ci: repoint release lane dispatch to AWS (devexp-argocd-apps)#1654
Conversation
Post-build dispatch in release-from-main now targets the AWS release lane in genlayerlabs/devexp-argocd-apps via repository_dispatch (event_type=release-backend), using a release-lane GitHub App token scoped to that repo instead of the shared CI bot. Part of the dev+stg->AWS cutover.
📝 WalkthroughWalkthroughThe release-from-main workflow is updated to dispatch release events to an external devexp-argocd-apps repository via GitHub App authentication. Token generation now uses ChangesRelease dispatch to AWS release lane
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-from-main.yml:
- Line 57: The workflow step "Get release-lane token" currently uses the moving
tag actions/create-github-app-token@v3; update that uses line to a full commit
SHA (replace actions/create-github-app-token@v3 with
actions/create-github-app-token@<full-commit-sha>) and do the same for other
unpinned actions found (actions/checkout@v6, actions/setup-node@v6,
docker/setup-buildx-action@v3) by locating their use lines and replacing the
semver tags with the exact commit SHAs from each action repository so the
workflow is fully pinned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6519cb69-3fe3-4457-a9b5-e581b51298ae
📒 Files selected for processing (1)
.github/workflows/release-from-main.yml
| uses: tibdex/github-app-token@v2 | ||
| - name: Get release-lane token | ||
| id: release_lane_token | ||
| uses: actions/create-github-app-token@v3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/release-from-main.yml"
echo "== File = $FILE =="
echo
nl -ba "$FILE" | sed -n '40,90p'
echo
echo "== All uses: lines in file =="
rg -n "^\s*uses:\s*" "$FILE" || trueRepository: genlayerlabs/genlayer-studio
Length of output: 187
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/release-from-main.yml"
echo "== File = $FILE =="
echo
if command -v awk >/dev/null 2>&1; then
awk 'NR>=40 && NR<=90{printf "%d\t%s\n", NR, $0}' "$FILE"
else
echo "awk not available"
exit 1
fi
echo
echo "== All uses: occurrences in file =="
rg -n "^\s*uses:\s*" "$FILE" || trueRepository: genlayerlabs/genlayer-studio
Length of output: 2425
Pin actions/create-github-app-token to a full commit SHA.
.github/workflows/release-from-main.ymlusesactions/create-github-app-token@v3inGet release-lane token, which is an unpinned moving tag (unpinned-uses).- This workflow also has other unpinned action tags (
actions/checkout@v6,actions/setup-node@v6,docker/setup-buildx-action@v3), which may be subject to the same policy.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 57-57: missing input "app-id" which is required by action "actions/create-github-app-token@v3". all required inputs are "app-id", "private-key"
(action)
🪛 zizmor (1.25.2)
[error] 57-57: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 57-57: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-from-main.yml at line 57, The workflow step "Get
release-lane token" currently uses the moving tag
actions/create-github-app-token@v3; update that uses line to a full commit SHA
(replace actions/create-github-app-token@v3 with
actions/create-github-app-token@<full-commit-sha>) and do the same for other
unpinned actions found (actions/checkout@v6, actions/setup-node@v6,
docker/setup-buildx-action@v3) by locating their use lines and replacing the
semver tags with the exact commit SHAs from each action repository so the
workflow is fully pinned.
|
🎉 This PR is included in version 0.121.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
2 participants
Repoints
release-from-main.yml's post-build dispatch from the GCP workload repo to the AWS release lane ingenlayerlabs/devexp-argocd-apps.trigger-workload-release-lanenow mints a token from the release-lane GitHub App (actions/create-github-app-token@v3, scoped todevexp-argocd-apps) instead of the shared CI bot viatibdex/github-app-token.repository_dispatch(event_type=release-backend); was aworkflow_dispatchagainst the GCPrelease-studio-backend-start.yml.Part of the dev+stg→AWS cutover: AWS owns dev/stg/rally-prd-tier and fans out to GCP for true-prd.
Requires repo var
RELEASE_LANE_APP_CLIENT_ID+ secretRELEASE_LANE_APP_KEYand the release-lane App installed on this repo.Summary by CodeRabbit