ci(gateway): prompt for next dev version on release#2870
ci(gateway): prompt for next dev version on release#2870renuka-fernando wants to merge 1 commit into
Conversation
Replace the automatic next-dev version bump in the gateway release workflow with a required workflow_dispatch input. The maintainer now provides the next development version (with -SNAPSHOT suffix) when triggering the release, which is applied via `version-set` and referenced in the version-bump PR body.
📝 WalkthroughWalkthroughThe gateway release workflow now requires a manually supplied next development version, validates and applies it through the gateway Make target, and includes the selected version in the automated pull request description. ChangesGateway release versioning
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gateway-release.yml:
- Line 79: Update the release workflow steps containing NEXT_DEV_VERSION and the
corresponding Make argument to avoid interpolating inputs directly into shell
source: expose the workflow input through the step’s env configuration,
reference the environment variable in the script with safe quoting, and quote
the Make argument so input contents cannot alter command parsing.
- Around line 80-85: Update the NEXT_DEV_VERSION validation in the gateway
release workflow to reject values that do not end with the required “-SNAPSHOT”
suffix, while retaining the existing missing-value error handling. Only invoke
`make ... version-set` after the value passes both non-empty and suffix-format
validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 79154c55-3e86-4968-9d10-8325544267bf
📒 Files selected for processing (1)
.github/workflows/gateway-release.yml
| run: make -C gateway version-bump-next-dev | ||
| - name: Set next dev version | ||
| run: | | ||
| NEXT_DEV_VERSION="${{ inputs.next_dev_version }}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Do not interpolate the workflow input into shell source.
A value containing quotes or shell syntax can break out of the assignment at Line 79 and execute arbitrary commands in the release job. Pass the input through env: and quote the Make argument.
Proposed fix
- name: Set next dev version
+ env:
+ NEXT_DEV_VERSION: ${{ inputs.next_dev_version }}
run: |
- NEXT_DEV_VERSION="${{ inputs.next_dev_version }}"
if [ -z "${NEXT_DEV_VERSION}" ]; then
echo "Error: next_dev_version input is required"
exit 1
fi
echo "Setting gateway to next dev version: ${NEXT_DEV_VERSION}"
- make -C gateway version-set VERSION=${NEXT_DEV_VERSION}
+ make -C gateway version-set "VERSION=${NEXT_DEV_VERSION}"Also applies to: 85-85
🧰 Tools
🪛 zizmor (1.26.1)
[error] 79-79: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/gateway-release.yml at line 79, Update the release
workflow steps containing NEXT_DEV_VERSION and the corresponding Make argument
to avoid interpolating inputs directly into shell source: expose the workflow
input through the step’s env configuration, reference the environment variable
in the script with safe quoting, and quote the Make argument so input contents
cannot alter command parsing.
Source: Linters/SAST tools
| if [ -z "${NEXT_DEV_VERSION}" ]; then | ||
| echo "Error: next_dev_version input is required" | ||
| exit 1 | ||
| fi | ||
| echo "Setting gateway to next dev version: ${NEXT_DEV_VERSION}" | ||
| make -C gateway version-set VERSION=${NEXT_DEV_VERSION} |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Validate the required -SNAPSHOT version format.
The current check accepts any non-empty value, despite the input contract requiring a development version with the -SNAPSHOT suffix. version-set propagates this value into VERSION, Compose, Helm, and build artifacts.
Proposed fix
if [ -z "${NEXT_DEV_VERSION}" ]; then
echo "Error: next_dev_version input is required"
exit 1
fi
+ if [[ ! "${NEXT_DEV_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-SNAPSHOT$ ]]; then
+ echo "Error: next_dev_version must match X.Y.Z-SNAPSHOT"
+ exit 1
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if [ -z "${NEXT_DEV_VERSION}" ]; then | |
| echo "Error: next_dev_version input is required" | |
| exit 1 | |
| fi | |
| echo "Setting gateway to next dev version: ${NEXT_DEV_VERSION}" | |
| make -C gateway version-set VERSION=${NEXT_DEV_VERSION} | |
| if [ -z "${NEXT_DEV_VERSION}" ]; then | |
| echo "Error: next_dev_version input is required" | |
| exit 1 | |
| fi | |
| if [[ ! "${NEXT_DEV_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-SNAPSHOT$ ]]; then | |
| echo "Error: next_dev_version must match X.Y.Z-SNAPSHOT" | |
| exit 1 | |
| fi | |
| echo "Setting gateway to next dev version: ${NEXT_DEV_VERSION}" | |
| make -C gateway version-set VERSION=${NEXT_DEV_VERSION} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/gateway-release.yml around lines 80 - 85, Update the
NEXT_DEV_VERSION validation in the gateway release workflow to reject values
that do not end with the required “-SNAPSHOT” suffix, while retaining the
existing missing-value error handling. Only invoke `make ... version-set` after
the value passes both non-empty and suffix-format validation.
1 participant
Purpose
The gateway release workflow currently bumps to the next development version automatically (minor + 1, with
-SNAPSHOT) viamake version-bump-next-dev. This removes control over the version chosen after a release — for example when the next cycle should be a patch, a specific minor, or carry an-rcpre-release qualifier. This PR makes the next development version an explicit, maintainer-provided input at release time.Goals
Let the maintainer specify the exact next development version when triggering the Gateway Release workflow, instead of having it computed automatically.
Approach
next_dev_versioninput to theworkflow_dispatchtrigger (string, documented to include the-SNAPSHOTsuffix, e.g.1.3.0-SNAPSHOT).make -C gateway version-bump-next-devstep with a step that validates the input and applies it viamake -C gateway version-set VERSION=<input>.The release version itself is still derived automatically from the
VERSIONfile (with-SNAPSHOTstripped); only the next development version is now prompted.Related Issues
N/A
Documentation
N/A — internal release automation change with no product documentation impact.
Automation tests
Security checks
Related PRs
N/A
Checklist