fix(ci): skip optional publish paths without credentials#3
Merged
Conversation
- Skip crates.io publish/release steps when cargo token secrets are absent - Skip Pages deployment when repository Pages is not enabled - Keep lint/test/build green for issue #347 Rust browser module publication
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe release workflow now adds conditional checks before publishing artifacts. Crates.io publish steps in both release jobs require credential presence, GitHub Release creation depends on successful crate publication, and documentation deployment checks GitHub Pages availability before proceeding with the build and upload sequence. ChangesRelease Workflow Publishing Gates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 513: The current GitHub Actions if condition requires
steps.publish-crate.outcome == 'success' which blocks continuing the release
when steps.version.outputs.already_released == 'true' and publishing was
intentionally skipped; update both if expressions referencing
steps.publish-crate.outcome (the ones that combine
steps.version.outputs.version_committed / already_released with
publish-crate.outcome) to allow a skipped publish as well (e.g., treat outcome
'skipped' or non-failure as acceptable) so the release can proceed when
already_released == 'true'.
- Line 698: Replace the mutable action tags with the provided immutable commit
SHAs: change uses: actions/configure-pages@v6 to uses:
actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d and change
uses: actions/upload-pages-artifact@v5 to uses:
actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9; update
every occurrence of the two action references in the workflow so the GitHub
Pages steps use the pinned SHAs instead of the major tags.
- Around line 682-690: The current curl check using `curl -fsS -H
"Authorization: Bearer ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json"
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages"` masks auth/rate-limit and
other API errors as "disabled"; change it to capture the HTTP status (e.g.,
`curl -sS -o /dev/null -w "%{http_code}" ...`) and branch on the status: if 200
set `enabled=true` to `GITHUB_OUTPUT`, if 404 set `enabled=false` and emit the
existing warning, and for any other status emit an error message with the HTTP
code and fail the job (non-zero exit) so auth/rate-limit/transient problems
aren’t silently skipped; reference the `curl ...
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages"`, `GITHUB_TOKEN`, and
`GITHUB_OUTPUT` variables when implementing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 23fe41b3-1817-4532-9fee-6727236cbe21
📒 Files selected for processing (1)
.github/workflows/release.yml
|
|
||
| - name: Wait for Crate availability on Crates.io | ||
| if: steps.version.outputs.version_committed == 'true' || steps.version.outputs.already_released == 'true' | ||
| if: (steps.version.outputs.version_committed == 'true' || steps.version.outputs.already_released == 'true') && steps.publish-crate.outcome == 'success' |
There was a problem hiding this comment.
Manual release gating blocks GitHub Release when crate is already published
Line 577 (and similarly Line 513) requires steps.publish-crate.outcome == 'success'. That prevents release continuation when already_released == 'true' and publish is intentionally skipped (e.g., no token). This diverges from the auto-release path behavior.
Suggested fix
- - name: Wait for Crate availability on Crates.io
- if: (steps.version.outputs.version_committed == 'true' || steps.version.outputs.already_released == 'true') && steps.publish-crate.outcome == 'success'
+ - name: Wait for Crate availability on Crates.io
+ if: (steps.version.outputs.version_committed == 'true' || steps.version.outputs.already_released == 'true') && (steps.version.outputs.already_released == 'true' || steps.publish-crate.outcome == 'success')
run: rust-script scripts/wait-for-crate.rs --release-version "${{ steps.version.outputs.new_version }}"
- - name: Create GitHub Release
- if: (steps.version.outputs.version_committed == 'true' || steps.version.outputs.already_released == 'true') && steps.publish-crate.outcome == 'success'
+ - name: Create GitHub Release
+ if: (steps.version.outputs.version_committed == 'true' || steps.version.outputs.already_released == 'true') && (steps.version.outputs.already_released == 'true' || steps.publish-crate.outcome == 'success')Also applies to: 577-577
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 513, The current GitHub Actions if
condition requires steps.publish-crate.outcome == 'success' which blocks
continuing the release when steps.version.outputs.already_released == 'true' and
publishing was intentionally skipped; update both if expressions referencing
steps.publish-crate.outcome (the ones that combine
steps.version.outputs.version_committed / already_released with
publish-crate.outcome) to allow a skipped publish as well (e.g., treat outcome
'skipped' or non-failure as acceptable) so the release can proceed when
already_released == 'true'.
Comment on lines
+682
to
+690
| if curl -fsS \ | ||
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages" >/dev/null; then | ||
| echo "enabled=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "enabled=false" >> "$GITHUB_OUTPUT" | ||
| echo "::warning::Skipping docs deploy because GitHub Pages is not enabled for GitHub Actions" | ||
| fi |
There was a problem hiding this comment.
Pages check currently masks non-404 API failures as “disabled”
Line 682’s curl -fsS path collapses auth/rate-limit/transient API errors into a soft skip. That can silently suppress docs deployment on real failures.
Suggested fix
- name: Check GitHub Pages configuration
id: pages
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
- if curl -fsS \
- -H "Authorization: Bearer ${GITHUB_TOKEN}" \
- -H "Accept: application/vnd.github+json" \
- "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages" >/dev/null; then
- echo "enabled=true" >> "$GITHUB_OUTPUT"
- else
- echo "enabled=false" >> "$GITHUB_OUTPUT"
- echo "::warning::Skipping docs deploy because GitHub Pages is not enabled for GitHub Actions"
- fi
+ status="$(curl -sS -o /dev/null -w "%{http_code}" \
+ -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+ -H "Accept: application/vnd.github+json" \
+ "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages")"
+ if [ "$status" = "200" ]; then
+ echo "enabled=true" >> "$GITHUB_OUTPUT"
+ elif [ "$status" = "404" ]; then
+ echo "enabled=false" >> "$GITHUB_OUTPUT"
+ echo "::warning::Skipping docs deploy because GitHub Pages is not enabled for GitHub Actions"
+ else
+ echo "::error::Failed to verify GitHub Pages configuration (HTTP $status)"
+ exit 1
+ fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 682 - 690, The current curl check
using `curl -fsS -H "Authorization: Bearer ${GITHUB_TOKEN}" -H "Accept:
application/vnd.github+json"
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages"` masks auth/rate-limit and
other API errors as "disabled"; change it to capture the HTTP status (e.g.,
`curl -sS -o /dev/null -w "%{http_code}" ...`) and branch on the status: if 200
set `enabled=true` to `GITHUB_OUTPUT`, if 404 set `enabled=false` and emit the
existing warning, and for any other status emit an error message with the HTTP
code and fail the job (non-zero exit) so auth/rate-limit/transient problems
aren’t silently skipped; reference the `curl ...
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pages"`, `GITHUB_TOKEN`, and
`GITHUB_OUTPUT` variables when implementing.
|
|
||
| - name: Configure GitHub Pages | ||
| if: steps.pages.outputs.enabled == 'true' | ||
| uses: actions/configure-pages@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Read-only verification: resolve current SHAs behind the tags so you can pin them.
set -euo pipefail
for repo_tag in \
"actions/configure-pages v6" \
"actions/upload-pages-artifact v5"
do
repo="${repo_tag% *}"
tag="${repo_tag#* }"
sha="$(gh api "repos/${repo}/git/ref/tags/${tag}" --jq '.object.sha')"
echo "${repo}@${tag} -> ${sha}"
doneRepository: ProverCoderAI/rust-browser-connection
Length of output: 229
Pin GitHub Pages GitHub Actions to immutable commit SHAs (supply-chain integrity)
In .github/workflows/release.yml, mutable major tags are used:
actions/configure-pages@v6→45bfe0192ca1faeb007ade9deae92b16b8254a0dactions/upload-pages-artifact@v5→fc324d3547104276b827a68afc52ff2a11cc49c9
Replace:
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9🧰 Tools
🪛 zizmor (1.25.2)
[error] 698-698: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 698, Replace the mutable action tags
with the provided immutable commit SHAs: change uses: actions/configure-pages@v6
to uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d and
change uses: actions/upload-pages-artifact@v5 to uses:
actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9; update
every occurrence of the two action references in the workflow so the GitHub
Pages steps use the pinned SHAs instead of the major tags.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
Relates to ProverCoderAI/docker-git#347.