Conversation
Update Renovate configuration file
Configure Renovate with best practices and alerts
Removed the action to delete branches after closing pull requests and commented out the CodeRabbit check.
Update Mergify configuration to remove branch deletion
|
Review these changes at https://app.gitnotebooks.com/AlphaSphereDotAI/visualizr/pull/381 |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR refactors the CI pipeline to adopt ubuntu-slim images across the board by updating configuration rules, disabling obsolete checks, and removing unused CI files. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughSummary by CodeRabbit
WalkthroughRemoved automatic branch deletion on PR close and deactivated the CodeRabbit success check in Mergify; enabled OSV vulnerability alerts and dependency dashboard summaries in Renovate; switched many GitHub Actions runners from Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as "GitHub PR"
participant M as "Mergify"
participant Repo as "Repository"
Note over Dev,GH: Before
Dev->>GH: Merge PR
GH->>M: PR closed event
M->>Repo: Delete branch after close
Note over Dev,GH: After
Dev->>GH: Merge PR
GH->>M: PR closed event
M--x Repo: (branch deletion action removed)
Note right of M: `check-success = CodeRabbit` is present but commented out
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used🪛 actionlint (1.7.8).github/workflows/.docker.yaml25-25: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file (runner-label) 67-67: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file (runner-label) 147-147: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file (runner-label) 188-188: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file (runner-label) 227-227: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file (runner-label) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @MH0386, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refines the repository's continuous integration and delivery (CI/CD) setup by removing obsolete configuration files, adjusting Mergify's automated branch management and merge queue checks, and enhancing Renovate's capability to detect and report Open Source Vulnerabilities (OSV) for improved dependency security. The changes aim to streamline workflows and bolster security practices. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- The PR title/description doesn’t match the actual changes – consider updating it to reflect the Mergify queue cleanup and .br folder removals instead of CI runner modifications.
- If removing the “Delete branch after close” rule and disabling the CodeRabbit check are intentional, please include a brief note explaining the rationale for future maintainers.
- Double-check that deleting .br/playbook.json and .br/config.json won’t break any existing workflows, and document their deprecation if these files are no longer needed.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The PR title/description doesn’t match the actual changes – consider updating it to reflect the Mergify queue cleanup and .br folder removals instead of CI runner modifications.
- If removing the “Delete branch after close” rule and disabling the CodeRabbit check are intentional, please include a brief note explaining the rationale for future maintainers.
- Double-check that deleting .br/playbook.json and .br/config.json won’t break any existing workflows, and document their deprecation if these files are no longer needed.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Merge ProtectionsYour pull request matches the following merge protections and will not be merged until they are valid. 🟢 📃 Configuration Change RequirementsWonderful, this rule succeeded.Mergify configuration change
|
There was a problem hiding this comment.
Pull Request Overview
This PR removes ByteRover configuration files from the repository while making minor improvements to CI/CD configuration. The changes clean up developer tooling files that shouldn't be tracked in version control and update the dependency management and merge workflow settings.
- Removes ByteRover CLI configuration and playbook files from version control
- Enables OSV vulnerability alerts in Renovate
- Adjusts Mergify rules to comment out CodeRabbit check and remove automatic branch deletion
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/renovate.json | Adds OSV vulnerability scanning configuration for dependency monitoring |
| .github/mergify.yml | Removes auto-delete branch rule and comments out CodeRabbit check requirement |
| .br/config.json | Removes ByteRover space/team configuration file |
| .br/ace/playbook.json | Removes ByteRover playbook data file |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request primarily focuses on CI and repository automation configuration changes. The removal of stale .br configuration files and the adjustments to the Mergify rules, such as disabling automatic branch deletion and the CodeRabbit check, are clear and well-justified. I have one suggestion regarding the Renovate configuration to ensure the newly added vulnerability scanning is effective.
| "osvVulnerabilityAlerts": true, | ||
| "dependencyDashboardOSVVulnerabilitySummary": "all", |
There was a problem hiding this comment.
Enabling OSV vulnerability alerts is a great security enhancement. However, with pyproject.toml currently in ignorePaths (line 16), Renovate will not scan or update the Python dependencies defined in that file. This means you won't get vulnerability alerts for them, which largely defeats the purpose of these new settings. To make these alerts effective, you should consider removing pyproject.toml from the ignorePaths list.
🧪 CI InsightsHere's what we observed from your CI run for 724b64d. 🟢 All jobs passed!But CI Insights is watching 👀 |
|
Here's the code health analysis summary for commits Analysis Summary
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/.docker.yaml (1)
81-82: Standardize APT package installation steps.The
build_imagejob (line 82) anddocker_scoutjob (line 159) use a single-line APT install command, whereascheck_dockerfile(lines 34–36) splits the commands and addssystemctl start docker. For consistency and clarity, align all three jobs to use the same pattern once the systemctl issue is resolved.Also applies to: 158-159
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/.docker.yaml(6 hunks)
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/.docker.yaml
25-25: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
67-67: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
147-147: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
188-188: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
227-227: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Test Image / Validate Dockerfile
- GitHub Check: Lint / Format
- GitHub Check: Sourcery review
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🔇 Additional comments (1)
.github/workflows/.docker.yaml (1)
32-36: Verify Docker installation necessity in check_dockerfile and fix systemctl issue on ubuntu-slim.Line 36 runs
sudo systemctl start docker, butubuntu-slimis a minimal, container-based GitHub-hosted runner that may not support systemd. Additionally, thecheck_dockerfilejob only validates the Dockerfile; it doesn't build or run containers, so installing Docker here may be unnecessary.Clarify:
- Does
check_dockerfileactually need Docker installed?- If yes, replace
systemctl start dockerwith a method compatible with ubuntu-slim's minimal toolset.- If no, remove the entire APT install block.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/.docker.yaml(6 hunks)
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/.docker.yaml
25-25: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
67-67: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
147-147: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
188-188: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
227-227: label "ubuntu-slim" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Test Image / Docker Scout (quickview)
- GitHub Check: Test Image / API Test
- GitHub Check: Test Image / Docker Scout (recommendations)
- GitHub Check: Lint / Check
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🔇 Additional comments (3)
.github/workflows/.docker.yaml (3)
25-25: ubuntu-slim is a valid GitHub-hosted runner label.The static analysis tool (actionlint) flags
ubuntu-slimas unknown, but this is a false positive. ubuntu-slim is a GitHub-hosted runner option supported as of Jan 2025, and the usage across all jobs is correct.Also applies to: 67-67, 147-147, 188-188, 227-227
32-36: Verify APT package installation approach for ubuntu-slim.The workflow now installs
docker.iovia apt on ubuntu-slim runners. Confirm that:
- This installation is necessary since ubuntu-slim has a minimal toolset
- The
systemctl start dockercommand in the check_dockerfile job (line 36) runs correctly in this environment- Consider whether
docker/setup-docker-action(used elsewhere) should fully replace manual docker setup, or if this hybrid approach is intentionalAlso applies to: 81-82, 158-159
43-46: QEMU and Buildx setup addition is appropriate.Adding
docker/setup-qemu-actionanddocker/setup-buildx-actionin the check_dockerfile job ensures proper Docker build capability for validation. Both actions are already pinned to full commit SHAs.
| uses: docker/setup-docker-action@v4.5.0 | ||
| with: | ||
| daemon-config: | | ||
| { | ||
| "debug": true, | ||
| "features": { | ||
| "containerd-snapshotter": true | ||
| } | ||
| } |
There was a problem hiding this comment.
Pin docker/setup-docker-action to commit SHA to mitigate supply-chain risk.
Lines 84 and 161 use the mutable tag @v4.5.0. Per GitHub Actions security best practices, these must be pinned to the full commit SHA. Previous reviews indicate this should have been fixed, but the unpinned references remain.
Apply this diff to both locations:
- name: Set up Docker
- uses: docker/setup-docker-action@v4.5.0
+ uses: docker/setup-docker-action@efe9e3891a4f7307e689f2100b33a155b900a608 # v4.5.0
with:
daemon-config: |
{
"debug": true,
"features": {
"containerd-snapshotter": true
}
}Use commit SHA efe9e3891a4f7307e689f2100b33a155b900a608 for both lines 84 and 161.
Also applies to: 161-169
🤖 Prompt for AI Agents
In .github/workflows/.docker.yaml around lines 84-92 and 161-169, the workflow
uses the mutable tag docker/setup-docker-action@v4.5.0 which is a supply-chain
risk; replace both occurrences with the pinned commit SHA
docker/setup-docker-action@efe9e3891a4f7307e689f2100b33a155b900a608 so the
action is fixed to that exact commit.
|
|
Hi @MH0386, Your PR is in conflict and cannot be merged. |
Summary by Sourcery
Refine CI automation settings by cleaning up Mergify rules, disabling obsolete checks, and removing stale .br configs
Enhancements:
Chores: