Conversation
miroslavpojer
requested review from
benedeki,
lsulak and
salamonpavel
as code owners
WalkthroughThis pull request adds Dependabot configuration for automated dependency updates on GitHub Actions and sbt packages, and pins GitHub Actions across multiple workflows to specific commit SHAs instead of version tags for reproducibility and security compliance. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used🪛 actionlint (1.7.9).github/workflows/release_draft.yml120-120: property "tagname" is not defined in object type {from-tag-name: string; tag-name: string} (expression) 144-144: property "tagname" is not defined in object type {from-tag-name: string; tag-name: string} (expression) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
JaCoCo 'balta' module code coverage report - scala 2.12.18
|
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/add-to-project@v0.5.0 | ||
| - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e |
There was a problem hiding this comment.
is this necessary? It's really really cumbersome to use such rule globally across our repos
There was a problem hiding this comment.
I was in extra meeting with CSO. From security point of view, it is reasonable. This reason of low resistance from our side and why I have introduced the dependabot.
There was a problem hiding this comment.
Understood. Let's die on another hill, not this one.
.github/workflows/dependabot.yml
Outdated
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Enable auto-merge for Dependabot PRs | ||
| if: startsWith(steps.metadata.outputs.update-type, 'version-update') || startsWith(steps.metadata.outputs.update-type, 'security') |
There was a problem hiding this comment.
hmm shouldn't we prevent doing this for major library update?
also, I think that this automatically, each Sunday, creates, approves, and merges up to 3 PRs of this kind - I'd rather prefer 1 step from a human, approval from someone from CODEOWNERS. I think it should be doable, we just need to adjust the branch protection, i.e. by adding Rulesets into this repo, right?
There was a problem hiding this comment.
no problem, I was waiting for decision to keep or remove the automated approve and merge. I will remove it.
There was a problem hiding this comment.
Yeah I think it's probably much better to have control over this and perform PR merges by a human hand...well, finger. Library updates, even minor ones, can have serious consequences for the functional aspects of the project and all other projects using it. In other words I don't prefer automation for this one
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
.github/workflows/release_draft.yml (5)
91-94: Remove incomplete step definition.This step is missing the required
withblock containing the script. The complete implementation exists in the next step (lines 96-112), making this an incomplete duplicate that will cause the workflow to fail.🔎 Apply this diff to remove the incomplete step:
- - name: Create and Push Tag - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd - env: - TAG_NAME: ${{ github.event.inputs.tag-name }} -
96-112: Add missing environment variable definition.After removing the incomplete duplicate step above, this step needs the
envblock to defineTAG_NAME.🔎 Apply this diff to add the missing env block:
- name: Create and push tag uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd + env: + TAG_NAME: ${{ github.event.inputs.tag-name }} with: script: |
114-138: Remove incorrectly configured step.This step contains configuration parameters (
chapters,duplicity-scope,duplicity-icon, etc.) that don't exist insoftprops/action-gh-release. These parameters belong toAbsaOSS/generate-release-notes, which is already correctly configured at lines 63-89. Additionally, line 120 references the non-existent inputinputs.tagNameinstead ofinputs.tag-name.The correct draft release creation step exists at lines 139-148.
🔎 Apply this diff to remove the incorrectly configured step:
- - name: Create Draft Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - name: ${{ github.event.inputs.tag-name }} - tag-name: ${{ github.event.inputs.tagName }} - chapters: | - - { title: No entry 🚫, label: duplicate } - - { title: Breaking Changes 💥, label: breaking-change } - - { title: New Features 🎉, label: enhancement } - - { title: Bugfixes 🛠, label: bug } - - { title: Infrastructure ⚙️, label: infrastructure } - - { title: Silent-live 🤫, label: silent-live } - - { title: Documentation 📜, label: documentation } - - { title: Closed Epics 📚, label: epic } - duplicity-scope: 'service' - duplicity-icon: '🔁' - warnings: true - skip-release-notes-labels: "no RN" - print-empty-chapters: false - row-format-issue: '_{title}_ {developed-by} {co-authored-by} in #{number}' - row-format-pr: '_{title}_ {developed-by} {co-authored-by} in #{number}' - row-format-link-pr: true -
139-148: Fix reference to non-existent input parameter.Line 144 references
inputs.tagName(camelCase), but the workflow input is defined astag-name(kebab-case) at line 21. This will cause the workflow to fail.🔎 Apply this diff to fix the input reference:
- name: Create draft release uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - name: ${{ github.event.inputs.tagName }} + name: ${{ github.event.inputs.tag-name }} body: ${{ steps.generate_release_notes.outputs.release-notes }} tag_name: ${{ github.event.inputs.tag-name }} draft: true prerelease: false
91-148: Fix multiple critical issues in release workflow steps.This workflow contains several blocking issues that will cause failures:
Incomplete first step (line ~101): "Create and Push Tag" uses
actions/github-scriptbut lacks the requiredscriptparameter—only definesenv.Invalid parameters in third step (line ~119): "Create Draft Release" passes
chapters,duplicity-scope,duplicity-icon, androw-format-*parameters tosoftprops/action-gh-release, which does not support these inputs. These parameters belong to theAbsaOSS/generate-release-notesaction used earlier.Parameter name inconsistency: Uses both
tag-nameandtag_nameinconsistently (andtagNamevstag-namefor input references), which will not resolve correctly.Duplicate release creation: Steps 3 and 4 both create releases using
softprops/action-gh-release, causing redundant executions.Remove the invalid "Create Draft Release" step, consolidate to a single release creation step using the correct
tag_nameparameter, and verify input variable names are consistent throughout.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/check_pr_release_notes.yml(1 hunks).github/workflows/release_draft.yml(2 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/check_pr_release_notes.yml
🧰 Additional context used
🪛 actionlint (1.7.9)
.github/workflows/release_draft.yml
120-120: property "tagname" is not defined in object type {from-tag-name: string; tag-name: string}
(expression)
144-144: property "tagname" is not defined in object type {from-tag-name: string; tag-name: string}
(expression)
| env: | ||
| TAG_NAME: ${{ github.event.inputs.tag-name }} | ||
|
|
||
| - name: Create and push tag |
There was a problem hiding this comment.
this has nothing to do with the Aquasec. Please let's all strive to have as relevant and small PRs as possible. You can keep it now...and thank for the contribution, definitely feel grateful, but I like us to improve on such things
lsulak
left a comment
lsulak
left a comment
There was a problem hiding this comment.
Thanks, I feel like it's good as is, hopefully I did not miss anything - but can be changed easily & quickly if so
tmikula-dev
left a comment
tmikula-dev
left a comment
There was a problem hiding this comment.
From my point of view, these changes looks good to me! The approach and upgrade of the release_draft.yml was already implemented in our QA repositories. However there needs to be answered the questions raised by @lsulak, so we behave on agreed terms. Crucial to be on the same page with our cooperation.
3 participants
Release Notes
Close #59
Summary by CodeRabbit
Chores
Infrastructure
✏️ Tip: You can customize this high-level summary in your review settings.