Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
WalkthroughTwo GitHub Actions workflows are introduced and enhanced to automate external workflow triggering with improved notifications. The new external.yml workflow dispatches the stg.yml workflow in an external repository, while release-docker.yml is expanded with Slack notifications, Docker metadata enhancements, and external workflow dispatch capabilities for testnet and mainnet environments. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/external.yml (1)
26-36: Consider adding error handling for workflow dispatch.The workflow dispatch call lacks error handling. If the external workflow trigger fails, the job will succeed without indication of the failure.
Apply this diff to add error handling:
script: | - await github.rest.actions.createWorkflowDispatch({ + try { + await github.rest.actions.createWorkflowDispatch({ + owner: 'OpenZeppelin', + repo: 'openzeppelin-relayer-infra', + workflow_id: 'stg.yml', + ref: 'main' + }) + console.log('Successfully triggered stg.yml workflow') + } catch (error) { + core.setFailed(`Failed to trigger external workflow: ${error.message}`) + }.github/workflows/release-docker.yml (1)
90-107: Add error handling for external workflow dispatches.Both workflow dispatch calls lack error handling. If either dispatch fails, the job continues without indicating the failure, which could lead to incomplete deployments.
Apply this diff to add error handling:
script: | - await github.rest.actions.createWorkflowDispatch({ - owner: 'OpenZeppelin', - repo: 'openzeppelin-relayer-infra', - workflow_id: 'testnet.yml', - ref: 'main' - }) - - await github.rest.actions.createWorkflowDispatch({ - owner: 'OpenZeppelin', - repo: 'openzeppelin-relayer-infra', - workflow_id: 'mainnet.yml', - ref: 'main' - }) + const workflows = ['testnet.yml', 'mainnet.yml']; + const results = []; + + for (const workflow_id of workflows) { + try { + await github.rest.actions.createWorkflowDispatch({ + owner: 'OpenZeppelin', + repo: 'openzeppelin-relayer-infra', + workflow_id, + ref: 'main' + }) + console.log(`Successfully triggered ${workflow_id}`) + results.push({ workflow_id, success: true }) + } catch (error) { + console.error(`Failed to trigger ${workflow_id}: ${error.message}`) + results.push({ workflow_id, success: false, error: error.message }) + } + } + + const failures = results.filter(r => !r.success); + if (failures.length > 0) { + core.setFailed(`Failed to trigger ${failures.length} workflow(s): ${failures.map(f => f.workflow_id).join(', ')}`) + }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/external.yml(1 hunks).github/workflows/release-docker.yml(7 hunks)
🧰 Additional context used
🪛 actionlint (1.7.9)
.github/workflows/external.yml
9-9: label "ubuntu:latest" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🪛 GitHub Check: CodeQL
.github/workflows/external.yml
[warning] 8-36: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: boostsecurity - boostsecurityio/semgrep-pro
- GitHub Check: Redirect rules - openzeppelin-relayer
- GitHub Check: Header rules - openzeppelin-relayer
- GitHub Check: Pages changed - openzeppelin-relayer
- GitHub Check: Analyze (rust)
- GitHub Check: semgrep/ci
🔇 Additional comments (3)
.github/workflows/external.yml (1)
1-5: LGTM: Workflow trigger configuration is correct.The workflow appropriately triggers on pushes to the main branch.
.github/workflows/release-docker.yml (2)
83-89: LGTM: GitHub App token retrieval is properly implemented.The use of a GitHub App for cross-repository workflow dispatch is a best practice, and the implementation correctly stores credentials in secrets.
136-139: LGTM: Enhanced summary output improves observability.Adding image labels to the summary alongside tags provides better visibility into the build output.
.github/workflows/external.yml
Outdated
There was a problem hiding this comment.
Add explicit permissions block for security best practices.
The workflow lacks an explicit permissions block. Following the principle of least privilege, you should define the minimum required permissions.
Apply this diff to add permissions after the job name:
jobs:
build-push-image:
name: Build and Push Docker Image
runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ actions: write
steps:🧰 Tools
🪛 actionlint (1.7.9)
9-9: label "ubuntu:latest" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🪛 GitHub Check: CodeQL
[warning] 8-36: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
🤖 Prompt for AI Agents
In .github/workflows/external.yml around lines 8–36, the job is missing an
explicit permissions block; add a permissions section immediately after the job
name that grants only the minimum scopes required (for this workflow: actions:
write and contents: read) so the GitHub App token and the workflow dispatch call
work under least privilege.
There was a problem hiding this comment.
Same here, lets narrow down the permissions
There was a problem hiding this comment.
@tirumerla, I agree. Here's the minimal permissions block needed for this workflow:
jobs:
build-push-image:
name: Build and Push Docker Image
runs-on: ubuntu-latest
permissions:
contents: read
steps:Explanation:
contents: read- Required for theactions/checkoutstep to clone the repositoryactions: writeis not needed because the external workflow dispatch is performed using the GitHub App token (viasteps.gh-app-token.outputs.token), not the defaultGITHUB_TOKEN
This follows the principle of least privilege by granting only the minimum permission required for this workflow to function.
.github/workflows/external.yml
Outdated
There was a problem hiding this comment.
Fix the invalid runner label syntax.
The runner label ubuntu:latest is invalid. The correct syntax uses a hyphen, not a colon.
Apply this diff:
- runs-on: ubuntu:latest
+ runs-on: ubuntu-latest📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| runs-on: ubuntu:latest | |
| runs-on: ubuntu-latest |
🧰 Tools
🪛 actionlint (1.7.9)
9-9: label "ubuntu:latest" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🤖 Prompt for AI Agents
.github/workflows/external.yml around line 9: the runner label uses an invalid
colon form "ubuntu:latest"; update that line to use the correct GitHub Actions
runner label "ubuntu-latest" (replace the colon with a hyphen) so the workflow's
runs-on value is valid.
There was a problem hiding this comment.
@tirumerla, thank you for confirming! Please update the runner label from ubuntu:latest to ubuntu-latest to resolve this issue.
tirumerla
left a comment
tirumerla
left a comment
There was a problem hiding this comment.
lgtm, added comments to change couple things
.github/workflows/external.yml
Outdated
There was a problem hiding this comment.
Same here, lets narrow down the permissions
.github/workflows/external.yml
Outdated
There was a problem hiding this comment.
There might be formatting issues, not sure. Did u run the pre-commit hook?
3 participants
Summary
Testing Process
Checklist
Note
If you are using Relayer in your stack, consider adding your team or organization to our list of Relayer Users in the Wild!
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.