Update release steps in CI workflow - #506
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR enhances the CI workflow by renaming the existing release step to focus on versioned tags and introducing a second step that creates or updates a ‘latest’ release with appropriate settings. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
gstraccini
Bot
added
the
☑️ auto-merge
![korbit-ai[bot]](https://avatars.githubusercontent.com/in/322216?s=60&v=4){kind=small}
|
Caution Review failedThe pull request is closed. Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughThe create-release workflow step is split into two separate steps: one for creating tagged releases and another for the latest release. The tag step formatting is consolidated to a single line, while a new latest step is added with additional configuration options. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
size/S
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
PR Review 🔍
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `.github/workflows/ci.yml:99` </location>
<code_context>
uses: ncipollo/release-action@v1.20.0
</code_context>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
PR Code Suggestions ✨
|
1 participant
📑 Description
Create
latestrelease✅ Checks
☢️ Does this introduce a breaking change?
Summary by Sourcery
CI:
Description by Korbit AI
What change is being made?
Update CI workflow to publish releases in two steps: rename the existing release step to "Create Release (tag)" and add a new "Create Release (latest)" step to publish a non-tagged, latest release with configurable options.
Why are these changes being made?
To publish both a tagged release and a separate latest release from CI, enabling latest releases while preserving tag-based releases. This provides users with stable tag-based releases and an additional latest release stream.
Summary by CodeRabbit