ci: replace codfish release action - #335
Merged
Merged
Conversation
…lease workflow GitHub blocked codfish/semantic-release-action for a ToS violation on 2026-06-25, so every release run since then died while resolving actions with "Repository access blocked" and no tag has been cut since v1.53.1. Call flanksource/action-workflows create-release.yml instead, matching duty/config-db/incident-commander, and rewire the downstream jobs to its published/version/tag outputs. Also export GOOS/GOARCH to the hx build: cmd/hx/Makefile derives the .exe suffix from $(GOOS), so the Windows leg was producing hx rather than the hx.exe its rename step expects. Claude-Session-Id: 7e8f563e-0830-4071-8aa0-f903fd93396b
WalkthroughThe release workflow now delegates release creation to a shared reusable workflow. Client bumps, binary builds, and release uploads consume its publication status, version, and tag outputs, with explicit build environment variables for ChangesRelease pipeline
Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant CreateRelease
participant HxBinaries
participant HxUploadRelease
ReleaseWorkflow->>CreateRelease: invoke reusable release workflow
CreateRelease-->>ReleaseWorkflow: return published, version, and tag
ReleaseWorkflow->>HxBinaries: gate build and pass version
HxBinaries->>HxUploadRelease: provide built artifacts
HxUploadRelease->>CreateRelease: upload artifacts using release tag
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Gavel summary
Totals: 463 passed · 0 failed · 3 skipped · 15.6s |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 56: Pass release outputs through step environment variables instead of
interpolating them into shell source: at .github/workflows/release.yml lines
56-56, expose version as COMMONS_VERSION and use it in the commons dependency;
at lines 123-123, expose version as RELEASE_VERSION and assign VERSION from that
variable; at lines 161-161, expose tag as RELEASE_TAG and quote it in the gh
release upload command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e81ff15c-fd97-4c48-a4ea-37de9023b840
📒 Files selected for processing (1)
.github/workflows/release.yml
| # Sleep to let index refresh | ||
| sleep 60 | ||
| go get github.com/flanksource/commons@v${{ needs.semantic-release.outputs.release-version }} | ||
| go get github.com/flanksource/commons@v${{ needs.create-release.outputs.version }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pass release outputs through environment variables before shell execution.
The reusable workflow outputs are inserted into generated shell source. If those values are ever attacker-controlled or insufficiently constrained, shell metacharacters can execute commands in release jobs.
.github/workflows/release.yml#L56-L56: exposeversionas a step environment variable and use"github.com/flanksource/commons@v${COMMONS_VERSION}"..github/workflows/release.yml#L123-L123: exposeversionas an environment variable and useVERSION="$RELEASE_VERSION"..github/workflows/release.yml#L161-L161: exposetagas an environment variable and usegh release upload "$RELEASE_TAG" ....
Proposed pattern
+ env:
+ COMMONS_VERSION: ${{ needs.create-release.outputs.version }}
run: |
- go get github.com/flanksource/commons@v${{ needs.create-release.outputs.version }}
+ go get "github.com/flanksource/commons@v${COMMONS_VERSION}"
env:
GOOS: ${{ matrix.goos }}
GOARCH: ${{ matrix.goarch }}
+ RELEASE_VERSION: ${{ needs.create-release.outputs.version }}
- run: make -C cmd/hx build VERSION=${{ needs.create-release.outputs.version }}
+ run: make -C cmd/hx build VERSION="$RELEASE_VERSION"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_REPO: ${{ github.repository }}
- run: gh release upload "${{ needs.create-release.outputs.tag }}" dist/hx_* --clobber
+ RELEASE_TAG: ${{ needs.create-release.outputs.tag }}
+ run: gh release upload "$RELEASE_TAG" dist/hx_* --clobber📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| go get github.com/flanksource/commons@v${{ needs.create-release.outputs.version }} | |
| env: | |
| COMMONS_VERSION: ${{ needs.create-release.outputs.version }} | |
| run: | | |
| go get "github.com/flanksource/commons@v${COMMONS_VERSION}" | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| RELEASE_VERSION: ${{ needs.create-release.outputs.version }} | |
| run: make -C cmd/hx build VERSION="$RELEASE_VERSION" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| RELEASE_TAG: ${{ needs.create-release.outputs.tag }} | |
| run: gh release upload "$RELEASE_TAG" dist/hx_* --clobber |
🧰 Tools
🪛 zizmor (1.26.1)
[info] 56-56: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
📍 Affects 1 file
.github/workflows/release.yml#L56-L56(this comment).github/workflows/release.yml#L123-L123.github/workflows/release.yml#L161-L161
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 56, Pass release outputs through step
environment variables instead of interpolating them into shell source: at
.github/workflows/release.yml lines 56-56, expose version as COMMONS_VERSION and
use it in the commons dependency; at lines 123-123, expose version as
RELEASE_VERSION and assign VERSION from that variable; at lines 161-161, expose
tag as RELEASE_TAG and quote it in the gh release upload command.
Source: Linters/SAST tools
Contributor
|
🎉 This PR is included in version 1.54.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit