Fix S3 path for RC builds

[rberezen]

No description provided.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request modifies the RC secure artifact S3 download path in the build workflow from releases/rc/${VERSION} to non-releases/secure/${VERSION}. This configuration change affects how RC-based secure-version builds retrieve artifacts, while production paths remain unaffected.

Changes

Cohort / File(s)	Summary
Workflow Configuration .github/workflows/build-qa-docker.yml	Updated RC secure artifact S3 path from releases/rc to non-releases/secure directory structure.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• Fixed path for RC builds #455: Modifies the same RC secure artifact S3 path in the build workflow, though with a different target directory structure.

Suggested reviewers

• jnewton03
• sayaliM0412
• jandroav

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	No pull request description was provided by the author, so this check cannot assess alignment with the changeset.	Add a description explaining the purpose of the S3 path change and why the RC builds require this path modification.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Fix S3 path for RC builds' directly and clearly summarizes the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch rc_fix

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude finished @rberezen's task in 36s —— View job

---

PR Review: Fix S3 path for RC builds

Tasks

• Gather PR diff and context
• Review changes for critical issues
• Post review findings

---

Review Findings

LGTM - no significant issues found

The change updates the S3 path for RC builds from s3://repo.liquibase.com/releases/rc/${VERSION}/ to s3://repo.liquibase.com/non-releases/secure/${VERSION}/, which appears to be a path correction for release candidate artifacts.

Verified:

• Logic for RC version detection (regex pattern) remains unchanged
• Regular production versions still use the correct path (releases/secure/)
• Error handling and fallback logic are preserved
• The echo statement on line 175 correctly describes the path as "RC S3 path"

---

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/build-qa-docker.yml (1)

326-337: ⚠️ Potential issue | 🟠 Major

Stale RC S3 path in download-after-trigger — same bug, missed in the parallel path.

Line 333 still uses the old releases/rc/${VERSION} path, which is exactly what was fixed on line 174. Although this branch is currently unreachable — download-after-trigger only executes when trigger_liquibase_secure_workflow == 'true', and that output is only ever set when inputs.secure-version is empty (so the if [[ -n "${{ inputs.secure-version }}" ]] condition on line 326 is always false) — the stale URL is a latent regression: if the step guard is relaxed in a future change, it will silently hit the wrong S3 path.

Apply the same fix here for consistency:

🐛 Proposed fix

       if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-RC([0-9]+)$ ]]; then
         BASE_VERSION="${BASH_REMATCH[1]}"
         RC_NUMBER="${BASH_REMATCH[2]}"
         LIQUIBASE_SECURE_ZIP="liquibase-secure-${VERSION}.tar.gz"
-        S3_URL="s3://repo.liquibase.com/releases/rc/${VERSION}/${LIQUIBASE_SECURE_ZIP}"
+        S3_URL="s3://repo.liquibase.com/non-releases/secure/${VERSION}/${LIQUIBASE_SECURE_ZIP}"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-qa-docker.yml around lines 326 - 337, Stale RC S3
path: in the branch matching the RC regex for inputs.secure-version, update the
LIQUIBASE_SECURE_ZIP/S3_URL assignment to mirror the fix applied earlier by
using BASE_VERSION and RC_NUMBER (not the raw VERSION) and the corrected
releases/rc path; specifically change the S3_URL construction in that RC branch
so it references
releases/rc/${BASE_VERSION}-RC${RC_NUMBER}/${LIQUIBASE_SECURE_ZIP} (and adjust
LIQUIBASE_SECURE_ZIP if your earlier fix altered its name) to ensure the RC
upload/download path is consistent with the prior fix.

🧹 Nitpick comments (1)

.github/workflows/build-qa-docker.yml (1)

171-172: BASE_VERSION and RC_NUMBER are captured but never used.

These variables are extracted on lines 171–172 (and again on 330–331 in download-after-trigger) but are not referenced anywhere in either step. Remove them to reduce noise, or document their intended future use.

🧹 Proposed cleanup (apply in both download steps)

       if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-RC([0-9]+)$ ]]; then
-        BASE_VERSION="${BASH_REMATCH[1]}"
-        RC_NUMBER="${BASH_REMATCH[2]}"
         LIQUIBASE_SECURE_ZIP="liquibase-secure-${VERSION}.tar.gz"
         S3_URL="s3://repo.liquibase.com/non-releases/secure/${VERSION}/${LIQUIBASE_SECURE_ZIP}"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-qa-docker.yml around lines 171 - 172, Remove the
unused variable assignments BASE_VERSION and RC_NUMBER from the download steps:
delete the two lines that set BASE_VERSION="${BASH_REMATCH[1]}" and
RC_NUMBER="${BASH_REMATCH[2]}" (and the duplicate occurrences in the other
download-after-trigger step) so the workflow no longer captures unused values;
if you intend to keep them for future use instead, add a comment explaining
their planned purpose.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/build-qa-docker.yml:
- Around line 326-337: Stale RC S3 path: in the branch matching the RC regex for
inputs.secure-version, update the LIQUIBASE_SECURE_ZIP/S3_URL assignment to
mirror the fix applied earlier by using BASE_VERSION and RC_NUMBER (not the raw
VERSION) and the corrected releases/rc path; specifically change the S3_URL
construction in that RC branch so it references
releases/rc/${BASE_VERSION}-RC${RC_NUMBER}/${LIQUIBASE_SECURE_ZIP} (and adjust
LIQUIBASE_SECURE_ZIP if your earlier fix altered its name) to ensure the RC
upload/download path is consistent with the prior fix.

---

Nitpick comments:
In @.github/workflows/build-qa-docker.yml:
- Around line 171-172: Remove the unused variable assignments BASE_VERSION and
RC_NUMBER from the download steps: delete the two lines that set
BASE_VERSION="${BASH_REMATCH[1]}" and RC_NUMBER="${BASH_REMATCH[2]}" (and the
duplicate occurrences in the other download-after-trigger step) so the workflow
no longer captures unused values; if you intend to keep them for future use
instead, add a comment explaining their planned purpose.

[claude]

Claude finished @jandroav's task in 1m 7s —— View job

---

PR Review: Fix S3 path for RC builds

Tasks

• Gather PR diff and context
• Review changes for critical issues
• Post review findings

---

Review Findings

The fix at line 174 correctly updates the initial download path from releases/rc/${VERSION} to non-releases/secure/${VERSION}.

Issue: Stale RC S3 path in download-after-trigger step

Line 333 in the download-after-trigger step contains the same bug and was not updated:

# Line 333 - still uses old path:
S3_URL="s3://repo.liquibase.com/releases/rc/${VERSION}/${LIQUIBASE_SECURE_ZIP}"
# Should be:
S3_URL="s3://repo.liquibase.com/non-releases/secure/${VERSION}/${LIQUIBASE_SECURE_ZIP}"

This step is currently unreachable with secure-version set (since trigger_liquibase_secure_workflow is only true when secure-version is empty), but it's a latent bug that will silently use the wrong path if the step guard changes in the future. Fix this →

Minor: BASE_VERSION and RC_NUMBER (lines 171–172, 330–331) are captured but never referenced — can be removed.

---