chore: refactors workflows to extract app-security separatelly#1576
chore: refactors workflows to extract app-security separatelly#1576
Conversation
WalkthroughThis update refactors multiple GitHub Actions workflows to use a new reusable validation workflow, standardizes event context handling via explicit inputs, and removes inline security scanning jobs. It also deletes a custom GCP deployment action and introduces a new reusable validation workflow for monorepo applications. Changes
Sequence Diagram(s)sequenceDiagram
participant Workflow as Caller Workflow
participant ShouldValidate as Reusable Should-Validate
participant ValidateApp as Reusable Validate-App
Workflow->>ShouldValidate: Call with app, workflow-trigger
ShouldValidate-->>Workflow: Output enabled/has_changes
alt Validation enabled
Workflow->>ValidateApp: Call with app, test-command, secrets
ValidateApp->>ValidateApp: Checkout, setup deps, lint, test, upload coverage
end
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
stalniy
force-pushed
the
chore/github-workflows2
branch
4 times, most recently
from
5991b2c to
a140bc4
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1576 +/- ##
==========================================
+ Coverage 40.76% 40.98% +0.22%
==========================================
Files 873 874 +1
Lines 21263 21282 +19
Branches 3887 3868 -19
==========================================
+ Hits 8668 8723 +55
+ Misses 12412 11842 -570
- Partials 183 717 +534
🚀 New features to boost your workflow:
|
stalniy
force-pushed
the
chore/github-workflows2
branch
from
a140bc4 to
6fc1cbc
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (4)
.github/workflows/console-api-validate-n-build.yml (1)
18-18: Same input-name concern as in Indexer workflow.
Ensurereusable-should-validate.ymlexposesworkflow-trigger..github/workflows/provider-proxy-docker-build.yml (2)
19-19: Input name verification.
Same observation as above — confirm the reusable workflow expectsworkflow-trigger.
24-27: Secret forwarding risk repeats here.
Limit the inherited secrets or harden the called workflow..github/workflows/notifications-validate-n-build.yml (1)
19-19: Verifyworkflow-triggerinput existence.
🧹 Nitpick comments (4)
.github/workflows/indexer-docker-build.yml (1)
32-32: Nit: add a descriptive step name for easier GitHub UI scanning.- - run: packages/docker/script/dc.sh build indexer + - name: Build Docker image for Indexer + run: packages/docker/script/dc.sh build indexer.github/workflows/provider-proxy-docker-build.yml (1)
36-36: Provide a step name for clarity.- - run: packages/docker/script/dc.sh build provider-proxy + - name: Build Docker image for Provider-Proxy + run: packages/docker/script/dc.sh build provider-proxy.github/workflows/notifications-validate-n-build.yml (2)
24-33: Secrets propagation & long inline test script.Same concerns as raised for the API workflow:
• Reviewsecrets: inheritexposure.
• Consider moving the multilinetest-commandintoscripts/test_notifications.shfor maintainability.
34-40: Add explicit step name for the Docker build.- - uses: actions/checkout@v4 - - run: packages/docker/script/dc.sh build notifications + - uses: actions/checkout@v4 + - name: Build Docker image for Notifications + run: packages/docker/script/dc.sh build notifications
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (11)
.github/actions/gcp-deploy/action.yml(0 hunks).github/workflows/console-api-validate-n-build.yml(1 hunks).github/workflows/console-web-docker-build.yml(2 hunks).github/workflows/indexer-docker-build.yml(2 hunks).github/workflows/local-packages-validate.yml(1 hunks).github/workflows/notifications-validate-n-build.yml(1 hunks).github/workflows/provider-console-docker-build.yml(2 hunks).github/workflows/provider-proxy-docker-build.yml(2 hunks).github/workflows/reusable-should-validate.yml(2 hunks).github/workflows/reusable-validate-app.yml(1 hunks).github/workflows/stats-web-docker-build.yml(1 hunks)
💤 Files with no reviewable changes (1)
- .github/actions/gcp-deploy/action.yml
🚧 Files skipped from review as they are similar to previous changes (6)
- .github/workflows/local-packages-validate.yml
- .github/workflows/provider-console-docker-build.yml
- .github/workflows/console-web-docker-build.yml
- .github/workflows/reusable-should-validate.yml
- .github/workflows/stats-web-docker-build.yml
- .github/workflows/reusable-validate-app.yml
⏰ Context from checks skipped due to timeout of 90000ms (11)
- GitHub Check: test-stats-web-build
- GitHub Check: test-indexer-build
- GitHub Check: validate-notifications / validate-app
- GitHub Check: test-notifications-build
- GitHub Check: test-provider-console-build
- GitHub Check: validate-api / validate-app
- GitHub Check: test-api-build
- GitHub Check: validate-deploy-web / validate-app
- GitHub Check: test-deploy-web-build
- GitHub Check: test-provider-proxy-build
- GitHub Check: Validate local packages
🔇 Additional comments (1)
.github/workflows/indexer-docker-build.yml (1)
15-15: Pass-through ofworkflow-triggerlooks correct — just verify the input name in the reusable workflow.
reusable-should-validate.ymlmust expose an input calledworkflow-trigger. If that input was renamed during the refactor, this line will silently fall back to the default and the decision logic could mis-behave.
1 participant
Why
This is required in order to get access to
secrets. There are just 2 ways to get them for outside collaborators:I decided to keep our CIs as is because it's much safer to run in secrets-less environment. And then check code for security issues only after workflow finished. Collaborators repository is then cloned in a separate folder but workflows are checked out from our
mainbranch and then it runs snyk for outside collaborator code.What
refactors workflows to extract app-security separatelly. Github doesn't pass enough context from previous workflow, that's why some it I encoded in workflow name.
Also deleted action for GCP deployment
Reference: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
Summary by CodeRabbit