[ci] Enabled bot-changelog workflow#763
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughTwo new GitHub Actions workflows were added: Sequence Diagram(s)sequenceDiagram
participant Reviewer as Reviewer
participant TriggerWA as "bot-changelog-trigger\n(GitHub Actions)"
participant Artifact as "Artifact\nStorage"
participant RunnerWA as "bot-changelog-runner\n(GitHub Actions)"
participant Reusable as "Reusable\nWorkflow (openwisp-utils)"
Reviewer->>TriggerWA: Submit approved review (OWNER/MEMBER/COLLABORATOR)
TriggerWA->>TriggerWA: Read PR title, match ^[\[(feature|fix|change)\]]
alt Title matches
TriggerWA->>Artifact: Upload artifact (changelog-metadata with pr_number)
Artifact-->>TriggerWA: Confirm upload
else Title doesn't match
TriggerWA-->>TriggerWA: Skip artifact upload
end
Note over TriggerWA,RunnerWA: Trigger workflow completes
RunnerWA->>Artifact: Download changelog-metadata (continue-on-error)
Artifact-->>RunnerWA: Return pr_number (or empty)
alt pr_number present
RunnerWA->>Reusable: Call reusable workflow with pr_number + secrets
Reusable-->>RunnerWA: Changelog generation complete
else pr_number empty
RunnerWA-->>RunnerWA: Skip calling reusable workflow
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CI Failures DetectedHello @pushpitkamboj, There are multiple build failures due to the Failures & Remediation
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/bot-changelog.yml:
- Line 11: Replace the mutable branch reference in the reusable workflow call
with an immutable commit SHA: find the `uses:
openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master`
line and replace `@master` with the repository commit SHA for the exact version
you want to lock (e.g., `@<commit-sha>`). Ensure you fetch and verify the
correct commit SHA from the openwisp-utils repository, update the `uses:` entry
accordingly, and commit the change so the workflow is pinned to that immutable
SHA.
- Around line 5-6: The workflow currently fires for all submitted reviews
because it uses pull_request_review with types: [submitted]; update the job (or
step) to gate execution to only approval events by adding an if condition that
checks github.event.review.state == 'approved' (keep the existing
pull_request_review/types: [submitted] but add the conditional at the job/step
level) so the workflow runs only when a review is submitted with state
"approved".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6b7e4744-78cd-4326-90df-4df65d7fcb6c
📒 Files selected for processing (1)
.github/workflows/bot-changelog.yml
📜 Review details
🔇 Additional comments (1)
.github/workflows/bot-changelog.yml (1)
9-12: [Your rewritten review comment text here]
[Exactly ONE classification tag]
| pull_request_review: | ||
| types: [submitted] |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In GitHub Actions, for pull_request_reviewwithtypes: [submitted], does the workflow trigger for approved, commented, and changes_requested review states?
💡 Result:
Yes. pull_request_review with types: [submitted] fires whenever a PR review is submitted, regardless of whether the submitted review’s github.event.review.state is approved, commented, or changes_requested (you filter by state with an if: condition). [1], [2]
Gate execution to approved reviews only.
Line 6 (types: [submitted]) triggers for all submitted reviews, including commented and changes_requested states, not just approvals. This doesn't match the PR objective.
Proposed fix
on:
# Trigger when a PR review is submitted with approval
pull_request_review:
types: [submitted]
jobs:
changelog:
+ if: ${{ github.event.review.state == 'approved' }}
# Call the reusable workflow from openwisp-utils
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/bot-changelog.yml around lines 5 - 6, The workflow
currently fires for all submitted reviews because it uses pull_request_review
with types: [submitted]; update the job (or step) to gate execution to only
approval events by adding an if condition that checks github.event.review.state
== 'approved' (keep the existing pull_request_review/types: [submitted] but add
the conditional at the job/step level) so the workflow runs only when a review
is submitted with state "approved".
| jobs: | ||
| changelog: | ||
| # Call the reusable workflow from openwisp-utils | ||
| uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What do GitHub Actions security best practices recommend for reusable workflow references: branch refs (e.g., @master) vs pinned commit SHA?
💡 Result:
GitHub Actions security guidance recommends pinning reusable workflow references to an immutable, full-length commit SHA (rather than a mutable ref like a branch name such as @master/@main, or a moving tag), to reduce supply-chain risk from a compromised repo updating that branch/tag to malicious code. You can then use tools like Dependabot to keep those pinned SHAs up to date. [1], [2]
Pin the reusable workflow to an immutable commit SHA.
Line 11 uses @master, which is mutable and increases supply-chain risk. Pin to a commit SHA instead to ensure reproducibility and prevent the workflow from being silently updated to malicious code.
Proposed fix
- uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master
+ uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@<commit-sha>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master | |
| uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@abc123def456... |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/bot-changelog.yml at line 11, Replace the mutable branch
reference in the reusable workflow call with an immutable commit SHA: find the
`uses:
openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master`
line and replace `@master` with the repository commit SHA for the exact version
you want to lock (e.g., `@<commit-sha>`). Ensure you fetch and verify the
correct commit SHA from the openwisp-utils repository, update the `uses:` entry
accordingly, and commit the change so the workflow is pinned to that immutable
SHA.
|
CI failure is unrelated to the PR changes. |
CI Failure AnalysisHello @pushpitkamboj, Test Failures1. Fatal Python error: Aborted / double free or corruption (fasttop)
2. RuntimeWarning: DateTimeField ... received a naive datetime while time zone support is active.
3. Slow Test Failures
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/bot-changelog-runner.yml:
- Line 24: Replace mutable action/workflow references with full commit SHAs:
locate usages of actions/download-artifact@v4 and the other reusable
workflow/reference currently pinned as `@master` and update each to the
corresponding full-length commit SHA for that repository; ensure you fetch the
exact commit SHA from the upstream repo (or GitHub UI) and replace the tag
strings so the workflow uses actions/download-artifact@<full-commit-sha> and the
reusable workflow@<full-commit-sha> to avoid mutable tags for secrets like
OPENWISP_BOT_PRIVATE_KEY.
In @.github/workflows/bot-changelog-trigger.yml:
- Line 33: Replace the mutable tag usage "uses: actions/upload-artifact@v4" with
a pinned full commit SHA for the actions/upload-artifact action; locate the line
containing that exact string in the workflow and update it to "uses:
actions/upload-artifact@<full-commit-sha>" (obtain the full SHA from the
actions/upload-artifact repository release/commit you intend to pin) so the
workflow references an immutable commit instead of the `@v4` tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a88973f8-b20e-4acd-ac7a-3c1d4c112bb3
📒 Files selected for processing (2)
.github/workflows/bot-changelog-runner.yml.github/workflows/bot-changelog-trigger.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.13 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=4.2.0
🔇 Additional comments (2)
.github/workflows/bot-changelog-trigger.yml (1)
9-29: Approval and noteworthy gating logic looks solid.The job-level approval filter plus conditional artifact creation is clear and correctly scoped.
.github/workflows/bot-changelog-runner.yml (1)
31-40: PR metadata validation is well implemented.The numeric guard before setting
pr_numberoutput is a good safety check.
| steps: | ||
| - name: Download PR metadata | ||
| id: download | ||
| uses: actions/download-artifact@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/bot-changelog-runner.ymlRepository: openwisp/openwisp-monitoring
Length of output: 1911
🌐 Web query:
GitHub Actions security best practices pinning actions to commit SHA
💡 Result:
Pinning GitHub Actions to a full-length commit SHA is a critical security best practice to prevent supply chain attacks. This ensures actions are immutable, as a specific SHA cannot be altered without creating a SHA-1 collision, mitigating risks from compromised repositories where attackers could push malicious code to tags or branches. Key practices: - Always use full-length commit SHAs (40 characters) instead of tags like 'v1' or 'main', which can be updated maliciously. Example: - uses: actions/checkout@192f8e1 # v4.1.7 Verify the SHA from the official repository's releases or commits, not forks. - Prioritize for third-party and high-risk actions handling secrets or repository access. - Audit action source code and prefer verified creators from GitHub Marketplace. - Use tools like pinact, pin-github-action, or Dependabot/Renovate for automation and updates. - Enforce organization-wide via GitHub policies: Enable "Require actions to be pinned to a full-length commit SHA" in repository/organization settings under Actions > General > Policies. Additional best practices: - Set GITHUB_TOKEN to read-only permissions by default. - Use Dependabot alerts for vulnerabilities (note: doesn't cover SHA-pinned actions). - Review and periodically update SHAs for security fixes. This aligns with GitHub's security hardening guide and recent policy updates supporting SHA enforcement.
Citations:
- 1: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 2: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 3: https://www.codewrecks.com/post/github/github-sha-pinning/
- 4: https://dev.to/ciberconscientes/github-actions-why-you-should-pin-your-actions-to-a-specific-version-1513
- 5: https://docs.github.com/en/actions/reference/security/secure-use
- 6: https://dev.to/suzukishunsuke/pin-github-actions-to-a-full-length-commit-sha-for-security-2n7p
- 7: https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/cicd/github/unpinned_actions_full_length_commit_sha/
- 8: https://github.com/mheap/pin-github-action
- 9: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
Pin actions and reusable workflows to full commit SHAs instead of mutable version tags or branch references.
Lines 24 and 45 use mutable references (@v4 and @master) that can be silently updated. Since this workflow handles sensitive secrets including OPENWISP_BOT_PRIVATE_KEY, both should be pinned to full-length commit SHAs to prevent supply chain attacks.
Hardening
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@<full_commit_sha>- uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@master
+ uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-changelog.yml@<full_commit_sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/bot-changelog-runner.yml at line 24, Replace mutable
action/workflow references with full commit SHAs: locate usages of
actions/download-artifact@v4 and the other reusable workflow/reference currently
pinned as `@master` and update each to the corresponding full-length commit SHA
for that repository; ensure you fetch the exact commit SHA from the upstream
repo (or GitHub UI) and replace the tag strings so the workflow uses
actions/download-artifact@<full-commit-sha> and the reusable
workflow@<full-commit-sha> to avoid mutable tags for secrets like
OPENWISP_BOT_PRIVATE_KEY.
|
|
||
| - name: Upload PR metadata | ||
| if: steps.check.outputs.has_noteworthy == 'true' | ||
| uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/bot-changelog-trigger.yml | head -50Repository: openwisp/openwisp-monitoring
Length of output: 1405
🏁 Script executed:
# Check if the file exists and get its full content
wc -l .github/workflows/bot-changelog-trigger.ymlRepository: openwisp/openwisp-monitoring
Length of output: 118
🏁 Script executed:
# Search for all 'uses:' statements in the workflow file
rg "uses:" .github/workflows/bot-changelog-trigger.yml -A 1Repository: openwisp/openwisp-monitoring
Length of output: 126
🌐 Web query:
GitHub Actions best practices version pinning commit SHA 2025
💡 Result:
GitHub Actions best practices strongly recommend pinning actions to full-length commit SHAs for security and reproducibility. This prevents supply chain attacks where malicious code could be injected via mutable tags or branches. Key practices: - Use full 40-character commit SHA: uses: actions/checkout@692d365 # v4.1.4 - Find SHA by visiting the action repo, selecting the tag/release, and copying the commit hash from the URL or branch switcher. - Add version comment for readability and tracking. - Prioritize for third-party and high-risk actions (those handling secrets or deployments). - For GitHub-owned actions (actions/, github/), tags like @v4 are acceptable if trusted, but SHA is still best. - Pin runners too: runs-on: ubuntu-24.04 instead of ubuntu-latest. Automation and enforcement (2025 updates): - Use Dependabot or Renovate to update pinned SHAs: Renovate's helpers:pinGitHubActionDigests preset automates SHA pinning and updates. - Tools: pin-github-action, pinact for bulk pinning. - Enforce via policies: Repository/Org/Enterprise settings > Actions > General > "Require actions to be pinned to a full-length commit SHA" checkbox (introduced Aug 2025). - Validation actions: zgosalvez/github-actions-ensure-sha-pinned-actions to fail builds on unpinned actions. Tradeoffs: - SHAs are immutable but require updates for fixes/security patches. - Balance with scheduled updates via PRs. Official guidance: GitHub Docs "Secure use reference" states SHA pinning is the only immutable way, mitigating SHA-1 collision attacks needed for supply chain compromise.
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
- 3: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
- 4: https://docs.github.com/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise
- 5: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 6: https://dev.to/ciberconscientes/github-actions-why-you-should-pin-your-actions-to-a-specific-version-1513
- 7: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
Pin actions/upload-artifact to an immutable commit SHA.
Line 33 uses a mutable major tag (@v4), which weakens workflow integrity guarantees. GitHub Actions best practices recommend pinning all actions to full-length commit SHAs to prevent supply chain attacks and ensure reproducible workflows.
- name: Upload PR metadata
if: steps.check.outputs.has_noteworthy == 'true'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@692d36539f903b6016f51ba6bba3eedbf55d65af # v4
with:
name: changelog-metadata
path: pr_number📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/upload-artifact@v4 | |
| uses: actions/upload-artifact@692d36539f903b6016f51ba6bba3eedbf55d65af # v4 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/bot-changelog-trigger.yml at line 33, Replace the mutable
tag usage "uses: actions/upload-artifact@v4" with a pinned full commit SHA for
the actions/upload-artifact action; locate the line containing that exact string
in the workflow and update it to "uses:
actions/upload-artifact@<full-commit-sha>" (obtain the full SHA from the
actions/upload-artifact repository release/commit you intend to pin) so the
workflow references an immutable commit instead of the `@v4` tag.
pushpitkamboj
force-pushed
the
ci/changelog_bot
branch
from
13027d7 to
db2de77
Compare
Prettier Check Failed:
|
pushpitkamboj
force-pushed
the
ci/changelog_bot
branch
from
76a4bf1 to
246341b
Compare
{
"failures": [
{
"name": "Commit Message",
"message": "Invalid commit message format",
"details": "The commit message does not follow the expected format. Please ensure your commit message includes a header in the format `[tag] Capitalized short title #<issue>`, followed by a blank line, a detailed description, and a footer with a closing keyword and issue number (e.g., `Fixes #123`).",
"command": "git commit --amend"
}
]
}Commit Message Invalid FormatHello @pushpitkamboj,
|
pushpitkamboj
force-pushed
the
ci/changelog_bot
branch
from
246341b to
35c1c88
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/bot-changelog-trigger.yml:
- Line 17: Replace the mutable runner label used by the runs-on key to a fixed
OS version: change the runs-on value from "ubuntu-latest" to a specific pinned
label such as "ubuntu-24.04" (i.e., update the runs-on: "ubuntu-latest" line to
runs-on: "ubuntu-24.04") so the workflow uses a stable, reproducible runner
image.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 836451f5-fe21-4f5e-9645-b38e6db4d8fd
📒 Files selected for processing (1)
.github/workflows/bot-changelog-trigger.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.10 | django~=5.2.0
- GitHub Check: Python==3.13 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=5.1.0
🔇 Additional comments (2)
.github/workflows/bot-changelog-trigger.yml (2)
36-36: Pinactions/upload-artifactto a full commit SHA.Line 36 still uses a mutable tag (
@v4). This was already flagged in prior review and remains unresolved.What is the current full commit SHA to pin for actions/upload-artifact v4, and what does GitHub recommend for immutable action pinning?
12-32: Approval gate and metadata extraction look correct.The review-state/author-association checks and PR-title filtering logic are aligned with the workflow objective, and the PR number handoff is clean.
| (github.event.review.author_association == 'OWNER' || | ||
| github.event.review.author_association == 'MEMBER' || | ||
| github.event.review.author_association == 'COLLABORATOR') | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
🧩 Analysis chain
🌐 Web query:
What are GitHub’s current recommendations for pinning runs-on runner images in GitHub Actions workflows?
💡 Result:
GitHub does not recommend or support directly pinning runs-on runner images to specific versions (e.g., ubuntu-24.04-20250915.62.1) in standard GitHub-hosted runners. Instead, the current recommendation is to use specific OS version labels like ubuntu-24.04, ubuntu-22.04, windows-2025, or macos-15 to avoid unexpected changes from -latest aliases, which roll forward to newer OS versions (e.g., ubuntu-latest now points to ubuntu-24.04 as of early 2025).
Citations:
- 1: https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job
- 2: https://docs.github.com/en/actions/reference/github-hosted-runners-reference
- 3: https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job
- 4: Please allow pinning an image to a specific version like
20250915.62.1, so users get control over *when* image updates break their CI 🙏 actions/runner-images#13034 - 5: Ubuntu-latest workflows will use Ubuntu-24.04 image actions/runner-images#10636
- 6: https://docs.github.com/en/actions/reference/runners/github-hosted-runners
- 7: https://github.com/actions/runner-images
Use a fixed runner image instead of ubuntu-latest.
ubuntu-latest is mutable and can introduce non-reproducible CI behavior. Pin to a specific OS version label like ubuntu-24.04 to ensure consistency.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/bot-changelog-trigger.yml at line 17, Replace the mutable
runner label used by the runs-on key to a fixed OS version: change the runs-on
value from "ubuntu-latest" to a specific pinned label such as "ubuntu-24.04"
(i.e., update the runs-on: "ubuntu-latest" line to runs-on: "ubuntu-24.04") so
the workflow uses a stable, reproducible runner image.
Commit Message and Test FailuresHello @pushpitkamboj,
Correct format example:
These failures indicate that the actual number of data points or charts returned by the API does not match the expected values in the tests. You need to investigate why the API is returning fewer data points than expected for |
|
Hi @pushpitkamboj 👋, This pull request has been marked as stale due to 41 days of inactivity after changes were requested. As a result, the linked issue(s) have been unassigned from you to allow other contributors to work on it. However, you can still continue working on this PR! If you push new commits or respond to the review feedback:
If you need more time or have questions about the requested changes, please let us know. We're happy to help! 🤝 If there's no further activity within 19 more days, this PR will be automatically closed (but can be reopened anytime). |
pushpitkamboj
force-pushed
the
ci/changelog_bot
branch
from
a8544ee to
de476b6
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/bot-changelog-trigger.yml (1)
35-35:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPin
actions/upload-artifactto a full commit SHA.Line 35 uses a mutable tag (
@v7). Please pin it to an immutable 40-char SHA for reproducibility and supply-chain hardening.#!/bin/bash # Verify unpinned action refs in this workflow and fetch SHA candidates. set -euo pipefail echo "Unpinned uses in trigger workflow:" rg -n '^\s*uses:\s*[^@]+@(?:v[0-9]+|master|main|latest)\s*$' .github/workflows/bot-changelog-trigger.yml || true echo echo "Latest upload-artifact release tag + commit:" curl -fsSL https://api.github.com/repos/actions/upload-artifact/releases/latest | jq -r '.tag_name, .target_commitish'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/bot-changelog-trigger.yml at line 35, The workflow currently uses a mutable tag "uses: actions/upload-artifact@v7" which should be pinned to an immutable 40-character commit SHA to improve reproducibility and supply-chain security; replace the "uses: actions/upload-artifact@v7" entry with "uses: actions/upload-artifact@<40-char-commit-sha>" (the exact SHA for the v7 tag) — obtain the correct SHA for the v7 release from the actions/upload-artifact GitHub API or the releases page and update the uses line accordingly so the workflow references that full commit SHA instead of the v7 tag..github/workflows/bot-changelog-runner.yml (1)
23-23:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winUse immutable SHAs for both action and reusable workflow references.
Lines 23 and 48 use mutable refs (
@v8,@master). Since this workflow passes sensitive secrets, both should be pinned to full commit SHAs.#!/bin/bash # Detect mutable refs and fetch SHAs to pin. set -euo pipefail echo "Mutable refs in runner workflow:" rg -n '^\s*uses:\s*[^@]+@(?:v[0-9]+|master|main|latest)\s*$' .github/workflows/bot-changelog-runner.yml || true echo echo "Latest download-artifact release tag + commit:" curl -fsSL https://api.github.com/repos/actions/download-artifact/releases/latest | jq -r '.tag_name, .target_commitish' echo echo "Current SHA behind openwisp-utils master:" curl -fsSL https://api.github.com/repos/openwisp/openwisp-utils/commits/master | jq -r '.sha'Also applies to: 48-48
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/bot-changelog-runner.yml at line 23, The workflow uses mutable action/workflow refs (e.g. uses: actions/download-artifact@v8 and the reusable workflow reference pinned to `@master`); replace both mutable tags with the corresponding full commit SHAs to make them immutable. Locate the two uses: lines referencing actions/download-artifact@v8 and the reusable workflow reference using `@master`, query the GitHub API or the upstream repo to get the exact commit SHA for each reference, and update the workflow to use uses: actions/download-artifact@<full-sha> and uses: <owner>/<repo>@<full-sha> (or the reusable workflow's full SHA) so secrets are only passed to pinned commits.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/bot-changelog-runner.yml:
- Line 23: The workflow uses mutable action/workflow refs (e.g. uses:
actions/download-artifact@v8 and the reusable workflow reference pinned to
`@master`); replace both mutable tags with the corresponding full commit SHAs to
make them immutable. Locate the two uses: lines referencing
actions/download-artifact@v8 and the reusable workflow reference using `@master`,
query the GitHub API or the upstream repo to get the exact commit SHA for each
reference, and update the workflow to use uses:
actions/download-artifact@<full-sha> and uses: <owner>/<repo>@<full-sha> (or the
reusable workflow's full SHA) so secrets are only passed to pinned commits.
In @.github/workflows/bot-changelog-trigger.yml:
- Line 35: The workflow currently uses a mutable tag "uses:
actions/upload-artifact@v7" which should be pinned to an immutable 40-character
commit SHA to improve reproducibility and supply-chain security; replace the
"uses: actions/upload-artifact@v7" entry with "uses:
actions/upload-artifact@<40-char-commit-sha>" (the exact SHA for the v7 tag) —
obtain the correct SHA for the v7 release from the actions/upload-artifact
GitHub API or the releases page and update the uses line accordingly so the
workflow references that full commit SHA instead of the v7 tag.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c73da99c-db50-457c-af8e-b50a00d07a2b
📒 Files selected for processing (2)
.github/workflows/bot-changelog-runner.yml.github/workflows/bot-changelog-trigger.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.13 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.2.0
|
The CI is failing due to transient infrastructure issues (not related to your code). I have restarted the failed jobs automatically (1/3). |
Multiple Test Failures DetectedHello @pushpitkamboj, There are multiple test failures in your commit. Please address the following:
Please fix these test failures and push a new commit. |
nemesifier
changed the title
2 participants
Checklist
Reference to Existing Issue
Closes #762
Description of Changes
Added a changelog bot workflow to automatically update changelogs when PRs are approved.