BUILD: Adding release workflow for deployments#4866
BUILD: Adding release workflow for deployments#4866blckmn wants to merge 5 commits intobetaflight:masterfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds tag-validation, environment-name preparation, and "is latest" checks to the release workflow; refactors build gating; splits deployment into maintenance and production flows that call a new reusable Cloudflare deploy workflow; updates deploy orchestration and PR comment outputs. (≈34 words) Changes
Sequence DiagramsequenceDiagram
actor GH as GitHub Events
participant CheckTag as check_tag
participant Build as modern_build
participant PrepareEnv as prepare_environment
participant CheckLatest as check_latest
participant DeployMaint as modern_deploy
participant DeployLatest as modern_deploy_latest
participant DeployWF as deploy_cloudflare.yml
participant CF as Cloudflare
GH->>CheckTag: release/tag event
CheckTag-->>Build: should_run
Build->>PrepareEnv: provide tag metadata
PrepareEnv-->>DeployMaint: env_name
Build->>CheckLatest: request latest check
CheckLatest-->>DeployLatest: is_latest
DeployMaint->>DeployWF: call with branch, env, project
DeployLatest->>DeployWF: call when is_latest == true
DeployWF->>CF: wrangler deploy src/dist to project/branch
DeployWF-->>DeployMaint: deployment_url, deployment_alias_url
DeployWF-->>DeployLatest: deployment_url, deployment_alias_url
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~30 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
No actionable comments were generated in the recent review. 🎉 Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In @.github/workflows/build-release.yml:
- Around line 94-105: The check for releases/latest can race with the new
release publish because check_latest runs in parallel with modern_build; modify
the workflow so the check waits for the release to propagate by either adding a
short sleep/retry loop before comparing CURRENT_TAG and LATEST_TAG (retry gh api
up to N times with delay) or by making check_latest depend on modern_build (or
move the check into modern_deploy_latest) to ensure the published release is
visible; update the job name/depends-on accordingly and reference the
CURRENT_TAG and LATEST_TAG comparison logic to apply the delay/retry or
dependency change.
- Around line 79-80: The environment name string has a typo ("-maintenence");
update the ENV_NAME assignment to use the correct spelling "-maintenance" (i.e.,
change ENV_NAME="${VERSION}-maintenence" to ENV_NAME="${VERSION}-maintenance")
so the GitHub environment and Cloudflare Pages branch names are created
correctly.
- Around line 18-25: The run block interpolates user-controlled
github.event.release.tag_name directly into the shell, which risks script
injection; instead, pass the tag into the job as an environment variable (e.g.
define RELEASE_TAG: ${{ github.event.release.tag_name }} under env:) and then
reference the safe shell variable inside the run script (use quoted
"$RELEASE_TAG" and the test [[ "$RELEASE_TAG" == 20* ]] ), update the echo to
write should_run to $GITHUB_OUTPUT the same way, and apply the same env-variable
pattern for the other occurrences of github.event.release.tag_name mentioned
(lines ~76 and ~95) so no untrusted value is expanded directly in the run block.
🧹 Nitpick comments (2)
.github/workflows/build-release.yml (2)
113-118: Overly broad permissions for deploy jobs.
issues: writeandpull-requests: writeare not used by the artifact download or Cloudflare deploy steps. Dropping them follows least-privilege. Same applies tomodern_deploy_latest(lines 143-148).Proposed fix
permissions: actions: read contents: read deployments: write - issues: write - pull-requests: write
109-166: Near-duplicate deploy jobs could be consolidated.
modern_deployandmodern_deploy_latestshare identical steps (download artifact → wrangler deploy) and differ only in branch/environment. Consider extracting a reusable workflow (or composite action) to reduce maintenance burden, though this is fine to defer.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/deploy.yml (1)
38-40:⚠️ Potential issue | 🟠 MajorCase mismatch in
commit_refoutput will produce an empty value.Line 28 sets the step output with uppercase key
COMMIT_REF, but line 18 declares the job output reading lowercasesteps.set_commit_ref.outputs.commit_ref. This mismatch causes the job-level output to be empty. Then line 40 referencesneeds.commit_reference.outputs.COMMIT_REF(uppercase), but the job-level key iscommit_ref(lowercase), which again resolves to an empty string. The build workflow receives an emptycommit_refon line 53, breaking the checkout step that depends on it.This is pre-existing, but since the new deployment flow depends on a successful build with a valid checkout reference, it should be fixed. Recommended fix: Make all keys lowercase—change line 28 to
echo "commit_ref=$COMMIT_REF" >> $GITHUB_OUTPUTand line 40 tocommit_ref: ${{ needs.commit_reference.outputs.commit_ref }}.
…acy branch names for the pr.yml (so that modern versions do not trigger it)
|
|
🎉 Do you want to test this code? 🎉 |
1 participant
Summary by CodeRabbit
New Features
Chores