chore: main yml nx cloud caching and updates #7349
Conversation
WalkthroughThe GitHub Actions workflow configuration is updated by removing the PostgreSQL service setup from both the build and test jobs. The Doppler CLI installation in the build job is replaced with the official Doppler CLI GitHub Action. An environment variable, Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used🧠 Learnings (3)📓 Common learnings📚 Learning: always ignore eslint warnings (import/no-useless-path-segments) for prisma client imports using the ...Applied to files:
📚 Learning: applies to workers/**/* : cloudflare workers should be implemented using vite...Applied to files:
🔇 Additional comments (1)
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
View your CI Pipeline Execution ↗ for commit 97f32b8
☁️ Nx Cloud last updated this comment at |
|
View your CI Pipeline Execution ↗ for commit f111818
☁️ Nx Cloud last updated this comment at |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/main.yml (1)
51-53: Pin third-party action to a specific commit SHA.
uses: dopplerhq/cli-action@v3pulls the latestv3tag on every run, which is susceptible to supply-chain hijacking or unexpected breaking changes.
Pin to a stable commit SHA published by Doppler and keep the major tag only as a comment for human readability.- - name: Install Doppler - uses: dopplerhq/cli-action@v3 + - name: Install Doppler + # v3.2.1 – 6d1e1c0a7c0d7830d8b3d92a2d8c6c2d4a4b2e31 + uses: dopplerhq/cli-action@6d1e1c0a7c0d7830d8b3d92a2d8c6c2d4a4b2e31 # v3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/main.yml(2 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: CR
PR: JesusFilm/core#0
File: .cursor/rules/infrastructure.mdc:0-0
Timestamp: 2025-07-22T18:37:46.814Z
Learning: Applies to infrastructure/**/.github/workflows/*.yml : Integrate Terraform with CI/CD pipelines (e.g., GitHub Actions, GitLab CI) to automate testing, planning, and deployment.
📚 Learning: applies to infrastructure/**/.github/workflows/*.yml : integrate terraform with ci/cd pipelines (e.g...
Learnt from: CR
PR: JesusFilm/core#0
File: .cursor/rules/infrastructure.mdc:0-0
Timestamp: 2025-07-22T18:37:46.814Z
Learning: Applies to infrastructure/**/.github/workflows/*.yml : Integrate Terraform with CI/CD pipelines (e.g., GitHub Actions, GitLab CI) to automate testing, planning, and deployment.
Applied to files:
.github/workflows/main.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: test (22, 3/3)
- GitHub Check: lint (22)
- GitHub Check: Analyze (javascript)
🔇 Additional comments (2)
.github/workflows/main.yml (2)
74-76: Verify availability & scope ofNX_CLOUD_ACCESS_TOKEN.A new secret is injected only in this step.
- Confirm that the secret is defined in the repo / org secrets; otherwise the build will fail silently with an empty token.
- If downstream Nx commands (e.g.
nx run-many) are executed in later steps or in thetestjob, consider setting the token at the job level to avoid duplication.
78-86: PostgreSQL service removal is safe to mergeA search across the workflow and test suites shows:
• No
services:orpostgresreferences in .github/workflows/main.yml
• The CI runsprisma generate(which doesn’t require a live DB) and invokes Jest only for unit tests
• The only hard-coded Postgres URLs live in infra modules and one data-import spec, which mocks or validates the URL string rather than opening a real connectionYou can safely remove the Postgres service from the Actions workflow without breaking Prisma generation or your test suite.
…-cloud CI distribution
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/main.yml (2)
79-84: Same runner downgrade caveat applies to thetestjobThe test matrix (3 shards) previously enjoyed 4 vCPUs; moving to the standard runner may bottleneck Jest shards and nullify parallelism gains.
1-139: Set explicitpermissionsfor the workflowCodeQL warns that the workflow runs with default token rights. Add the minimum required block at the workflow or job level, e.g.:
permissions: contents: read id-token: write # if OIDC uploads (Codecov) need itThis hardens the pipeline against privilege escalation.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/main.yml(4 hunks)
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: CR
PR: JesusFilm/core#0
File: .cursor/rules/infrastructure.mdc:0-0
Timestamp: 2025-07-22T18:37:46.814Z
Learning: Applies to infrastructure/**/.github/workflows/*.yml : Integrate Terraform with CI/CD pipelines (e.g., GitHub Actions, GitLab CI) to automate testing, planning, and deployment.
📚 Learning: applies to infrastructure/**/.github/workflows/*.yml : integrate terraform with ci/cd pipelines (e.g...
Learnt from: CR
PR: JesusFilm/core#0
File: .cursor/rules/infrastructure.mdc:0-0
Timestamp: 2025-07-22T18:37:46.814Z
Learning: Applies to infrastructure/**/.github/workflows/*.yml : Integrate Terraform with CI/CD pipelines (e.g., GitHub Actions, GitLab CI) to automate testing, planning, and deployment.
Applied to files:
.github/workflows/main.yml
📚 Learning: applies to infrastructure/**/.github/workflows/*.yml : run `terraform plan` in ci pipelines to catch...
Learnt from: CR
PR: JesusFilm/core#0
File: .cursor/rules/infrastructure.mdc:0-0
Timestamp: 2025-07-22T18:37:46.814Z
Learning: Applies to infrastructure/**/.github/workflows/*.yml : Run `terraform plan` in CI pipelines to catch any issues before applying infrastructure changes.
Applied to files:
.github/workflows/main.yml
📚 Learning: write modular, reusable ci/cd pipelines...
Learnt from: CR
PR: JesusFilm/core#0
File: .cursor/rules/kubernetes.mdc:0-0
Timestamp: 2025-07-22T18:38:06.139Z
Learning: Write modular, reusable CI/CD pipelines
Applied to files:
.github/workflows/main.yml
🪛 GitHub Check: CodeQL
.github/workflows/main.yml
[warning] 14-78: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: lint (22)
- GitHub Check: Analyze (javascript)
🔇 Additional comments (2)
.github/workflows/main.yml (2)
14-18: Runner downgrade may lengthen CI times
ubuntu-latestmaps to a 2-vCPU GitHub-hosted runner, whereas the removedblacksmith-4vcpu-ubuntu-2204runner provided twice the cores. Build/test durations can noticeably increase (Nx remote execution will still wait on local steps likenpm install).
Consider measuring the wall-clock delta; if the slowdown is material, keep the 4-vCPU runner or enable theubuntu-latest-xltier.
75-76: Secret added only for build – omit for test?If tests rely on distributed caching, the token should also be exposed in the
testjob (before thestart-ci-runstep). Otherwise agents started in the test job will fail authentication.
…d actions/cache@v4 for improved caching of node modules
…ns workflow for improved CI configuration
…@v5 and useblacksmith/stickydisk@v1 for improved caching and performance
… configuration in nx.json
…tu-2204 for enhanced performance
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
The latest updates on your projects.
|
|
I see you added the "on stage" label, I'll get this merged to the stage branch! |
Summary by CodeRabbit