Repository navigation
Conversation
Add one 'OpenAPI spec drift gate' step to the tests matrix job, after the test-run steps and with the same working-directory as its siblings. It probes Makefile targets via 'make -n' (the house auto-detect pattern the 'Detect Makefile test target' step already uses) in order: check-api-spec > check-generated-artifacts > check-openapi-spec > check-huma-spec. The first target that exists runs as a hard gate — a stale committed OpenAPI spec fails the job. No matching target (or no Makefile) logs one line and succeeds, so repos opt in by exposing a detectable target (canonical: check-api-spec). validate-api-docs is deliberately excluded from the probe list: it is an unverified swag-family target and auto-adopting it could break PRs org-wide; repos on that target join later via a verified check-api-spec alias. Claude-Session: https://claude.ai/code/session_013kJ9BuhVsVJXVBivdKLNt2
The drift gate probed four target names (check-api-spec, check-generated-artifacts, check-openapi-spec, check-huma-spec) and ran the first that existed. check-generated-artifacts is not unique to any opting-in repo — it is a boilerplate-standard target across many org repos, including the swag-family BACEN-rail consumers br-sta, br-ccs and br-sisbajud (all on: pull_request callers of this workflow). Their target chains into a swag check that exit 1s when swag is absent; the tests job never installs swag and ubuntu-latest does not ship it, so the gate would fail under set -e and block EVERY PR in those repos the moment the shared-workflow ref bumps. Probing the other boilerplate names likewise auto-adopts unverified targets org-wide, front-running the per-repo verification later waves require. Fix: probe exactly one target, check-api-spec — a name no repo exposes yet, so adoption is genuinely opt-in. Repos join by aliasing their own verified check into check-api-spec. Comment block updated to match; behavioral test confirms a check-generated-artifacts-only repo is skipped, not run. Claude-Session: https://claude.ai/code/session_013kJ9BuhVsVJXVBivdKLNt2
Raise cosign_max_attempts default from 3 to 5, cap the exponential backoff at cosign_max_delay (default 60s), and randomize it (equal jitter) to avoid thundering-herd retries against Rekor. Closes #450
Clamp the persistent delay variable to max-delay (not just the sleep value) to avoid unbounded growth across retries, and add max-delay to the README/docs configuration examples.
vars.RUNNER_LABEL remains the primary runner selector; the secondary fallback (when the var is unset) is now GitHub's own ubuntu-latest runner instead of the blacksmith label, both in hardcoded runs-on values and in runner_type input defaults. gitops-update.yml is untouched — it has its own vars.GITOPS_RUNNERS fallback logic.
Renamed vars.RUNNER_LABEL to vars.GENERAL_RUNNERS across all shared workflows for clarity. gitops-update.yml (vars.GITOPS_RUNNERS) and the Ungoliant release-diff jobs (vars.UNGOLIANT_RUNNERS) already use their own dedicated runner variables and were not part of this rename.
…ritative Addresses CodeRabbit findings on PR #600: - Restore blacksmith-4vcpu-ubuntu-2404 (or 'blacksmith' for gptchangelog.yml, matching its pre-existing value) as the final fallback/default across all reusable workflows, per the repo's documented runner policy (.claude/commands/gha.md, workflow.md). vars.GENERAL_RUNNERS remains the primary override. - api-dog-e2e-tests.yml and end-to-end-tests.yml: drop the vars.GENERAL_RUNNERS override entirely — these jobs require network-reachable runners (eveo-lxc-runners) and must keep inputs.runner_type authoritative. - go-fuzz.yml and release-notification.yml: dry-run summaries now report the effective resolved runner instead of the raw input.
Addresses CodeRabbit/zizmor template-injection findings on go-fuzz.yml:91 and release-notification.yml:152. The resolved runner (vars.GENERAL_RUNNERS || input/literal) is now passed through a step-level env var and printed via the shell variable instead of being interpolated directly into the run: block.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughThe pull request standardizes GitHub Actions runner selection through ChangesWorkflow infrastructure
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
v2.0.6 targets Node.js 20, which GitHub deprecated and now force-runs on Node.js 24 with a warning on every cleanup job run. v2.1 uses runs.using: node24 natively. Inputs are unchanged between versions. Closes #522
lerian-studio
added
size/M
lerian-studio
added
golang
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
Contributor
🛡️ CodeQL Analysis ResultsLanguages analyzed: Found 2 issue(s): 2 Medium
🔍 View full scan logs | 🛡️ Security tab |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/backmerge.yml:
- Line 48: Replace the shared vars.GENERAL_RUNNERS override with the approved
blacksmith-4vcpu-ubuntu-2404 runner for every affected job: expand and sync in
.github/workflows/backmerge.yml (48, 140), branch cleanup in
.github/workflows/branch-cleanup.yml (48), workflow dispatch in
.github/workflows/dispatch-helm.yml (100), AWS release in
.github/workflows/go-lambda-release.yml (73), release preparation, publishing,
aggregation, changelog generation, major-tag updates, and latest-release
enforcement in .github/workflows/release.yml (113, 171, 413, 474, 504, 540), and
S3 uploads in .github/workflows/s3-upload.yml (127).
In @.github/workflows/gptchangelog.yml:
- Line 58: Update the runs-on expressions for both workflow jobs to fall back to
the required blacksmith-4vcpu-ubuntu-2404 label when vars.GENERAL_RUNNERS is
unset and no runner input is supplied; preserve the existing GENERAL_RUNNERS
override.
In @.github/workflows/js-release.yml:
- Line 81: Revert the enable_dockerhub input default in the release workflow to
false, preserving the existing opt-in behavior for DockerHub login and
publishing when callers explicitly enable it.
In @.github/workflows/self-pr-validation.yml:
- Line 39: Update every runs-on expression in the self-* PR validation workflow,
including the entries near the referenced jobs, to use the approved hosted
runner blacksmith-4vcpu-ubuntu-2404 directly instead of vars.GENERAL_RUNNERS. Do
not allow repository variables or self-hosted labels to select the runner for
fork-controlled validation.
In @.github/workflows/slack-notify.yml:
- Line 44: Constrain runner selection in the reusable workflow jobs by replacing
the configurable runner expressions with the mandated
blacksmith-4vcpu-ubuntu-2404 runner or an approved hosted-runner mapping. Apply
this change at .github/workflows/slack-notify.yml:44,
.github/workflows/stale-issue.yml:38, and .github/workflows/stale-pr.yml:38.
In @.github/workflows/typescript-build.yml:
- Line 54: Revert the workflow_call input default for enable_dockerhub to false
in the TypeScript build workflow, preserving existing callers’ behavior unless
they explicitly opt in to DockerHub publishing.
In `@src/security/cosign-sign/action.yml`:
- Around line 115-126: The retry jitter logic around capped_delay must handle
odd caps correctly. Update the half calculation to use a ceiling half and derive
the RANDOM range from the capped delay, ensuring sleep_time stays within the
intended jitter window and max-delay: 1 does not produce immediate retries.
- Around line 24-27: Validate the retry inputs before the signing loop begins,
covering max-attempts, initial-delay, and max-delay as integers with nonnegative
delay values and max-attempts of at least one. Reject invalid or negative values
before any arithmetic, modulo, or sleep operations, while preserving the
existing retry behavior for valid inputs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5041fc70-70e4-45f9-b6e3-37e038b927d2
📒 Files selected for processing (38)
.github/workflows/backmerge.yml.github/workflows/branch-cleanup.yml.github/workflows/build.yml.github/workflows/dispatch-helm.yml.github/workflows/frontend-pr-analysis.yml.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml.github/workflows/go-lambda-release.yml.github/workflows/go-pr-analysis.yml.github/workflows/go-pr-validation.yml.github/workflows/go-security.yml.github/workflows/gptchangelog.yml.github/workflows/helm-alpha-cleanup.yml.github/workflows/helm-alpha-release.yml.github/workflows/helm-release-notification.yml.github/workflows/helm-update-chart.yml.github/workflows/helm-upgrade-doc.yml.github/workflows/js-pr-validation.yml.github/workflows/js-release.yml.github/workflows/labels-sync.yml.github/workflows/lerian-lib-version-check.yml.github/workflows/pr-security-scan.yml.github/workflows/pr-validation.yml.github/workflows/release-notification.yml.github/workflows/release.yml.github/workflows/s3-upload.yml.github/workflows/self-pr-validation.yml.github/workflows/slack-notify.yml.github/workflows/stale-issue.yml.github/workflows/stale-pr.yml.github/workflows/typescript-build.yml.github/workflows/typescript-ci.yml.github/workflows/typescript-release.yml.github/workflows/version-propagation.yml.github/workflows/workflow-runs-cleanup.ymldocs/build-workflow.mdsrc/security/cosign-sign/README.mdsrc/security/cosign-sign/action.yml
| # ----------------- Expand Rules ----------------- | ||
| expand: | ||
| runs-on: blacksmith-4vcpu-ubuntu-2404 | ||
| runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Shared runner override violates the reusable-workflow security contract.
The new vars.GENERAL_RUNNERS precedence allows privileged jobs to run on arbitrary labels instead of the required Blacksmith runner. Revert these expressions or add a strict approved-runner allowlist before merging.
.github/workflows/backmerge.yml#L48-L48: keepexpandon the approved runner..github/workflows/backmerge.yml#L140-L140: keepsyncon the approved runner..github/workflows/branch-cleanup.yml#L48-L48: keep branch cleanup on the approved runner..github/workflows/dispatch-helm.yml#L100-L100: keep workflow dispatch on the approved runner..github/workflows/go-lambda-release.yml#L73-L73: keep AWS release on the approved runner..github/workflows/release.yml#L113-L113: keep release preparation on the approved runner..github/workflows/release.yml#L171-L171: keep publishing on the approved runner..github/workflows/release.yml#L413-L413: keep aggregation on the approved runner..github/workflows/release.yml#L474-L474: keep changelog generation on the approved runner..github/workflows/release.yml#L504-L504: keep major-tag updates on the approved runner..github/workflows/release.yml#L540-L540: keep latest-release enforcement on the approved runner..github/workflows/s3-upload.yml#L127-L127: keep S3 uploads on the approved runner.
As per path instructions, all jobs in reusable workflows must use blacksmith-4vcpu-ubuntu-2404.
📍 Affects 6 files
.github/workflows/backmerge.yml#L48-L48(this comment).github/workflows/backmerge.yml#L140-L140.github/workflows/branch-cleanup.yml#L48-L48.github/workflows/dispatch-helm.yml#L100-L100.github/workflows/go-lambda-release.yml#L73-L73.github/workflows/release.yml#L113-L113.github/workflows/release.yml#L171-L171.github/workflows/release.yml#L413-L413.github/workflows/release.yml#L474-L474.github/workflows/release.yml#L504-L504.github/workflows/release.yml#L540-L540.github/workflows/s3-upload.yml#L127-L127
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/backmerge.yml at line 48, Replace the shared
vars.GENERAL_RUNNERS override with the approved blacksmith-4vcpu-ubuntu-2404
runner for every affected job: expand and sync in
.github/workflows/backmerge.yml (48, 140), branch cleanup in
.github/workflows/branch-cleanup.yml (48), workflow dispatch in
.github/workflows/dispatch-helm.yml (100), AWS release in
.github/workflows/go-lambda-release.yml (73), release preparation, publishing,
aggregation, changelog generation, major-tag updates, and latest-release
enforcement in .github/workflows/release.yml (113, 171, 413, 474, 504, 540), and
S3 uploads in .github/workflows/s3-upload.yml (127).
Source: Path instructions
| jobs: | ||
| prepare: | ||
| runs-on: ${{ inputs.runner_type }} | ||
| runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }} |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Use a valid runner fallback.
runner_type defaults to blacksmith, so when vars.GENERAL_RUNNERS is unset and callers omit the input, both jobs resolve runs-on to blacksmith instead of the required blacksmith-4vcpu-ubuntu-2404 label. Use that exact label as the expression fallback or update the input default.
As per coding guidelines, reusable workflow jobs must use blacksmith-4vcpu-ubuntu-2404.
Also applies to: 248-248
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/gptchangelog.yml at line 58, Update the runs-on
expressions for both workflow jobs to fall back to the required
blacksmith-4vcpu-ubuntu-2404 label when vars.GENERAL_RUNNERS is unset and no
runner input is supplied; preserve the existing GENERAL_RUNNERS override.
Source: Coding guidelines
| description: 'Enable pushing to DockerHub' | ||
| type: boolean | ||
| default: false | ||
| default: true |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Do not enable DockerHub publishing by default without a breaking-change migration.
Changing enable_dockerhub from false to true opts callers that omit this input into the DockerHub login/publishing path, which can publish images unexpectedly or fail when DockerHub credentials are not configured. Revert the default to false, or document this as an intentional breaking change and update callers.
Proposed safe default
- default: true
+ default: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| default: true | |
| default: false |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/js-release.yml at line 81, Revert the enable_dockerhub
input default in the release workflow to false, preserving the existing opt-in
behavior for DockerHub login and publishing when callers explicitly enable it.
| changed-files: | ||
| name: Detect Changed Files | ||
| runs-on: blacksmith-4vcpu-ubuntu-2404 | ||
| runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Keep PR validation on an approved hosted runner.
These expressions allow vars.GENERAL_RUNNERS to select a self-hosted runner for pull-request validation. That would execute fork-controlled workflow content on a persistent runner, violating the repository’s explicit self-hosted-runner restriction and increasing compromise risk. Keep this self-* workflow on blacksmith-4vcpu-ubuntu-2404, or enforce an allowlist that excludes self-hosted labels.
Also applies to: 63-63, 78-78, 93-93, 108-108, 125-125, 138-138, 153-153, 168-168, 183-183, 198-198, 240-240
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/self-pr-validation.yml at line 39, Update every runs-on
expression in the self-* PR validation workflow, including the entries near the
referenced jobs, to use the approved hosted runner blacksmith-4vcpu-ubuntu-2404
directly instead of vars.GENERAL_RUNNERS. Do not allow repository variables or
self-hosted labels to select the runner for fork-controlled validation.
Source: Coding guidelines
| notify: | ||
| name: Send Notification | ||
| runs-on: ${{ inputs.runner_type }} | ||
| runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Constrain runner selection for all reusable workflows.
These changes allow reusable workflows to run on arbitrary or self-hosted labels, violating the repository requirement that reusable workflow jobs use blacksmith-4vcpu-ubuntu-2404.
.github/workflows/slack-notify.yml#L44-L44: replace the unconstrainedvars.GENERAL_RUNNERS || inputs.runner_typeexpression with the mandated runner or an approved hosted-runner mapping..github/workflows/stale-issue.yml#L38-L38: apply the same runner constraint..github/workflows/stale-pr.yml#L38-L38: apply the same runner constraint.
📍 Affects 3 files
.github/workflows/slack-notify.yml#L44-L44(this comment).github/workflows/stale-issue.yml#L38-L38.github/workflows/stale-pr.yml#L38-L38
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/slack-notify.yml at line 44, Constrain runner selection in
the reusable workflow jobs by replacing the configurable runner expressions with
the mandated blacksmith-4vcpu-ubuntu-2404 runner or an approved hosted-runner
mapping. Apply this change at .github/workflows/slack-notify.yml:44,
.github/workflows/stale-issue.yml:38, and .github/workflows/stale-pr.yml:38.
Source: Coding guidelines
| description: 'Enable pushing to DockerHub' | ||
| type: boolean | ||
| default: false | ||
| default: true |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Do not silently enable DockerHub publishing for existing callers.
Changing the workflow_call default from false to true means callers that omit enable_dockerhub now pass true to the Docker build action. The downstream workflow conditionally logs in to DockerHub when enabled (.github/workflows/build.yml Lines 311-315), so existing callers may unexpectedly require DockerHub credentials and publish images. Revert the default or document and version this as a breaking change.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/typescript-build.yml at line 54, Revert the workflow_call
input default for enable_dockerhub to false in the TypeScript build workflow,
preserving existing callers’ behavior unless they explicitly opt in to DockerHub
publishing.
Comment on lines
+24
to
+27
| max-delay: | ||
| description: Maximum delay in seconds between retry attempts. Caps the exponential backoff before jitter is applied. | ||
| required: false | ||
| default: "60" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Validate retry inputs before arithmetic.
max-delay accepts arbitrary strings, but the signing loop uses it with -gt, division, modulo, and sleep. Values such as -2 can produce RANDOM % 0, while non-numeric values fail at runtime. Validate max-attempts, initial-delay, and max-delay once before signing, enforcing integer ranges and at least one attempt.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/security/cosign-sign/action.yml` around lines 24 - 27, Validate the retry
inputs before the signing loop begins, covering max-attempts, initial-delay, and
max-delay as integers with nonnegative delay values and max-attempts of at least
one. Reject invalid or negative values before any arithmetic, modulo, or sleep
operations, while preserving the existing retry behavior for valid inputs.
Comment on lines
+115
to
+126
| local capped_delay="$delay" | ||
| if [ "$capped_delay" -gt "$MAX_DELAY" ]; then | ||
| capped_delay="$MAX_DELAY" | ||
| fi | ||
| local half=$((capped_delay / 2)) | ||
| local sleep_time=$((half + RANDOM % (half + 1))) | ||
| echo "::warning::cosign sign failed (attempt $attempt/$MAX_ATTEMPTS) — retrying in ${sleep_time}s (base ${capped_delay}s, jittered)…" | ||
| sleep "$sleep_time" | ||
| delay=$((delay * 3)) | ||
| if [ "$delay" -gt "$MAX_DELAY" ]; then | ||
| delay="$MAX_DELAY" | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the odd-delay jitter calculation.
half=$((capped_delay / 2)) floors odd values; with max-delay: 1, sleep_time is always 0, causing immediate retries despite a one-second cap. Use a ceiling half and calculate the random range from the capped delay so the result remains within the intended jitter window.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/security/cosign-sign/action.yml` around lines 115 - 126, The retry jitter
logic around capped_delay must handle odd caps correctly. Update the half
calculation to use a ceiling half and derive the RANDOM range from the capped
delay, ensuring sleep_time stays within the intended jitter window and
max-delay: 1 does not produce immediate retries.
Contributor
🔍 Lint Analysis
❌ Failures (2)Action Lint
Pinned Actions
|
lerian-studio
added
the
config
This was referenced Jul 22, 2026
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None.
Testing
@this-branchor the beta tagCaller repo / workflow run:
Related Issues
Closes #