👷 ci: Adds labeler & release workflows, updates action versions #103
Conversation
WalkthroughThis update introduces new configuration files and workflows to automate changelog generation, pull request labeling, and release publishing within GitHub Actions. It adds labeler and changelog configuration files for categorizing and formatting changelogs, and implements new workflows for labeling pull requests and publishing releases based on version tags. Several existing workflows are updated to use newer versions of their respective GitHub Actions, and some parameters are refined for stricter error handling and improved artifact management. No changes are made to application logic or exported entities. Changes
Sequence Diagram(s)sequenceDiagram
participant Developer
participant GitHub
participant Labeler Action
participant Release Workflow
participant Changelog Builder
Developer->>GitHub: Open Pull Request / Push Tag
alt Pull Request Event
GitHub->>Labeler Action: Trigger PR labeling workflow
Labeler Action->>GitHub: Apply labels based on branch name
else Tag Push Event (v*.*.*)
GitHub->>Release Workflow: Trigger release workflow
Release Workflow->>Changelog Builder: Generate changelog using config
Changelog Builder->>Release Workflow: Return changelog content
Release Workflow->>GitHub: Publish release with changelog
end
Suggested labels
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
bendoerr
force-pushed
the
feature/release-and-updates
branch
from
7f00e9c to
c759f04
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (8)
.github/changelog.json(1 hunks).github/labeler.yml(1 hunks).github/workflows/dependency-review.yml(1 hunks).github/workflows/lint.yml(7 hunks).github/workflows/pr-label.yml(1 hunks).github/workflows/release.yml(1 hunks).github/workflows/scorecard.yml(3 hunks).github/workflows/test.yml(1 hunks)
🔇 Additional comments (25)
.github/changelog.json (1)
24-25: Verify changelog template placeholders.
Ensure that the chosen changelog generator supports the${{CHANGELOG}}and${{CONTRIBUTORS}}syntax in this JSON template. If it uses a different interpolation format, update the template accordingly to avoid runtime errors..github/workflows/test.yml (3)
17-17: Approve hardened runner upgrade.
Upgradingstep-security/harden-runnerto v2.12.0 aligns with our security hardening strategy and is consistent with other workflows.
22-22: Approve checkout action bump.
Pinningactions/checkoutto v4.2.2 is appropriate and matches the upgrade policy across workflows.
25-25: Approve Go setup action bump.
Upgradingactions/setup-goto v5.4.0 is consistent with other pipelines and should deliver the latest features and fixes..github/workflows/dependency-review.yml (2)
20-20: Approve hardened runner upgrade.
Upgradingstep-security/harden-runnerto v2.12.0 in the dependency review job is consistent with other workflows and improves runner security.
27-27: Approve Dependency Review action bump.
Pinningactions/dependency-review-actionto v4.6.0 brings in the latest dependency scanning enhancements..github/workflows/pr-label.yml (2)
18-18: Approve hardened runner upgrade.
Usingstep-security/harden-runner@v2.12.0here keeps security policies consistent across all workflows.
22-22: Verify labeler action compatibility.
Confirm thatactions/labeler@v5.0.0supports thehead-branchkey patterns defined in.github/labeler.yml. If there have been breaking changes in v5.x, adjust to a compatible version or update the config format..github/workflows/lint.yml (9)
20-23: Consistent runner hardening across all lint jobs
All jobs now pinstep-security/harden-runner@v2.12.0withegress-policy: audit, matching updates in other CI workflows and ensuring uniform security posture.Also applies to: 40-43, 60-63, 80-83, 101-104, 122-124, 142-145, 160-163
26-31: Upgrade tflint integration and enforce failure on errors
Bumpedreviewdog/action-tflintto v1.24.2 and switchedfail_on_errortotrueso that tflint findings block pull requests, improving code quality enforcement.
46-52: Upgrade trivy integration and enforce failure on errors
Updatedreviewdog/action-trivyto v1.13.10 and setfail_on_error: true, ensuring any configuration misconfigurations are surfaced immediately.
66-72: Enforce failure for golangci-lint reports
Although the golangci-lint action version remains at v2.8.0, togglingfail_on_error: trueensures lint violations fail the build, aligning with other CI checks.
89-94: Enforce failure for prettier checks
TheEPMatt/reviewdog-action-prettierstep now hasfail_on_error: true, so formatting issues must be resolved before merging.
107-113: Upgrade misspell integration with non-blocking mode
Bumpedreviewdog/action-misspellto v1.26.3 while keepingfail_on_error: false, allowing typos to be reported without impeding PR workflow noise.
128-133: Upgrade alex integration with non-blocking mode
Updatedreviewdog/action-alexto v1.16.0 and retainedfail_on_error: falsefor stylistic guidance rather than enforcement.
148-152: Upgrade markdownlint integration with non-blocking mode
Switched toreviewdog/action-markdownlint@v0.26.2and keptfail_on_error: falseso markdown style feedback is informative but not blocking.
166-171: Upgrade actionlint integration and enforce failures
Bumpedreviewdog/action-actionlintto v1.65.2 and setfail_on_error: trueso workflow definition issues will block merges, improving CI reliability..github/workflows/release.yml (4)
1-9: Define release trigger and minimal read permissions
The workflow is named “Publish release” and triggers onpushofv*.*.*tags, with top-levelcontents: readpermission. This correctly scopes credentials while reacting to semantic version tags.
21-24: Harden runner for release job
Pinsstep-security/harden-runner@v2.12.0withegress-policy: audit, matching other CI jobs and ensuring a secure execution environment for the release pipeline.
27-33: Configure changelog builder action
Pinsmikepenz/release-changelog-builder-action@v5, uses.github/changelog.json, and setsfailOnError: "true"andfetchReviewers: "true". These settings will auto-generate changelogs, fail on errors, and pull in reviewer suggestions—ideal for reliable releases.
34-38: Create GitHub release with generated changelog
Pinssoftprops/action-gh-release@v2.2.2, conditioned onrefs/tags/, and uses the built changelog as the release body. This automates publishing with correct version tags and release notes..github/workflows/scorecard.yml (4)
35-38: Upgrade runner hardening in Scorecard job
Pinsstep-security/harden-runner@v2.12.0withegress-policy: audit, consistent with other supply-chain security and lint workflows.
45-50: Bump Scorecard action version
Updatedossf/scorecard-actionfrom v2.4.0 to v2.4.1 to pull in the latest fixes without altering existing configuration or behavior.
67-72: Upgrade artifact upload action
Switchedactions/upload-artifactto v4.6.2, ensuring reliable SARIF artifact storage with the latest improvements.
75-79: Upgrade SARIF upload action
Bumpedgithub/codeql-action/upload-sarifto v3.28.16 so code scanning results are uploaded using the most recent stable release.
Summary by CodeRabbit
New Features
CI/CD