Conversation
📝 WalkthroughWalkthroughGitHub Actions workflows upgraded to force JavaScript actions to Node 24, and Docker action versions bumped (v3→v4 for setup-buildx, v6→v7 for build-push, v3→v4 for login). CI lint step refactored to use direct shell-based golangci-lint installation instead of the dedicated action. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflows to be compatible with (and explicitly opt into) Node 24 execution, while keeping golangci-lint pinned at v1.64.8 by installing/running it directly instead of using the action.
Changes:
- Opt workflows into Node 24 execution via
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24. - Replace
golangci-lint-actionusage with ago install ...@v1.64.8+ directgolangci-lint run. - Bump Docker-related GitHub Actions used in CI/E2E (Buildx + build/push, and login in CI).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/ci.yml | Node 24 env opt-in, switch golangci-lint to direct install/run, update Docker action versions in build/deploy jobs |
| .github/workflows/e2e.yml | Node 24 env opt-in, update Docker action versions used to build the API image |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| version: v1.64.8 | ||
| run: | | ||
| go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 | ||
| "$(go env GOPATH)/bin/golangci-lint" run ./... |
There was a problem hiding this comment.
The lint step installs golangci-lint via go install ...@v1.64.8, but then invokes it via "$(go env GOPATH)/bin/golangci-lint". This can break if GOBIN is set (binary won’t land in GOPATH/bin) or if GOPATH contains multiple entries. Prefer invoking golangci-lint from PATH (actions/setup-go typically adds the install dir) or resolve the install location via go env GOBIN (with a GOPATH/bin fallback).
| "$(go env GOPATH)/bin/golangci-lint" run ./... | |
| GOBIN_DIR="$(go env GOBIN)" | |
| if [ -z "$GOBIN_DIR" ]; then | |
| GOBIN_DIR="$(go env GOPATH)/bin" | |
| fi | |
| "$GOBIN_DIR/golangci-lint" run ./... |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
347-350: Consider pinning these upgraded Docker actions to immutable commit SHAs.Using major tags is convenient, but SHA pinning improves supply-chain integrity for CI/CD workflows.
Suggested hardening pattern
- uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@<resolved-commit-sha> - uses: docker/login-action@v4 + uses: docker/login-action@<resolved-commit-sha> - uses: docker/build-push-action@v7 + uses: docker/build-push-action@<resolved-commit-sha>Also applies to: 379-380, 388-389, 395-396, 418-419, 426-427, 433-434
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 347 - 350, Replace loose major-version tags for GitHub Actions with immutable commit SHAs: locate usages of docker/setup-buildx-action@v4 and docker/build-push-action@v7 (and the other occurrences noted around the file) and update each "uses:" entry to reference the specific repository@<commit-sha> for the tested commit; ensure you pick the verified commit SHA for the action version you intend to use and update all matching lines (the instances at the shown diff and the additional occurrences) so the workflow uses SHA-pinned refs instead of major tags.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 347-350: Replace loose major-version tags for GitHub Actions with
immutable commit SHAs: locate usages of docker/setup-buildx-action@v4 and
docker/build-push-action@v7 (and the other occurrences noted around the file)
and update each "uses:" entry to reference the specific repository@<commit-sha>
for the tested commit; ensure you pick the verified commit SHA for the action
version you intend to use and update all matching lines (the instances at the
shown diff and the additional occurrences) so the workflow uses SHA-pinned refs
instead of major tags.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 06df6093-5fe2-4657-9892-488507f81410
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/e2e.yml
Summary
golangci-lint-actionupgrade with a directgolangci-lintinstall/run while keeping the repo onv1.64.8Testing
.github/workflows/ci.ymland.github/workflows/e2e.ymlSummary by CodeRabbit