chore: replace curl/jq with gh CLI for release resolution and downloads#16
Conversation
…loads gh CLI handles auth, retries, rate limiting, and pagination natively. - gh release list replaces the curl + jq pipeline for version resolution - gh release download replaces curl for tarball fetching, writing to disk before hashing instead of piping through sha256sum Removes manual retry flags and API response validation since gh handles all of that internally. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
PR SummaryMedium Risk Overview Checksum generation is refactored to Written by Cursor Bugbot for commit 8cd5e2e. This will update automatically on new commits. Configure here. |
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
gh CLI's --jq flag does not support --arg for passing variables into jq expressions (cli/cli#10263). Interpolate the prefix directly into the jq string via the Actions expression syntax instead. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
yordis
changed the title
| --repo "${{ matrix.upstream_repo }}" \ | ||
| --limit 100 \ | ||
| --json tagName \ | ||
| --jq '[.[] | select(.tagName | startswith("${{ matrix.tag_prefix }}") and (contains("/") | not))] | first | .tagName | ltrimstr("${{ matrix.tag_prefix }}")') |
There was a problem hiding this comment.
Unsafe direct interpolation of tag_prefix into jq expression
Low Severity
The ${{ matrix.tag_prefix }} value is directly interpolated into the --jq expression string (inside double quotes in the jq filter). The old code safely passed the prefix via jq --arg prefix, which properly escapes special characters. The gh --jq flag does not support --arg, so if a tag_prefix ever contains characters meaningful to jq (like " or \), the jq expression would be malformed and the step would fail silently or produce incorrect results. Current matrix values are safe, but this is a robustness regression from the prior approach.
1 participant
Replaces the raw `curl | jq` approach with the `gh` CLI which is pre-installed on all GitHub-hosted runners and handles auth, retries, rate limiting, and pagination natively.
Changes:
Closes the 504 flakiness on `otel-collector` that was caused by GitHub API timeouts on large external repos.