Add nightly CI workflow building against WLED main#6
Conversation
Clones wled/WLED on each run and builds the usermod against it via a file:// custom_usermods entry. Runs on push, PR, nightly schedule, and manual dispatch so API regressions are caught within 24 hours. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
WalkthroughAdds a GitHub Actions workflow that builds this usermod against the upstream WLED repository on pushes, pull requests, nightly (04:00 UTC), and manual dispatch. The job checks out both repos, caches PlatformIO packages, installs PlatformIO, writes a platformio override enabling a ChangesCI Build Workflow
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
34-35: ⚡ Quick winConsider pinning the Python version for reproducibility.
The workflow relies on the default Python version in
ubuntu-latest, which could change over time. Explicitly setting up Python ensures consistent behavior across builds.🐍 Proposed addition to pin Python version
+ - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.12' + - name: Install PlatformIO run: pip install platformio🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 34 - 35, The workflow currently installs PlatformIO without pinning Python; update the GitHub Actions job by adding a setup step before the "Install PlatformIO" step that uses actions/setup-python (e.g., actions/setup-python@v4) and sets a fixed python-version (like "3.11" or your chosen version), so the "Install PlatformIO" run step (named "Install PlatformIO") executes on a pinned Python runtime for reproducible builds.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Line 17: The workflow uses unpinned action references like
"actions/checkout@v6" (and the other unpinned "uses:" entries flagged) — pin
each external action to its specific commit SHA instead of a semantic tag to
prevent supply-chain risks; update the "uses: actions/checkout@v6" entry to
"uses: actions/checkout@<commit-sha>" and do the same for the other unpinned
actions, and add a comment preserving the original semantic version (e.g., "#
actions/checkout@v6.0.0") so reviewers know which release the SHA corresponds
to.
- Around line 16-25: Update the two checkout steps that use actions/checkout@v6
(the steps named "Checkout usermod" and "Checkout WLED") to explicitly set
persist-credentials: false; locate the steps that use "uses:
actions/checkout@v6" and add the key persist-credentials: false under their
with: block so the GitHub token is not written into .git/config and cannot be
leaked via artifacts or logs.
---
Nitpick comments:
In @.github/workflows/build.yml:
- Around line 34-35: The workflow currently installs PlatformIO without pinning
Python; update the GitHub Actions job by adding a setup step before the "Install
PlatformIO" step that uses actions/setup-python (e.g., actions/setup-python@v4)
and sets a fixed python-version (like "3.11" or your chosen version), so the
"Install PlatformIO" run step (named "Install PlatformIO") executes on a pinned
Python runtime for reproducible builds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 79cd156f-00dd-4a91-b935-7cc05331aa9d
📒 Files selected for processing (1)
.github/workflows/build.yml
|
|
||
| steps: | ||
| - name: Checkout usermod | ||
| uses: actions/checkout@v6 |
There was a problem hiding this comment.
Consider pinning actions to SHA hashes for supply chain security.
The workflow uses semantic version tags (@v6, @v5) rather than pinned commit SHAs. While semantic versions are more maintainable and receive automatic security updates, pinning to SHAs provides immutable references that prevent potential supply chain attacks if a tag is moved or compromised.
For production workflows, consider pinning to specific commit SHAs with comments noting the version:
# actions/checkout@v6.0.0
uses: actions/checkout@f4320f289a07f...Note: This is a security trade-off. Since this is a template workflow, semantic versions may be more user-friendly. Evaluate based on your security requirements.
As per static analysis hint from zizmor: unpinned action reference (unpinned-uses).
Also applies to: 22-22, 28-28
🧰 Tools
🪛 zizmor (1.25.2)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yml at line 17, The workflow uses unpinned action
references like "actions/checkout@v6" (and the other unpinned "uses:" entries
flagged) — pin each external action to its specific commit SHA instead of a
semantic tag to prevent supply-chain risks; update the "uses:
actions/checkout@v6" entry to "uses: actions/checkout@<commit-sha>" and do the
same for the other unpinned actions, and add a comment preserving the original
semantic version (e.g., "# actions/checkout@v6.0.0") so reviewers know which
release the SHA corresponds to.
There was a problem hiding this comment.
Consider it considered. ;)
I think in this case we're better served to accept updates from upstream - in the context of smoke-test CI like this, I'm not too worried about supply chain attacks.
There was a problem hiding this comment.
@willmmiles — Totally fair! For a template smoke-test workflow where staying current with upstream matters more than supply-chain immutability, semantic version tags are the right call. Acknowledged and moving on. 🐇
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/build.yml (1)
36-37:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winPin PlatformIO to a fixed version for reproducible builds.
pip install platformiowill pull whatever is latest, which can change PlatformIO behavior over time. The latest stable PlatformIO Core is 6.1.19 (Feb 4, 2026); pin to it (e.g.,pip install platformio==6.1.19) or restrict to a specific 6.1.x line.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 36 - 37, Update the "Install PlatformIO" step so the pip invocation pins PlatformIO to a fixed version; replace the current pip install command (the run command under the step named "Install PlatformIO") with a pinned version like pip install platformio==6.1.19 (or restrict to a 6.1.x line) to ensure reproducible CI builds.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/build.yml:
- Around line 36-37: Update the "Install PlatformIO" step so the pip invocation
pins PlatformIO to a fixed version; replace the current pip install command (the
run command under the step named "Install PlatformIO") with a pinned version
like pip install platformio==6.1.19 (or restrict to a 6.1.x line) to ensure
reproducible CI builds.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 754bd667-a93c-4100-b67f-f09d4f8c9c9f
📒 Files selected for processing (1)
.github/workflows/build.yml
1 participant
Add a CI workflow to help keep out-of-tree usermods fresh. By default, does nightly build against WLED main, providing an early warning if a breaking change gets merged.
Template users are free to customize however they like, but we can start with encouraging good maintenance practices.
Fixes #5
Summary by CodeRabbit