ci(SP-4166): add schema sync CI check#198
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new GitHub Actions workflow Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/schema-sync.yml (1)
10-10: Pin the reusable workflow to a commit SHA.This is the only
@mainreference across all workflows in the repository. All other actions and workflows are pinned to specific versions (v4, v5, etc.) or commit SHAs. Pinning prevents unexpected breakage from upstream changes and provides an audit trail of which version was deployed.Suggested change
- uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@main + uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@<commit-sha>Replace
<commit-sha>with the full 40-character commit SHA.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/schema-sync.yml at line 10, The reusable workflow reference "scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@main" should be pinned to a specific commit SHA instead of `@main`: fetch the exact full 40-character commit SHA for the desired version of the upstream repo and replace the "@main" suffix with "@<full-40-char-commit-sha>" so the workflow is immutable and auditable; ensure you use the long SHA (not a short SHA or tag) when updating the reference.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/schema-sync.yml:
- Line 10: The reusable workflow reference
"scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@main" should be
pinned to a specific commit SHA instead of `@main`: fetch the exact full
40-character commit SHA for the desired version of the upstream repo and replace
the "@main" suffix with "@<full-40-char-commit-sha>" so the workflow is
immutable and auditable; ensure you use the long SHA (not a short SHA or tag)
when updating the reference.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 83c6dc0b-f307-466c-b233-098854bf0f73
📒 Files selected for processing (2)
.github/workflows/schema-sync.ymldocs/source/_static/scanoss-settings-schema.json
💤 Files with no reviewable changes (1)
- docs/source/_static/scanoss-settings-schema.json
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
isasmendiagus
force-pushed
the
feat/SP-4166/schema-sync-ci
branch
from
8631d99 to
f80f019
Compare
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
isasmendiagus
force-pushed
the
feat/SP-4166/schema-sync-ci
branch
from
f80f019 to
9be13d2
Compare
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
isasmendiagus
force-pushed
the
feat/SP-4166/schema-sync-ci
branch
from
9be13d2 to
6c0aa03
Compare
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/schema-sync.yml:
- Line 10: The workflow reference currently pins to a mutable branch
"scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@feat/SP-4166/schema-sync-ci";
replace the branch suffix after the @ with the immutable commit SHA for that
branch (i.e., change "@feat/SP-4166/schema-sync-ci" to "@<commit-sha>") so the
reusable workflow is pinned to a specific commit SHA for deterministic CI.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 99878998-0b67-4ab9-a8a9-ba0ce8066315
📒 Files selected for processing (1)
.github/workflows/schema-sync.yml
|
|
||
| jobs: | ||
| schema-sync: | ||
| uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@feat/SP-4166/schema-sync-ci |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Resolve current SHA behind the branch so it can be pinned.
gh api repos/scanoss/scanoss-devops/branches/feat/SP-4166/schema-sync-ci \
| jq -r '.commit.sha'Repository: scanoss/scanoss.py
Length of output: 114
🏁 Script executed:
# Check if the file exists and read the relevant section
cat -n .github/workflows/schema-sync.yml | head -20Repository: scanoss/scanoss.py
Length of output: 485
Pin reusable workflow to an immutable commit SHA.
Line 10 references a mutable branch (@feat/SP-4166/schema-sync-ci). For CI determinism and safer supply-chain posture, pin to a commit SHA before merge.
Suggested change
- uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@feat/SP-4166/schema-sync-ci
+ uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@<commit-sha>Replace <commit-sha> with the current commit SHA of the feat/SP-4166/schema-sync-ci branch.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@feat/SP-4166/schema-sync-ci | |
| uses: scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@<actual-commit-sha> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/schema-sync.yml at line 10, The workflow reference
currently pins to a mutable branch
"scanoss/scanoss-devops/.github/workflows/schema-sync-check.yml@feat/SP-4166/schema-sync-ci";
replace the branch suffix after the @ with the immutable commit SHA for that
branch (i.e., change "@feat/SP-4166/schema-sync-ci" to "@<commit-sha>") so the
reusable workflow is pinned to a specific commit SHA for deterministic CI.
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
|
Closing to re-open with clean CI run after fixing devops workflow sharing. |
1 participant
Summary
.github/workflows/schema-sync.ymlthat calls the reusable schema sync check workflow fromscanoss-devopsscanoss-settings-schema.json(docs already redirect toscanoss/schema)Context
Jira: SP-4166
The
scanoss/schemarepo is the single source of truth for JSON schemas. This PR adds a CI check on PRs tomainthat fails if the vendored schema atsrc/scanoss/data/scanoss-settings-schema.jsonis out of sync with the source.Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation