chore(release): develop to main

[bedatty]

GitHub Actions Shared Workflows

---

Description

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

Summary by CodeRabbit

Release Notes

• Chores

  • Updated CI/CD workflows with pinned GitHub Actions versions across multiple pipeline configurations.

• New Features

  • Expanded release workflow configuration options for app naming, Docker build customization, Helm deployment, and GitOps controls.
  • Enhanced documentation for release workflow parameters.

• Bug Fixes

  • Improved version tag filtering logic to more accurately identify stable releases.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

Pins actions/checkout to the v6.0.3 commit SHA across all shared workflow files. Separately, expands go-release.yml's workflow_call interface with 17 new inputs covering monorepo app naming, Docker/Helm dispatch, and GitOps/ArgoCD deployment controls, forwarding them to child build and gitops-update jobs. Updates docs/go-release-workflow.md accordingly. Fixes resolve_latest() in lerian-lib-version to filter stable tags by a v?.MAJOR.MINOR.PATCH regex in addition to GitHub's prerelease flag.

Changes

actions/checkout SHA bump

Layer / File(s)

Summary

Bulk actions/checkout repinning .github/workflows/api-dog-e2e-tests.yml, .github/workflows/backmerge.yml, .github/workflows/build.yml, .github/workflows/dispatch-helm.yml, .github/workflows/frontend-pr-analysis.yml, .github/workflows/gitops-update.yml, .github/workflows/go-ci.yml, .github/workflows/go-fuzz.yml, .github/workflows/go-pr-analysis.yml, .github/workflows/go-security.yml, .github/workflows/gptchangelog.yml, .github/workflows/helm-release-notification.yml, .github/workflows/helm-update-chart.yml, .github/workflows/lerian-lib-version-check.yml, .github/workflows/pr-security-scan.yml, .github/workflows/pr-validation.yml, .github/workflows/release-notification.yml, .github/workflows/release.yml, .github/workflows/s3-upload.yml, .github/workflows/self-pr-validation.yml, .github/workflows/typescript-build.yml, .github/workflows/typescript-ci.yml, .github/workflows/typescript-release.yml, .github/workflows/version-propagation.yml

Every checkout step across all shared workflows is updated from de0fac2e... to df4cb1c0... (v6.0.3). No other workflow logic is altered.

---

go-release interface expansion and lerian-lib pre-release fix

Layer / File(s)	Summary
go-release.yml new inputs and job wiring .github/workflows/go-release.yml	Adds 17 new workflow_call inputs for app naming (app_name_prefix, app_name_overrides), Docker/Helm (dockerhub_org, path_level, build_context_from_working_dir, enable_helm_dispatch, helm_chart, helm_detect_env_changes, helm_values_key_mappings), and GitOps/deployment (gitops_runner_type, enable_argocd_sync, commit_message_prefix, deploy_in_firmino, deploy_in_clotilde, use_dynamic_mapping, configmap_updates, enable_docker_login). The tag-triggered build and update_gitops jobs are updated to forward these inputs to child workflows. runner_type is replaced by gitops_runner_type in the update_gitops job wiring.
go-release-workflow.md documentation update docs/go-release-workflow.md	Extends the Inputs table with all newly added inputs for app naming, Docker/Helm, and GitOps/deployment controls.
lerian-lib-version stable-tag regex filter src/validate/lerian-lib-version/action.yml	Adds grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+$' to resolve_latest() as a belt-and-suspenders filter after GitHub's prerelease flag check, ensuring -beta/-rc tags are excluded from the stable latest calculation. Comments updated to explain that the prerelease flag is unreliable alone.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• feat(go-release): expose helm-dispatch and gitops-update inputs for multi-cluster deploy #432: The go-release.yml expansion directly implements the requested input forwarding for Helm dispatch, multi-cluster GitOps, ArgoCD sync, and related controls described in this issue.
• fix(lerian-lib-version): pre-release tags can be picked as 'latest' (false Outdated) #430: The regex filter added to resolve_latest() in src/validate/lerian-lib-version/action.yml directly implements the fix proposed in this issue.

Possibly related PRs

• LerianStudio/github-actions-shared-workflows#166: Overlaps directly with this PR's addition of build_context_from_working_dir and enable_docker_login inputs to go-release.yml.
• LerianStudio/github-actions-shared-workflows#431: Both PRs modify resolve_latest() in src/validate/lerian-lib-version/action.yml to add a stable vMAJOR.MINOR.PATCH regex filter excluding pre-release tags.
• LerianStudio/github-actions-shared-workflows#433: Both PRs add gitops_runner_type and Helm/GitOps-related inputs to go-release.yml's reusable workflow interface.

Suggested labels

workflow, documentation, golang, size/XL

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The PR title 'chore(release): develop to main' is vague and does not clearly convey the specific changes in the changeset (actions/checkout upgrades, bug fixes, new workflow inputs, documentation).	Use a more specific title that reflects the primary technical changes, such as 'chore(deps): upgrade actions/checkout to v6.0.3 and expand go-release workflow inputs'.
Description check	❓ Inconclusive	The description is largely a template with checkboxes marked for 'feat', 'fix', and 'docs', and a completed testing checklist, but lacks substantive detail about what functionality was added, what bugs were fixed, or which inputs/workflows were affected.	Fill in the Description section with specific details about the changes: dependency upgrades, pre-release filtering fix, new go-release inputs, and relevant documentation updates.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	26 file(s)	✅ success
Action Lint	25 file(s)	❌ failure
Pinned Actions	26 file(s)	❌ failure
Markdown Link Check	1 file(s)	✅ success
Spelling Check	27 file(s)	✅ success
Shell Check	26 file(s)	✅ success
README Check	26 file(s)	✅ success
Composite Schema	1 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

❌ Failures (2)

Action Lint

.github/workflows/dispatch-helm.yml

• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:8:27: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:7:12: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:6:46: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:5:61: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:4:12: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:3:32: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:13:138: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:11:50: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 335) — shellcheck reported issue in this script: SC2086:info:10:50: Double quote to prevent globbing and word splitting
• .github/workflows/dispatch-helm.yml (line 109) — shellcheck reported issue in this script: SC2086:info:171:46: Double quote to prevent globbing and word splitting

Pinned Actions

.github/workflows/go-ci.yml

• .github/workflows/go-ci.yml (line 149) — External action not pinned by SHA: uses: golangci/golangci-lint-action@v9 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 143) — External action not pinned by SHA: uses: actions/setup-go@v6 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 140) — External action not pinned by SHA: uses: actions/checkout@v6.0.3 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 129) — External action not pinned by SHA: uses: fgrosse/go-coverage-report@v1.3.0 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 124) — External action not pinned by SHA: uses: actions/download-artifact@v8 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 121) — External action not pinned by SHA: uses: actions/checkout@v6.0.3 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 104) — External action not pinned by SHA: uses: actions/upload-artifact@v7 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 85) — External action not pinned by SHA: uses: actions/setup-go@v6 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 82) — External action not pinned by SHA: uses: actions/checkout@v6.0.3 (use full commit SHA with a # vX.Y.Z comment)

.github/workflows/dispatch-helm.yml

• .github/workflows/dispatch-helm.yml (line 103) — External action not pinned by SHA: uses: actions/checkout@v6.0.3 (use full commit SHA with a # vX.Y.Z comment)

⚠️ Warnings (3)

Pinned Actions

.github

• .github (line 162) — Found 2 internal action(s) not pinned to a version. Consider pinning to vX.Y.Z.

.github/workflows/release-notification.yml

• .github/workflows/release-notification.yml (line 180) — Internal composite must use floating major tag (e.g. @v1) or develop/main for testing: uses: LerianStudio/github-actions-shared-workflows/src/notify/slack-release@v1.18.0
• .github/workflows/release-notification.yml (line 168) — Internal composite must use floating major tag (e.g. @v1) or develop/main for testing: uses: LerianStudio/github-actions-shared-workflows/src/notify/discord-release@v1.18.0

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 3 issue(s): 3 Medium

Severity	Rule	File	Message
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:143	Potential unsafe checkout of untrusted pull request on privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:151	Potential unsafe checkout of untrusted pull request on privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/version-propagation.yml:62	Potential unsafe checkout of untrusted pull request on privileged workflow.

---

_{🔍 View full scan logs | 🛡️ Security tab}