chore(release): promote v1.51.0 - #650
Merged
Merged
Conversation
Reusable workflow_call that builds a frontend SPA, authenticates to AWS via an OIDC role (no static keys), syncs the built dist to a private S3 bucket with differentiated Cache-Control (assets immutable, HTML no-store, HTML uploaded last), and invalidates CloudFront. Fills the gap where s3-upload cannot deploy an SPA (no build, no artifact input, env-folder routing, no Cache-Control, no invalidation). SHA-pinned actions, least-priv permissions, dry_run supported.
Refactor spa-deploy.yml from an inlined build+deploy workflow into a thin orchestrator that delegates the complex S3 sync and CloudFront invalidation shell to single-responsibility composites, per the reusable-workflow architecture model. - add src/deploy/s3-sync (differentiated Cache-Control: assets immutable with --delete, *.html no-store uploaded last) - add src/deploy/cloudfront-invalidate (create-invalidation, dry-run aware) - reuse src/setup/aws-cli so composites' aws calls work on self-hosted runners - keep OIDC-only auth and secret routing in the workflow - add deploy label + labeler mapping for src/deploy/** - update docs/spa-deploy.md to reflect the composite delegation
Comply with .claude/commands/workflow.md: - Reference composites via LerianStudio/.../src/<cap>/<name>@ref instead of ./src/... — a local path in a workflow_call reusable resolves to the CALLER's workspace and breaks for external callers (critical rule). - Remove workflow_dispatch: a reusable workflow must be workflow_call only; build_command is free-text and eval'd, so a manual-dispatch string input would be a command-injection surface.
…le HTML, doc fixes - Dry run is now fully local: workflow skips AWS CLI + OIDC credential steps and the s3-sync composite prints the resolved plan (no AWS calls, no role assumed). - s3-sync HTML pass now uses --delete scoped to *.html so obsolete HTML is pruned. - Align deploy label description with the paths the labeler covers. - README composite-step examples use dry-run: false (no workflow input in scope). - docs/spa-deploy.md reflects the local dry-run behavior.
…ed short-lived creds - environment input → job-level GitHub Environment gate (required reviewers / branch protection / environment-scoped OIDC trust); empty = no gate. - concurrency group per s3_bucket with cancel-in-progress: false so a --delete sync never races a concurrent run. - configure-aws-credentials: per-run role-session-name (CloudTrail attribution) and short role-duration-seconds (default 900, overridable).
- Stable-named non-fingerprinted files (service-worker.js, manifest.webmanifest, robots.txt, favicon.ico) no longer inherit the immutable 1y Cache-Control — a dedicated pass syncs them with a revalidation policy (configurable via revalidate-globs / revalidate-cache-control) so updates propagate. - README composite-step examples are now complete workflows with the required runs-on: blacksmith-4vcpu-ubuntu-2404 and external composite refs.
…arify concurrency scope - Add a dry_run-only step that emits ::notice:: with every resolved non-secret input (working dir, build command, dist, bucket, distribution id, region, environment, role duration). AWS_DEPLOY_ROLE_ARN is never echoed. - Reword the concurrency comment + docs: GitHub concurrency is repository-scoped, so serialization covers a single-owner bucket, not a bucket shared across repos.
…ated bucket - Refuse to sync when the distribution has no regular files — an empty/missing dist with --delete would wipe the entire bucket. Guard in the composite (safe standalone) and tighten the workflow's build-output check to regular files. - Document that the bucket must be dedicated (--delete prunes the root).
X-Lerian-Ref: 0x1
… step Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughChangesThe pull request adds reusable SPA deployment workflows and composite actions for S3 and CloudFront. It also adds a breaking-change guard action, integration tests, documentation, CI execution, and deployment labeling. SPA deployment automation
Breaking-change validation
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
lerian-studio
added
size/XL
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
Contributor
🛡️ CodeQL Analysis ResultsLanguages analyzed: ✅ No security issues found. 🔍 View full scan logs | 🛡️ Security tab |
Contributor
🔍 Lint Analysis
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/spa-deploy.yml:
- Around line 163-184: Update the “Dry-run deployment plan (resolved inputs)”
step to expose the missing resolved inputs: add NODE_VERSION from
inputs.node_version and print it, and add DRY_RUN from inputs.dry_run and print
it alongside the other plan values. Preserve the existing
environment-variable-based output structure.
- Around line 209-216: Update the deployment composite references in the
spa-deploy workflow, specifically the S3 sync and CloudFront invalidation steps,
to use an immutable released tag containing both composites instead of the
mutable `@develop` reference. Prefer `@v1` once available; otherwise use the
appropriate released tag.
In `@src/validate/breaking-change-guard/README.md`:
- Around line 75-78: Update the README examples using actions/checkout to
include a concise note explaining that it materializes HEAD and fetches full
history needed to resolve origin/<base-ref>..HEAD. Apply the note consistently
to the checkout usages in all referenced examples.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: e2db8e7b-b794-4fa0-899d-7480bdd0bd23
📒 Files selected for processing (13)
.github/labeler.yml.github/labels.yml.github/workflows/self-pr-validation.yml.github/workflows/spa-deploy.ymldocs/spa-deploy.mdsrc/deploy/cloudfront-invalidate/README.mdsrc/deploy/cloudfront-invalidate/action.ymlsrc/deploy/s3-sync/README.mdsrc/deploy/s3-sync/action.ymlsrc/validate/breaking-change-guard/README.mdsrc/validate/breaking-change-guard/action.ymlsrc/validate/breaking-change-guard/detect.shsrc/validate/breaking-change-guard/test.sh
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
fredcamaral
temporarily deployed
to
create_release
August 6, 2026 06:12 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
…(breaking-change-guard): explain checkout requirement Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
fredcamaral
temporarily deployed
to
create_release
August 6, 2026 06:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/spa-deploy.yml:
- Around line 213-220: Publish the stable shared workflow version v1.51.0,
including both the S3 sync and CloudFront invalidation composites, before
promoting SPA Deploy. Then update the deploy steps to reference the stable
`@v1.51.0` release and remove both TODO comments from the workflow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9dc66dcd-cecc-4675-be6a-f9c7a1baedc0
📒 Files selected for processing (2)
.github/workflows/spa-deploy.ymlsrc/validate/breaking-change-guard/README.md
Member
Author
|
@BlackSmith -- ainda temos um minor do coderabbit que faz sentido. |
|
Got it, I'm reviewing the PR details now. |
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
O minor que sobrou faz sentido sim, e a razão é a própria política do repo: O argumento "chicken-and-egg" da minha resposta anterior não se aplica a Commit # Composites are pinned to the floating major tag (@v1) per the internal
# pinning policy (src/lint/pinned-actions). The v1 tag advances on every
# release, so both composites resolve as soon as this promotion ships and
# semantic-release moves v1 forward (same bootstrap as end-to-end-tests.yml).
- name: Sync SPA to S3 (differentiated Cache-Control)
uses: LerianStudio/github-actions-shared-workflows/src/deploy/s3-sync@v1Ambos os TODOs foram removidos, e os warnings do Pinned Actions Check devem zerar no próximo run. |
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg)
fredcamaral
temporarily deployed
to
create_release
August 6, 2026 06:29 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Promotes the validated
developstate tomainfor the stablev1.51.0release.This promotion includes:
Develop published
v1.51.0-beta.2successfully. The beta contains the Breaking Change Guard action and the release workflow completed successfully: https://github.com/LerianStudio/github-actions-shared-workflows/actions/runs/31075949056Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None.
Testing
@this-branchor the beta tagCaller repo / workflow run: Develop beta release
v1.51.0-beta.2: https://github.com/LerianStudio/github-actions-shared-workflows/actions/runs/31075949056Related Issues
Related PRs: #647 and #649.