fix(release): padronizar runners via vars.RUNNER_LABEL (shared workflows)#600
Merged
Conversation
br-sisbajud releases failed gitops-update with 'App br-sisbajud is not registered in any cluster of the deployment matrix' and produced an empty ArgoCD-sync target matrix. It deploys on benedita (dev-st/stg-st/prd-st/ stg-mt/sandbox) and anacleto (fuzzing+chaos, dev-st/dev-mt), so add it to apps.registry and both clusters' apps lists.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
Summary by CodeRabbit
WalkthroughChangesThe workflows now support Configurable workflow runners
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/api-dog-e2e-tests.yml:
- Line 52: Update the workflow job’s runs-on expression to make the
caller-provided inputs.runner_type authoritative, removing the unconditional
vars.RUNNER_LABEL fallback; only retain a runner-label override if it is
explicitly opt-in and cannot silently replace the supplied runner.
In @.github/workflows/go-fuzz.yml:
- Line 75: Define a single resolved runner value using the same precedence as
runs-on, preferring vars.RUNNER_LABEL over inputs.runner_type, and update both
the runs-on setting and the dry-run summary to reference it. Ensure dry-run
output reports this effective runner rather than the raw input.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: a0a0779e-7b02-4083-98fd-e7ccdf90a1ad
📒 Files selected for processing (37)
.github/workflows/api-dog-e2e-tests.yml.github/workflows/backmerge.yml.github/workflows/branch-cleanup.yml.github/workflows/build.yml.github/workflows/dispatch-helm.yml.github/workflows/end-to-end-tests.yml.github/workflows/frontend-pr-analysis.yml.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml.github/workflows/go-lambda-release.yml.github/workflows/go-pr-analysis.yml.github/workflows/go-pr-validation.yml.github/workflows/go-security.yml.github/workflows/gptchangelog.yml.github/workflows/helm-alpha-cleanup.yml.github/workflows/helm-alpha-release.yml.github/workflows/helm-release-notification.yml.github/workflows/helm-update-chart.yml.github/workflows/helm-upgrade-doc.yml.github/workflows/js-pr-validation.yml.github/workflows/labels-sync.yml.github/workflows/lerian-lib-version-check.yml.github/workflows/pr-security-scan.yml.github/workflows/pr-validation.yml.github/workflows/release-notification.yml.github/workflows/release.yml.github/workflows/s3-upload.yml.github/workflows/self-pr-validation.yml.github/workflows/slack-notify.yml.github/workflows/stale-issue.yml.github/workflows/stale-pr.yml.github/workflows/typescript-build.yml.github/workflows/typescript-ci.yml.github/workflows/typescript-release.yml.github/workflows/version-propagation.yml.github/workflows/workflow-runs-cleanup.ymlconfig/deployment-matrix.yml
lerian-studio
added
size/M
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
Contributor
🛡️ CodeQL Analysis ResultsLanguages analyzed: Found 2 issue(s): 2 Medium
🔍 View full scan logs | 🛡️ Security tab |
Contributor
🔍 Lint Analysis
❌ Failures (2)Action Lint
Pinned Actions
|
bedatty
changed the title
vars.RUNNER_LABEL remains the primary runner selector; the secondary fallback (when the var is unset) is now GitHub's own ubuntu-latest runner instead of the blacksmith label, both in hardcoded runs-on values and in runner_type input defaults. gitops-update.yml is untouched — it has its own vars.GITOPS_RUNNERS fallback logic.
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/branch-cleanup.yml:
- Line 48: The runs-on expressions in .github/workflows/branch-cleanup.yml:48,
.github/workflows/go-lambda-release.yml:73,
.github/workflows/helm-alpha-cleanup.yml:74,
.github/workflows/helm-alpha-release.yml:50, and
.github/workflows/labels-sync.yml:44 must use blacksmith-4vcpu-ubuntu-2404
instead of ubuntu-latest as the fallback, while preserving the existing
vars.RUNNER_LABEL override.
In @.github/workflows/build.yml:
- Line 27: Restore blacksmith-4vcpu-ubuntu-2404 for every listed default and
fallback runner setting: .github/workflows/build.yml lines 27-27, 185-185, and
276-276; .github/workflows/dispatch-helm.yml lines 91-91 and 100-100;
.github/workflows/frontend-pr-analysis.yml lines 24-24, 199-199, 223-223,
276-276, 322-322, 376-376, 452-452, 588-588, 641-641, 723-723, 777-777, 856-856,
910-910, 975-975, 1051-1051, and 1198-1198; .github/workflows/go-ci.yml lines
21-21 and 112-112; .github/workflows/typescript-build.yml lines 31-31, 162-162,
and 259-259; .github/workflows/typescript-release.yml lines 21-21, 47-47, and
101-101; and .github/workflows/backmerge.yml lines 48-48 and 140-140. Ensure all
reusable-workflow job defaults and fallbacks use the Blacksmith runner
consistently.
In @.github/workflows/go-fuzz.yml:
- Line 12: Restore blacksmith-4vcpu-ubuntu-2404 as the runner fallback across
.github/workflows/go-fuzz.yml lines 12-12 and 43-43,
.github/workflows/go-pr-analysis.yml lines 14-14,
.github/workflows/go-pr-validation.yml lines 14-14,
.github/workflows/go-release.yml lines 14-14, and
.github/workflows/go-security.yml lines 13-13. Update
.github/workflows/release-notification.yml line 114 to fall back to
blacksmith-4vcpu-ubuntu-2404 when vars.RUNNER_LABEL is unset, preserving the
reusable-workflow runner contract.
In @.github/workflows/gptchangelog.yml:
- Line 24: Pin every listed reusable-workflow runner to the Blacksmith label
instead of allowing runner_type or vars.RUNNER_LABEL to select the runner:
update .github/workflows/gptchangelog.yml at lines 24, 58, and 248;
.github/workflows/helm-update-chart.yml at lines 43 and 102;
.github/workflows/helm-upgrade-doc.yml at lines 24 and 72;
.github/workflows/js-pr-validation.yml at lines 14, 311, 379, 410, 429, and 438;
.github/workflows/js-release.yml at line 14; and
.github/workflows/lerian-lib-version-check.yml at lines 18 and 80. Ensure all
affected runs-on jobs, including js-release jobs using inputs.runner_type
directly, resolve to blacksmith-4vcpu-ubuntu-2404.
In @.github/workflows/pr-security-scan.yml:
- Line 16: Restore the runner default to blacksmith-4vcpu-ubuntu-2404 at
.github/workflows/pr-security-scan.yml:16-16,
.github/workflows/pr-validation.yml:15-15, .github/workflows/release.yml:30-30,
both .github/workflows/s3-upload.yml:36-36 and :83-83, and
.github/workflows/slack-notify.yml:35-35, preserving the existing
vars.RUNNER_LABEL || inputs.runner_type selectors so all reusable workflow jobs
use the required Blacksmith runner.
In @.github/workflows/release-notification.yml:
- Line 114: Update the dry-run summary in the release notification workflow to
print the effective runner resolved by the runs-on expression, including the
RUNNER_LABEL value when set and the ubuntu-latest fallback otherwise. Ensure
dry-run output reports every resolved input and computed variable without
changing runner selection.
In @.github/workflows/stale-issue.yml:
- Line 38: Update the runs-on fallback in .github/workflows/stale-issue.yml:38,
.github/workflows/stale-pr.yml:38, .github/workflows/version-propagation.yml:56,
and .github/workflows/workflow-runs-cleanup.yml:43 to use
blacksmith-4vcpu-ubuntu-2404 instead of ubuntu-latest, while preserving
vars.RUNNER_LABEL when it is set.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: cd684910-132a-452d-9784-63c95d9177a9
📒 Files selected for processing (34)
.github/workflows/backmerge.yml.github/workflows/branch-cleanup.yml.github/workflows/build.yml.github/workflows/dispatch-helm.yml.github/workflows/frontend-pr-analysis.yml.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml.github/workflows/go-lambda-release.yml.github/workflows/go-pr-analysis.yml.github/workflows/go-pr-validation.yml.github/workflows/go-release.yml.github/workflows/go-security.yml.github/workflows/gptchangelog.yml.github/workflows/helm-alpha-cleanup.yml.github/workflows/helm-alpha-release.yml.github/workflows/helm-update-chart.yml.github/workflows/helm-upgrade-doc.yml.github/workflows/js-pr-validation.yml.github/workflows/js-release.yml.github/workflows/labels-sync.yml.github/workflows/lerian-lib-version-check.yml.github/workflows/pr-security-scan.yml.github/workflows/pr-validation.yml.github/workflows/release-notification.yml.github/workflows/release.yml.github/workflows/s3-upload.yml.github/workflows/self-pr-validation.yml.github/workflows/slack-notify.yml.github/workflows/stale-issue.yml.github/workflows/stale-pr.yml.github/workflows/typescript-build.yml.github/workflows/typescript-release.yml.github/workflows/version-propagation.yml.github/workflows/workflow-runs-cleanup.yml
Renamed vars.RUNNER_LABEL to vars.GENERAL_RUNNERS across all shared workflows for clarity. gitops-update.yml (vars.GITOPS_RUNNERS) and the Ungoliant release-diff jobs (vars.UNGOLIANT_RUNNERS) already use their own dedicated runner variables and were not part of this rename.
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/pr-validation.yml (1)
15-15: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winRestore the shared Blacksmith runner defaults across reusable workflows.
These defaults collectively change the fallback execution environment from
blacksmith-4vcpu-ubuntu-2404toubuntu-latest. Callers that omitrunner_typecan therefore lose runner-specific tooling, networking, or permissions.
.github/workflows/pr-validation.yml#L15-L15: restore the Blacksmith default for PR validation..github/workflows/release.yml#L30-L30: restore theworkflow_callrelease default..github/workflows/release.yml#L83-L83: restore the manual-dispatch release default..github/workflows/s3-upload.yml#L36-L36: restore the reusable upload default..github/workflows/s3-upload.yml#L83-L83: restore the manual-dispatch upload default..github/workflows/slack-notify.yml#L35-L35: restore the notification default..github/workflows/typescript-build.yml#L31-L31: restore the TypeScript build default.As per coding guidelines, reusable workflows must use
blacksmith-4vcpu-ubuntu-2404. As per path instructions, preserve the shared runner contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-validation.yml at line 15, Restore the runner default to blacksmith-4vcpu-ubuntu-2404 at .github/workflows/pr-validation.yml:15-15, .github/workflows/release.yml:30-30 and 83-83, .github/workflows/s3-upload.yml:36-36 and 83-83, .github/workflows/slack-notify.yml:35-35, and .github/workflows/typescript-build.yml:31-31. Preserve the shared runner contract for all reusable workflow and manual-dispatch defaults.Sources: Coding guidelines, Path instructions
.github/workflows/typescript-release.yml (1)
21-21: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winPreserve the required Blacksmith runner default.
Changing the default to
ubuntu-latestis a breaking behavior change for callers that omitrunner_type; those jobs now run outside the repository’s required runner environment. Restoreblacksmith-4vcpu-ubuntu-2404as the default, and ensure anyGENERAL_RUNNERSoverride is constrained to an approved Blacksmith label.As per coding guidelines, all jobs in reusable workflows must use
blacksmith-4vcpu-ubuntu-2404.Proposed fix
- default: ubuntu-latest + default: blacksmith-4vcpu-ubuntu-2404🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/typescript-release.yml at line 21, Restore the reusable workflow’s runner default to blacksmith-4vcpu-ubuntu-2404 instead of ubuntu-latest, and constrain any GENERAL_RUNNERS override to an approved Blacksmith label so all jobs continue using the required runner environment.Source: Coding guidelines
♻️ Duplicate comments (2)
.github/workflows/build.yml (1)
27-27: 🩺 Stability & Availability | 🟠 MajorRestore the Blacksmith defaults across reusable workflows.
These changes replace the required
blacksmith-4vcpu-ubuntu-2404fallback withubuntu-latest, changing the environment for callers that omitrunner_type.
.github/workflows/build.yml#L27-L27: restore the Blacksmith default..github/workflows/dispatch-helm.yml#L91-L91: restore the Blacksmith default..github/workflows/frontend-pr-analysis.yml#L24-L24: restore the Blacksmith default..github/workflows/go-ci.yml#L21-L21: restore the Blacksmith default.As per coding guidelines, all jobs in reusable workflows must use
blacksmith-4vcpu-ubuntu-2404.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml at line 27, Restore the reusable-workflow runner default to blacksmith-4vcpu-ubuntu-2404 at .github/workflows/build.yml:27-27, .github/workflows/dispatch-helm.yml:91-91, .github/workflows/frontend-pr-analysis.yml:24-24, and .github/workflows/go-ci.yml:21-21, replacing ubuntu-latest in each runner_type default.Source: Coding guidelines
.github/workflows/gptchangelog.yml (1)
24-24: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winPreserve the Blacksmith runner fallback for reusable workflows.
When
vars.GENERAL_RUNNERSis unset, these changes resolve reusable-workflow jobs toubuntu-latest, violating the repository requirement that reusable workflows useblacksmith-4vcpu-ubuntu-2404. Restore the Blacksmith default/fallback; ifrunner_typeremains caller-overridable, ensure it cannot select unsupported runners.
.github/workflows/gptchangelog.yml#L24-L24: restore therunner_typedefault toblacksmith-4vcpu-ubuntu-2404..github/workflows/gptchangelog.yml#L58-L58: replace theubuntu-latestpath with the Blacksmith fallback..github/workflows/gptchangelog.yml#L248-L248: apply the same Blacksmith fallback..github/workflows/release-notification.yml#L114-L114: replace theubuntu-latestfallback..github/workflows/stale-issue.yml#L38-L38: replace theubuntu-latestfallback..github/workflows/stale-pr.yml#L38-L38: replace theubuntu-latestfallback.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gptchangelog.yml at line 24, Restore the Blacksmith runner fallback for reusable workflows: in .github/workflows/gptchangelog.yml lines 24, 58, and 248, set the runner_type default and GENERAL_RUNNERS fallbacks to blacksmith-4vcpu-ubuntu-2404; apply the same fallback in .github/workflows/release-notification.yml line 114, .github/workflows/stale-issue.yml line 38, and .github/workflows/stale-pr.yml line 38. Preserve caller overrides only when they select supported runners.Sources: Coding guidelines, Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/backmerge.yml:
- Line 48: Replace the ubuntu-latest fallback in the runs-on expressions at
.github/workflows/backmerge.yml lines 48-48 and 140-140,
.github/workflows/branch-cleanup.yml lines 48-48,
.github/workflows/go-lambda-release.yml line 73, and
.github/workflows/helm-alpha-cleanup.yml line 74 with
blacksmith-4vcpu-ubuntu-2404, while preserving the GENERAL_RUNNERS override.
In @.github/workflows/end-to-end-tests.yml:
- Line 78: Update the E2E workflow’s runs-on expression to keep the
caller-provided inputs.runner_type authoritative, rather than unconditionally
preferring vars.GENERAL_RUNNERS. If retaining the variable fallback, make it
explicitly opt-in while preserving the ability to select network-specific
runners such as eveo-lxc-runners.
In @.github/workflows/helm-alpha-release.yml:
- Line 50: Update the runs-on fallback in
.github/workflows/helm-alpha-release.yml at line 50 and
.github/workflows/labels-sync.yml at line 44 to use blacksmith-4vcpu-ubuntu-2404
instead of ubuntu-latest, while preserving the vars.GENERAL_RUNNERS override.
In @.github/workflows/version-propagation.yml:
- Line 56: Replace the dynamic runner fallback with the fixed approved runner
label blacksmith-4vcpu-ubuntu-2404 for the propagation/signing job in
.github/workflows/version-propagation.yml at lines 56-56, lint-and-typecheck,
build-and-test, security-audit, and docs in .github/workflows/typescript-ci.yml
at lines 79-79, 113-113, 171-171, and 218-218, and destructive cleanup in
.github/workflows/workflow-runs-cleanup.yml at line 43.
---
Outside diff comments:
In @.github/workflows/pr-validation.yml:
- Line 15: Restore the runner default to blacksmith-4vcpu-ubuntu-2404 at
.github/workflows/pr-validation.yml:15-15, .github/workflows/release.yml:30-30
and 83-83, .github/workflows/s3-upload.yml:36-36 and 83-83,
.github/workflows/slack-notify.yml:35-35, and
.github/workflows/typescript-build.yml:31-31. Preserve the shared runner
contract for all reusable workflow and manual-dispatch defaults.
In @.github/workflows/typescript-release.yml:
- Line 21: Restore the reusable workflow’s runner default to
blacksmith-4vcpu-ubuntu-2404 instead of ubuntu-latest, and constrain any
GENERAL_RUNNERS override to an approved Blacksmith label so all jobs continue
using the required runner environment.
---
Duplicate comments:
In @.github/workflows/build.yml:
- Line 27: Restore the reusable-workflow runner default to
blacksmith-4vcpu-ubuntu-2404 at .github/workflows/build.yml:27-27,
.github/workflows/dispatch-helm.yml:91-91,
.github/workflows/frontend-pr-analysis.yml:24-24, and
.github/workflows/go-ci.yml:21-21, replacing ubuntu-latest in each runner_type
default.
In @.github/workflows/gptchangelog.yml:
- Line 24: Restore the Blacksmith runner fallback for reusable workflows: in
.github/workflows/gptchangelog.yml lines 24, 58, and 248, set the runner_type
default and GENERAL_RUNNERS fallbacks to blacksmith-4vcpu-ubuntu-2404; apply the
same fallback in .github/workflows/release-notification.yml line 114,
.github/workflows/stale-issue.yml line 38, and .github/workflows/stale-pr.yml
line 38. Preserve caller overrides only when they select supported runners.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: e7af549d-192d-4c84-8879-e90846b2581b
📒 Files selected for processing (36)
.github/workflows/api-dog-e2e-tests.yml.github/workflows/backmerge.yml.github/workflows/branch-cleanup.yml.github/workflows/build.yml.github/workflows/dispatch-helm.yml.github/workflows/end-to-end-tests.yml.github/workflows/frontend-pr-analysis.yml.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml.github/workflows/go-lambda-release.yml.github/workflows/go-pr-analysis.yml.github/workflows/go-pr-validation.yml.github/workflows/go-security.yml.github/workflows/gptchangelog.yml.github/workflows/helm-alpha-cleanup.yml.github/workflows/helm-alpha-release.yml.github/workflows/helm-release-notification.yml.github/workflows/helm-update-chart.yml.github/workflows/helm-upgrade-doc.yml.github/workflows/js-pr-validation.yml.github/workflows/labels-sync.yml.github/workflows/lerian-lib-version-check.yml.github/workflows/pr-security-scan.yml.github/workflows/pr-validation.yml.github/workflows/release-notification.yml.github/workflows/release.yml.github/workflows/s3-upload.yml.github/workflows/self-pr-validation.yml.github/workflows/slack-notify.yml.github/workflows/stale-issue.yml.github/workflows/stale-pr.yml.github/workflows/typescript-build.yml.github/workflows/typescript-ci.yml.github/workflows/typescript-release.yml.github/workflows/version-propagation.yml.github/workflows/workflow-runs-cleanup.yml
…ritative Addresses CodeRabbit findings on PR #600: - Restore blacksmith-4vcpu-ubuntu-2404 (or 'blacksmith' for gptchangelog.yml, matching its pre-existing value) as the final fallback/default across all reusable workflows, per the repo's documented runner policy (.claude/commands/gha.md, workflow.md). vars.GENERAL_RUNNERS remains the primary override. - api-dog-e2e-tests.yml and end-to-end-tests.yml: drop the vars.GENERAL_RUNNERS override entirely — these jobs require network-reachable runners (eveo-lxc-runners) and must keep inputs.runner_type authoritative. - go-fuzz.yml and release-notification.yml: dry-run summaries now report the effective resolved runner instead of the raw input.
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/go-fuzz.yml:
- Line 91: Update the dry-run summary step in the workflow to pass the resolved
runner value through the step’s env configuration, then echo the environment
variable instead of interpolating inputs.runner_type directly in the run script.
Leave the runs-on configuration unchanged.
In @.github/workflows/release-notification.yml:
- Line 152: Update the dry-run step containing the runner echo to resolve
GENERAL_RUNNERS through the step’s env configuration, including its existing
default, and print the resulting shell variable instead of interpolating
vars.GENERAL_RUNNERS directly in the run block. Preserve the displayed fallback
value while preventing runner labels from altering the generated shell script.
In @.github/workflows/version-propagation.yml:
- Line 56: Replace the dynamic GENERAL_RUNNERS overrides with the approved
blacksmith-4vcpu-ubuntu-2404 runner for the affected jobs:
.github/workflows/version-propagation.yml:56, .github/workflows/stale-pr.yml:38,
.github/workflows/typescript-build.yml:162 and :259,
.github/workflows/typescript-release.yml:47 and :101, and
.github/workflows/workflow-runs-cleanup.yml:43. Ensure all reusable-workflow
jobs use this fixed approved runner and cannot be redirected through an
unvalidated variable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: a83eb12b-a6de-4e7c-8c03-2e2b2387c32f
📒 Files selected for processing (34)
.github/workflows/backmerge.yml.github/workflows/branch-cleanup.yml.github/workflows/build.yml.github/workflows/dispatch-helm.yml.github/workflows/frontend-pr-analysis.yml.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml.github/workflows/go-lambda-release.yml.github/workflows/go-pr-analysis.yml.github/workflows/go-pr-validation.yml.github/workflows/go-security.yml.github/workflows/gptchangelog.yml.github/workflows/helm-alpha-cleanup.yml.github/workflows/helm-alpha-release.yml.github/workflows/helm-release-notification.yml.github/workflows/helm-update-chart.yml.github/workflows/helm-upgrade-doc.yml.github/workflows/js-pr-validation.yml.github/workflows/labels-sync.yml.github/workflows/lerian-lib-version-check.yml.github/workflows/pr-security-scan.yml.github/workflows/pr-validation.yml.github/workflows/release-notification.yml.github/workflows/release.yml.github/workflows/s3-upload.yml.github/workflows/self-pr-validation.yml.github/workflows/slack-notify.yml.github/workflows/stale-issue.yml.github/workflows/stale-pr.yml.github/workflows/typescript-build.yml.github/workflows/typescript-ci.yml.github/workflows/typescript-release.yml.github/workflows/version-propagation.yml.github/workflows/workflow-runs-cleanup.yml
Addresses CodeRabbit/zizmor template-injection findings on go-fuzz.yml:91 and release-notification.yml:152. The resolved runner (vars.GENERAL_RUNNERS || input/literal) is now passed through a step-level env var and printed via the shell variable instead of being interpolated directly into the run: block.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by: Bedatty — Padronizar runners via vars.RUNNER_LABEL para todos os workflows shared (exceto gitops e ungoliant que já têm lógica própria). PR equivalente ao #599 mas targetting develop.