feat: add common github actions#17
Merged
Merged
Conversation
📝 WalkthroughWalkthroughThis PR introduces two new GitHub composite actions with supporting infrastructure. The ChangesGitHub Actions Infrastructure Setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/test-actions.yml (1)
19-19: ⚡ Quick winConsider pinning actions to commit SHAs and disabling credential persistence.
Static analysis identified two security improvements:
Unpinned action references: Using tag references like
@v4instead of commit SHAs means tags could be moved or compromised. Pin to specific commit hashes for immutability.Credential persistence: By default,
actions/checkoutleaves credentials in.git/config, making them accessible to subsequent steps or scripts. Settingpersist-credentials: falseremoves them after checkout.🔒 Proposed security improvements
steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Run ShellCheck on action scriptssteps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Test verify-clean.shNote: The SHA
11bd71901bbe5b1630ceea73d27597364c9af683corresponds tov4.2.2. Verify this is the desired version.Also applies to: 27-27
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test-actions.yml at line 19, Replace the unpinned checkout action usage `uses: actions/checkout@v4` with a pinned commit SHA (for example the suggested `11bd71901bbe5b1630ceea73d27597364c9af683`) to make the action immutable, and add `persist-credentials: false` to the same `actions/checkout` step so credentials are not left in `.git/config`; update both occurrences of `uses: actions/checkout@v4` in the workflow to use the chosen SHA and include the `persist-credentials: false` setting..github/actions/get-go-version/extract-go-version.sh (1)
4-4: ⚡ Quick winAdd explicit check for flake.nix existence.
If
flake.nixdoesn't exist,sedsucceeds silently with empty output, leading to a misleading error message "Expected exactly one goVersion assignment" instead of "flake.nix not found".🛡️ Proposed improvement
#!/usr/bin/env bash set -euo pipefail +if [ ! -f flake.nix ]; then + echo "::error::flake.nix not found" + exit 1 +fi + GO_VERSION="$(sed -nE 's/^[[:space:]]*goVersion[[:space:]]*=[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)";[[:space:]]*$/\1/p' flake.nix)"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/actions/get-go-version/extract-go-version.sh at line 4, The script assigns GO_VERSION by running sed against flake.nix but doesn't check that flake.nix exists; add an explicit file existence check before the sed (e.g., test -f or [[ -r flake.nix ]]) and if the file is missing print a clear error like "flake.nix not found" to stderr and exit with non-zero status; keep the existing GO_VERSION extraction using the sed command and the existing validation that ensures exactly one match after the extraction.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/diff-check/action.yml:
- Line 2: Fix the typo in the action metadata by updating the description key
value (the "description:" field) to use the correct spelling "uncommitted"
instead of "uncommited"; locate the description: entry in the action.yml and
correct the word in its string value.
In @.github/actions/diff-check/test-verify-clean.sh:
- Line 9: The script test-verify-clean.sh performs a git init and immediate
commit without configuring identity; configure a repo-local git user identity
before the first commit by running git config to set user.name and user.email
earlier in the script (i.e., add the configuration step before the line with
"git init && git commit ...") so commits no longer fail with "empty ident"
errors.
---
Nitpick comments:
In @.github/actions/get-go-version/extract-go-version.sh:
- Line 4: The script assigns GO_VERSION by running sed against flake.nix but
doesn't check that flake.nix exists; add an explicit file existence check before
the sed (e.g., test -f or [[ -r flake.nix ]]) and if the file is missing print a
clear error like "flake.nix not found" to stderr and exit with non-zero status;
keep the existing GO_VERSION extraction using the sed command and the existing
validation that ensures exactly one match after the extraction.
In @.github/workflows/test-actions.yml:
- Line 19: Replace the unpinned checkout action usage `uses:
actions/checkout@v4` with a pinned commit SHA (for example the suggested
`11bd71901bbe5b1630ceea73d27597364c9af683`) to make the action immutable, and
add `persist-credentials: false` to the same `actions/checkout` step so
credentials are not left in `.git/config`; update both occurrences of `uses:
actions/checkout@v4` in the workflow to use the chosen SHA and include the
`persist-credentials: false` setting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: aa02c3c3-7e61-4932-9ec8-2f447d8f07fc
📒 Files selected for processing (7)
.github/actions/diff-check/action.yml.github/actions/diff-check/test-verify-clean.sh.github/actions/diff-check/verify-clean.sh.github/actions/get-go-version/action.yml.github/actions/get-go-version/extract-go-version.sh.github/actions/get-go-version/test-extract-go-version.sh.github/workflows/test-actions.yml
olzemal
force-pushed
the
feature/common-gh-actions
branch
from
848db01 to
a5e03b1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add github actions to get go version from flake.nix and check if uncommited changes occured.
Why
This reduces duplicate code in our repos.
Testing
Tests were added in the .github/actions/* dirs. The tests also run on commits to the scripts.
Checklist
Summary by CodeRabbit
New Features
Tests