feat: check for codegen changes in ci#571
Merged
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughAdds a new codegen validation workflow that extracts Go version detection into a reusable composite action, refactors the golang workflow to use it, extends the Makefile to regenerate Helm documentation during code generation, and updates the auto-generated Helm chart documentation with container image and configuration changes. ChangesCode generation automation and validation infrastructure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/golang.yaml (1)
36-36: 💤 Low valueConsider
persist-credentials: falseon checkout.This job only lints/tests and doesn't push, so the persisted
GITHUB_TOKENfrom checkout isn't needed. Disabling credential persistence reduces the artipacked exposure flagged by static analysis.🔒 Proposed hardening
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/golang.yaml at line 36, Update the actions/checkout step (uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to include persist-credentials: false so the GITHUB_TOKEN is not persisted in the workspace; modify the checkout step to add the persist-credentials: false input under that uses entry.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codegen.yaml:
- Around line 21-31: The job step "Run codegen and check for changes" currently
runs "make codegen" then only uses "git diff --exit-code" which misses brand-new
(untracked) generated files; change the check after "make codegen" to fail when
there are any modifications OR untracked files by replacing the single "git diff
--exit-code" check with a status check that considers untracked files (for
example use "git status --porcelain" and fail if its output is non-empty, or
combine "git diff --exit-code" with "git ls-files --others --exclude-standard"
so the step reports and exits non-zero when new generated files are created),
keeping the surrounding messages and listing changed/untracked filenames (use
"git diff --name-only" and "git ls-files --others --exclude-standard" to show
them).
- Line 15: Update the codegen workflow checkout step to disable persisted
credentials: locate the GitHub Actions step that uses actions/checkout@v6 (the
line with "uses: actions/checkout@de0fac2e4500...") and add the input
persist-credentials: false to that step so the runner does not retain auth
tokens when running the repo-controlled make codegen / hack scripts.
---
Nitpick comments:
In @.github/workflows/golang.yaml:
- Line 36: Update the actions/checkout step (uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to include
persist-credentials: false so the GITHUB_TOKEN is not persisted in the
workspace; modify the checkout step to add the persist-credentials: false input
under that uses entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6a2c5e91-a06b-4324-b4e4-87309f5366d8
📒 Files selected for processing (5)
.github/actions/get-go-version/action.yml.github/workflows/codegen.yaml.github/workflows/golang.yamlMakefilecharts/solar/README.md
Coverage Report for CI Build 27003508463Coverage decreased (-0.7%) to 73.265%Details
Uncovered ChangesNo uncovered changes found. Coverage Regressions25 previously-covered lines in 2 files lost coverage.
Coverage Stats
💛 - Coveralls |
olzemal
force-pushed
the
feature/557-codegen-ci
branch
3 times, most recently
from
c2600fb to
a74c5d6
Compare
olzemal
force-pushed
the
feature/557-codegen-ci
branch
from
a74c5d6 to
897970a
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/golang.yaml (2)
36-36: 💤 Low valueConsider adding
persist-credentials: falseto the checkout action.Static analysis flags that the checkout action doesn't explicitly set
persist-credentials: false. While this workflow doesn't perform git operations that require credentials, explicitly disabling credential persistence is a security best practice that reduces attack surface.🔒 Proposed security hardening
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - id: go-version🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/golang.yaml at line 36, Update the checkout step that uses "actions/checkout@de0fac2..." to explicitly set persist-credentials: false; modify the checkout action configuration (the step where uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd appears) to include the persist-credentials: false input so credentials are not left in the runner environment.
37-38: ⚡ Quick winConsider refactoring
.github/workflows/release.yamlto use the sharedget-go-versioncomposite action
golang.yaml(andcodegen.yaml) usesopendefensecloud/dev-kit/.github/actions/get-go-version, butrelease.yamlstill extractsgoVersionfromflake.nixvia an inlinesedscript. Refactoringrelease.yamlto the composite action would centralize the parsing logic and reduce duplication/fragility.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/golang.yaml around lines 37 - 38, Release workflow currently extracts GO_VERSION with an inline "Extract go version from flake.nix" step (step id: get-go-version) using sed; replace that inline parsing with the shared composite action opendefensecloud/dev-kit/.github/actions/get-go-version (same action used by golang.yaml and codegen.yaml) by swapping the sed step for a uses: entry pointing to that composite action and adapting any outputs/step ids that downstream steps rely on (preserve the step id get-go-version or update references to match the new step output name).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/golang.yaml:
- Around line 37-38: Replace the broken composite action reference used by the
step with id "go-version" (uses:
opendefensecloud/dev-kit/.github/actions/get-go-version@9fe77282c8260284d4efdb69d19b883e52e9a4d8)
by pinning it to a valid tag/commit or correct path in the
opendefensecloud/dev-kit repository, then verify the action's action.yml still
exposes the "version" output so steps.go-version.outputs.version remains valid;
update the "uses" value accordingly and adjust any output name if the action's
contract changed.
---
Nitpick comments:
In @.github/workflows/golang.yaml:
- Line 36: Update the checkout step that uses "actions/checkout@de0fac2..." to
explicitly set persist-credentials: false; modify the checkout action
configuration (the step where uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd appears) to include
the persist-credentials: false input so credentials are not left in the runner
environment.
- Around line 37-38: Release workflow currently extracts GO_VERSION with an
inline "Extract go version from flake.nix" step (step id: get-go-version) using
sed; replace that inline parsing with the shared composite action
opendefensecloud/dev-kit/.github/actions/get-go-version (same action used by
golang.yaml and codegen.yaml) by swapping the sed step for a uses: entry
pointing to that composite action and adapting any outputs/step ids that
downstream steps rely on (preserve the step id get-go-version or update
references to match the new step output name).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f517a8e8-1975-4c97-814b-18496c8eddd4
📒 Files selected for processing (4)
.github/workflows/codegen.yaml.github/workflows/golang.yamlMakefilecharts/solar/README.md
✅ Files skipped from review due to trivial changes (2)
- Makefile
- charts/solar/README.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/codegen.yaml
olzemal
force-pushed
the
feature/557-codegen-ci
branch
from
897970a to
c585a0b
Compare
yocaba
approved these changes
Jun 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Relates to #557
Checklist
Tests added/updatedn/aSummary by CodeRabbit
New Features
Chores