Add automated release CI pipeline and update project scripts#12
Conversation
…project repository link
|
Warning Review limit reached
More reviews will be available in 45 minutes and 31 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR introduces a complete release automation pipeline via GitHub Actions, building ChangesRelease Workflow Automation
Dashboard Repository Link Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 50: Replace floating action refs like "uses: actions/checkout@v4" with
their corresponding full 40-character commit SHAs across the release workflow;
locate every "uses:" entry mentioned (e.g., actions/checkout@v4 and the other
floating refs at the listed lines) and update each to the exact commit SHA for
that action version so the workflow is pinned to immutable commits.
- Around line 3-9: Add a top-level GitHub Actions concurrency block to serialize
runs per the provided inputs.tag_name so two workflow_dispatch runs with the
same tag don't race; add a top-level "concurrency:" mapping with "group: ${{
github.workflow }}-${{ github.event.inputs.tag_name }}" and "cancel-in-progress:
false" (or true if you prefer cancelling previous runs) to the release workflow
so runs are queued/serialized by tag_name.
- Around line 93-100: The get_version step currently injects inputs.tag_name
directly into shell which is unsafe and also assumes a leading "v"; change the
step (id get_version) to receive the tag via environment (use env: TAG_NAME: ${{
inputs.tag_name }}), validate TAG_NAME against a strict regex like
^v[0-9]+\.[0-9]+\.[0-9]+(?:[-+].*)?$ and fail (non-zero exit) if it doesn't
match, then set VERSION by stripping the leading "v" from TAG_NAME and write
both "version=${VERSION}" and "tag_name=${TAG_NAME}" to GITHUB_OUTPUT so
downstream Homebrew URLs use the validated TAG_NAME (with the v) while the
VERSION remains semver without the v; ensure TAG_NAME and VERSION are not
interpolated from untrusted shell variables elsewhere.
- Around line 11-12: The workflow currently sets workflow-level permissions
"contents: write" making all jobs (e.g., the build-binaries matrix) able to
write via GITHUB_TOKEN; remove or change the top-level permissions so "contents"
is not globally set to write, then add a job-level permissions block granting
"contents: write" only for the release-related jobs (create-release and
generate-packages) so those two jobs retain write access while build-binaries
and others keep default/read-only permissions.
- Around line 168-176: The RPM copy in scripts/package.sh uses cp
"$RPM_BUILD_DIR"/RPMS/**/*.rpm "$OUT_DIR/" but the script never enables bash
globstar so ** is not recursive and is ambiguous; update scripts/package.sh to
either enable bash globstar (shopt -s globstar) before the cp, or replace the
pattern with an explicit safe pattern like "$RPM_BUILD_DIR"/RPMS/*/*.rpm, or use
find (find "$RPM_BUILD_DIR"/RPMS -name '*.rpm' -exec cp {} "$OUT_DIR/" \;) to
reliably collect RPMs; ensure you reference the RPM_BUILD_DIR and OUT_DIR
variables and adjust the cp invocation accordingly.
- Around line 49-50: Update each actions/checkout@v4 step in the release
workflow to disable credential persistence: locate the three checkout steps
(each named "Checkout repository" using actions/checkout@v4) and add the with:
persist-credentials: false option so the checkout doesn't retain GITHUB_TOKEN
credentials across subsequent clones (the Homebrew TAP update uses TAP_TOKEN
instead).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1e4f7b63-706c-45f5-b681-ff8f47dd2739
⛔ Files ignored due to path filters (1)
scripts/package.shis excluded by none and included by none
📒 Files selected for processing (2)
.github/workflows/release.ymlsrc/ui/dashboard.rs
…opying in package script
There was a problem hiding this comment.
Our agent can fix these. Install it.
Gates Passed
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
1 participant
…project repository link
Summary by CodeRabbit
New Features
Chores