packaging returned - #58
Conversation
|
PR diff hash: 1003b4134424741d3f383c36df9484e4a8bb7c15910d15a28d6a6894640a93c4 |
📝 WalkthroughWalkthroughThe new workflow runs after successful manually dispatched General Build runs on 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/release_packaging_publish.yml (1)
124-127: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin
DotnetPackaging.Toolto a tested version.
dotnet tool installresolves the latest available version on each run. This makes release artifacts non-reproducible. Pass an explicit tested--versionvalue.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release_packaging_publish.yml around lines 124 - 127, Update the “Install packaging tools” step to pass an explicit, tested --version value to dotnet tool install for DotnetPackaging.Tool, ensuring release packaging uses a reproducible tool version.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release_packaging_publish.yml:
- Around line 9-12: Change the workflow-level permissions to read-only, removing
unnecessary pull-requests access, and move contents: write into the permissions
block for the release-creating job only. Keep evaluate_trigger limited to the
permissions it requires.
- Around line 97-102: Update the release-tag validation in the workflow’s
workflow_run publishing block to verify that RELEASE_TAG resolves to COMMIT_SHA,
not merely that the tag exists. Keep the existing missing-tag error handling,
and fail the release when the tag’s commit differs from the expected commit.
- Around line 63-65: Pin both third-party GitHub Actions to reviewed full commit
SHAs instead of mutable tags: update c-py/action-dotenv-to-setenv in
.github/workflows/release_packaging_publish.yml lines 63-65 and
softprops/action-gh-release in lines 219-221, preserving their existing workflow
usage.
---
Nitpick comments:
In @.github/workflows/release_packaging_publish.yml:
- Around line 124-127: Update the “Install packaging tools” step to pass an
explicit, tested --version value to dotnet tool install for
DotnetPackaging.Tool, ensuring release packaging uses a reproducible tool
version.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5514d63b-9f5e-4a21-8b6c-bcf48601169d
📒 Files selected for processing (1)
.github/workflows/release_packaging_publish.yml
| permissions: | ||
| contents: write | ||
| actions: read | ||
| pull-requests: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scope contents: write to the release job.
evaluate_trigger does not need repository write access. Set workflow permissions to read-only. Grant contents: write only to the job that creates the release. Remove pull-requests: read unless a later step requires it.
🧰 Tools
🪛 zizmor (1.29.0)
[error] 10-10: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release_packaging_publish.yml around lines 9 - 12, Change
the workflow-level permissions to read-only, removing unnecessary pull-requests
access, and move contents: write into the permissions block for the
release-creating job only. Keep evaluate_trigger limited to the permissions it
requires.
Source: Linters/SAST tools
| - name: Load .env | ||
| uses: c-py/action-dotenv-to-setenv@v5 | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow references ---'
sed -n '55,70p;212,226p' .github/workflows/release_packaging_publish.yml
printf '%s\n' '--- repository action references ---'
rg -n 'c-py/action-dotenv-to-setenv|softprops/action-gh-release' .github/workflows
printf '%s\n' '--- GitHub CLI availability ---'
command -v gh || true
printf '%s\n' '--- tag metadata ---'
for spec in \
'c-py/action-dotenv-to-setenv v5' \
'softprops/action-gh-release v2'
do
repo=${spec% *}
tag=${spec#* }
printf '%s %s\n' "$repo" "$tag"
curl -fsSL "https://api.github.com/repos/$repo/git/ref/tags/$tag" |
jq '{ref, object}'
doneRepository: Consolonia/Edit.NET
Length of output: 1911
🏁 Script executed:
#!/bin/bash
set -eu
for repo_tag in \
'c-py/action-dotenv-to-setenv v5' \
'softprops/action-gh-release v2'
do
repo=${repo_tag% *}
tag=${repo_tag#* }
printf '%s %s\n' "$repo" "$tag"
git ls-remote "https://github.com/$repo.git" \
"refs/tags/$tag" \
"refs/tags/$tag^{}"
doneRepository: Consolonia/Edit.NET
Length of output: 328
Pin third-party actions to reviewed commit SHAs.
Both referenced tags are mutable. Pin c-py/action-dotenv-to-setenv@v5 and softprops/action-gh-release@v2 to full commit SHAs.
📍 Affects 1 file
.github/workflows/release_packaging_publish.yml#L63-L65(this comment).github/workflows/release_packaging_publish.yml#L219-L221
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release_packaging_publish.yml around lines 63 - 65, Pin
both third-party GitHub Actions to reviewed full commit SHAs instead of mutable
tags: update c-py/action-dotenv-to-setenv in
.github/workflows/release_packaging_publish.yml lines 63-65 and
softprops/action-gh-release in lines 219-221, preserving their existing workflow
usage.
| if [ "${{ github.event.workflow_run.event }}" = "workflow_dispatch" ] && [ "${{ github.event.workflow_run.head_branch }}" = "main" ]; then | ||
| git fetch --tags --force | ||
| if ! git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then | ||
| echo "Expected release tag '$RELEASE_TAG' not found. Ensure General Build created and pushed tags." >&2 | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Verify that the tag resolves to COMMIT_SHA.
The current check only verifies that $RELEASE_TAG exists. A pre-existing tag can point to a different commit. The release can then attach packages built from head_sha to the wrong source tag.
Proposed fix
- if ! git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
- echo "Expected release tag '$RELEASE_TAG' not found. Ensure General Build created and pushed tags." >&2
+ TAG_COMMIT=$(git rev-parse --verify "${RELEASE_TAG}^{commit}")
+ if [ "$TAG_COMMIT" != "$COMMIT_SHA" ]; then
+ echo "Release tag '$RELEASE_TAG' resolves to $TAG_COMMIT, not $COMMIT_SHA." >&2
exit 1
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if [ "${{ github.event.workflow_run.event }}" = "workflow_dispatch" ] && [ "${{ github.event.workflow_run.head_branch }}" = "main" ]; then | |
| git fetch --tags --force | |
| if ! git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then | |
| echo "Expected release tag '$RELEASE_TAG' not found. Ensure General Build created and pushed tags." >&2 | |
| exit 1 | |
| fi | |
| if [ "${{ github.event.workflow_run.event }}" = "workflow_dispatch" ] && [ "${{ github.event.workflow_run.head_branch }}" = "main" ]; then | |
| git fetch --tags --force | |
| TAG_COMMIT=$(git rev-parse --verify "${RELEASE_TAG}^{commit}") | |
| if [ "$TAG_COMMIT" != "$COMMIT_SHA" ]; then | |
| echo "Release tag '$RELEASE_TAG' resolves to $TAG_COMMIT, not $COMMIT_SHA." >&2 | |
| exit 1 | |
| fi |
🧰 Tools
🪛 zizmor (1.29.0)
[error] 97-97: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 97-97: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release_packaging_publish.yml around lines 97 - 102,
Update the release-tag validation in the workflow’s workflow_run publishing
block to verify that RELEASE_TAG resolves to COMMIT_SHA, not merely that the tag
exists. Keep the existing missing-tag error handling, and fail the release when
the tag’s commit differs from the expected commit.
1 participant
No description provided.