh-x#4: Modifies the same generated workflow and related configuration for the review-validation system.

Suggested labels: feature

Poem

A rabbit checks the tokens bright,
Guards the MCP through day and night.
Old keys hop out, new secrets flow,
Provenance marks the build below.
Safe sinks wait with watchful cheer.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the deployment of Set it Free Loop version 2.0.0 to the review tier.
Description check	✅ Passed	The description directly explains the deployment, included components, authentication changes, and required pre-merge checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sfl/tier-review-2fa3dd4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/sfl-pr-review.lock.yml (1)

540-540: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Keep SFL_APP_PRIVATE_KEY in the workflow secret/redaction inputs.

The lock workflow still passes ${{ secrets.SFL_APP_PRIVATE_KEY }} to actions/create-github-app-token in active token-generation steps, so removing it from redact_secrets would allow the generated GitHub App token to leak in step output. Restore the secret to GH_AW_SECRET_NAMES and as SECRET_SFL_APP_PRIVATE_KEY before the App-token actions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sfl-pr-review.lock.yml at line 540, Restore
SFL_APP_PRIVATE_KEY in the workflow’s GH_AW_SECRET_NAMES and
SECRET_SFL_APP_PRIVATE_KEY redaction inputs before the active
actions/create-github-app-token steps, ensuring the generated token remains
redacted.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/sfl-pr-review.lock.yml:
- Line 540: Restore SFL_APP_PRIVATE_KEY in the workflow’s GH_AW_SECRET_NAMES and
SECRET_SFL_APP_PRIVATE_KEY redaction inputs before the active
actions/create-github-app-token steps, ensuring the generated token remains
redacted.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0b1892c-ebce-4b6a-960b-261cf870471a

📥 Commits

Reviewing files that changed from the base of the PR and between 83e1739 and 8177ee8.

📒 Files selected for processing (3)

• .github/workflows/sfl-pr-review.lock.yml
• .github/workflows/sfl-pr-review.md
• sfl.json

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[HemSoft]

Review triage: CodeRabbit's outside-diff redaction concern is not actionable. The removed SFL_APP_PRIVATE_KEY redaction entry belonged to the deleted read-side App-token job; that secret is no longer exposed to the agent job. The separately generated safe-outputs-app-token step remains intact and continues to receive the private key through GitHub's masked secrets context. The lock was regenerated from source with gh aw v0.84.1; it must not be edited manually.