feat!: new releasing system - #22
Conversation
📝 WalkthroughWalkthroughThis PR restructures CI/CD by splitting the monolithic tests workflow into reusable lint, test, and e2e workflows invoked via workflow_call, and replaces semantic-release with release-please for versioning and PyPI publishing, removing related dependencies and Makefile targets. ChangesReusable CI Workflows
Release-please migration and dependency cleanup
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant TestsWorkflow
participant LintWorkflow
participant TestWorkflow
participant E2EWorkflow
TestsWorkflow->>LintWorkflow: uses lint.yml
TestsWorkflow->>TestWorkflow: uses test.yml (upload-coveralls true)
TestsWorkflow->>E2EWorkflow: uses e2e.yml
TestWorkflow-->>TestsWorkflow: coverage.lcov results
sequenceDiagram
participant ReleaseWorkflow
participant TestsJob
participant ReleasePleaseAction
participant PublishJob
participant PyPI
ReleaseWorkflow->>TestsJob: uses tests.yml
ReleaseWorkflow->>ReleasePleaseAction: run release-please with GitHub App token
ReleasePleaseAction-->>ReleaseWorkflow: release_created, tag_name
ReleaseWorkflow->>PublishJob: trigger if release_created == true
PublishJob->>PublishJob: checkout tag_name, poetry install, make build
PublishJob->>PyPI: publish dist via gh-action-pypi-publish
Estimated code review effort: 3 (Moderate) | ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/e2e.yml (1)
23-25: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winPin Cypress version and prefer a lockfile-based install.
npm install cypresswith no lockfile intests/e2e_testspulls whatever version is currently published, risking flaky/non-reproducible e2e runs when a new Cypress release changes behavior.♻️ Proposed fix
- - name: Install Cypress - working-directory: tests/e2e_tests - run: npm install cypress + - name: Install Cypress + working-directory: tests/e2e_tests + run: npm ciRequires committing a
package.json/package-lock.jsonintests/e2e_testspinning the Cypress version.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/e2e.yml around lines 23 - 25, The Cypress install step is unpinned and non-reproducible, so update the e2e setup to use a lockfile-based install instead of npm install cypress. Add a pinned Cypress dependency in the tests/e2e_tests package.json along with a matching package-lock.json, then change the workflow step in the Cypress install job to install from that lockfile using the existing tests/e2e_tests working-directory.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e.yml:
- Line 10: The checkout step in the e2e workflow still persists Git credentials,
which is unsafe before running third-party install steps like poetry install and
npm install. Update the actions/checkout usage in the e2e workflow to disable
credential persistence, matching the other reusable workflows, so the job does
not leave repo credentials available to dependencies.
In @.github/workflows/lint.yml:
- Line 10: The checkout step currently uses actions/checkout@v6 with default
credential persistence, which leaves the GitHub token available to later build
steps. Update the checkout configuration in the workflow to explicitly disable
persisted credentials on the actions/checkout step so the token is not written
to git config before poetry install runs.
In @.github/workflows/test.yml:
- Line 16: The checkout step is persisting git credentials unnecessarily, which
exposes them to later third-party steps like poetry install. Update the
actions/checkout usage in the workflow to disable credential persistence by
setting the checkout action’s credential persistence option off, keeping the
rest of the job flow unchanged.
In @.github/workflows/tests.yml:
- Around line 35-39: Remove the unnecessary secrets inheritance from the test
job in the tests workflow. The reusable workflow invocation for test should rely
on the automatically provided GITHUB_TOKEN instead of passing all secrets
through secrets: inherit; update the test job configuration accordingly and keep
the existing uses and with settings unchanged.
---
Nitpick comments:
In @.github/workflows/e2e.yml:
- Around line 23-25: The Cypress install step is unpinned and non-reproducible,
so update the e2e setup to use a lockfile-based install instead of npm install
cypress. Add a pinned Cypress dependency in the tests/e2e_tests package.json
along with a matching package-lock.json, then change the workflow step in the
Cypress install job to install from that lockfile using the existing
tests/e2e_tests working-directory.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 420abfe9-ac9e-474d-bb2b-873b630132fa
⛔ Files ignored due to path filters (1)
poetry.lockis excluded by!**/*.lock
📒 Files selected for processing (9)
.github/workflows/e2e.yml.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/test.yml.github/workflows/tests.yml.release-please-manifest.jsonMakefilepyproject.tomlrelease-please-config.json
💤 Files with no reviewable changes (2)
- Makefile
- pyproject.toml
| e2e: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Disable credential persistence on checkout.
Same rationale as the other reusable workflows — this job also runs poetry install and npm install, both of which execute third-party code.
🔒 Proposed fix
- uses: actions/checkout@v6
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v6 | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e.yml at line 10, The checkout step in the e2e workflow
still persists Git credentials, which is unsafe before running third-party
install steps like poetry install and npm install. Update the actions/checkout
usage in the e2e workflow to disable credential persistence, matching the other
reusable workflows, so the job does not leave repo credentials available to
dependencies.
Source: Linters/SAST tools
| lint: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Disable credential persistence on checkout.
actions/checkout@v6 persists the GitHub token to the git config by default. Since poetry install runs third-party install/build code, a compromised dependency could read/misuse it.
🔒 Proposed fix
- uses: actions/checkout@v6
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v6 | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint.yml at line 10, The checkout step currently uses
actions/checkout@v6 with default credential persistence, which leaves the GitHub
token available to later build steps. Update the checkout configuration in the
workflow to explicitly disable persisted credentials on the actions/checkout
step so the token is not written to git config before poetry install runs.
Source: Linters/SAST tools
| test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Disable credential persistence on checkout.
Same rationale as the other reusable workflows: poetry install executes third-party code, so a persisted git credential is unnecessary exposure.
🔒 Proposed fix
- uses: actions/checkout@v6
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v6 | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yml at line 16, The checkout step is persisting git
credentials unnecessarily, which exposes them to later third-party steps like
poetry install. Update the actions/checkout usage in the workflow to disable
credential persistence by setting the checkout action’s credential persistence
option off, keeping the rest of the job flow unchanged.
Source: Linters/SAST tools
| test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - name: Install Poetry | ||
| run: pip install poetry==2.0.1 | ||
| - name: Set up Python 3.10 | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: "3.10" | ||
| cache: 'poetry' | ||
| - name: Install dependencies | ||
| run: poetry install | ||
| - name: Run tests with coverage | ||
| run: make coverage | ||
| - name: Coveralls | ||
| uses: coverallsapp/github-action@v2 | ||
| with: | ||
| path-to-lcov: "./coverage.lcov" | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| uses: ./.github/workflows/test.yml | ||
| with: | ||
| upload-coveralls: true | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Drop unnecessary secrets: inherit on the test job.
test.yml only uses secrets.GITHUB_TOKEN, which is automatically granted to called workflows without secrets: inherit. As-is, this exposes every repo/org/environment secret to test.yml unnecessarily, violating least privilege.
🔒 Proposed fix
test:
uses: ./.github/workflows/test.yml
with:
upload-coveralls: true
- secrets: inherit📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install Poetry | |
| run: pip install poetry==2.0.1 | |
| - name: Set up Python 3.10 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.10" | |
| cache: 'poetry' | |
| - name: Install dependencies | |
| run: poetry install | |
| - name: Run tests with coverage | |
| run: make coverage | |
| - name: Coveralls | |
| uses: coverallsapp/github-action@v2 | |
| with: | |
| path-to-lcov: "./coverage.lcov" | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| uses: ./.github/workflows/test.yml | |
| with: | |
| upload-coveralls: true | |
| secrets: inherit | |
| test: | |
| uses: ./.github/workflows/test.yml | |
| with: | |
| upload-coveralls: true |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 36-36: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tests.yml around lines 35 - 39, Remove the unnecessary
secrets inheritance from the test job in the tests workflow. The reusable
workflow invocation for test should rely on the automatically provided
GITHUB_TOKEN instead of passing all secrets through secrets: inherit; update the
test job configuration accordingly and keep the existing uses and with settings
unchanged.
Source: Linters/SAST tools
1 participant
Summary by CodeRabbit
New Features
Chores