chore(ci): harden the build and release supply chain - #1631
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (24)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request updates CI action pins, migrates the Maven Wrapper to 3.3.4, refreshes container and build inputs, pins development dependencies, and updates related documentation. ChangesSupply-chain and build updates
Estimated code review effort: 3 (Moderate) | ~30 minutes Merge Risk: ⚪ Minimal · up to This PR hardens CI and release inputs through immutable action, container, and build-tool versions without changing the application or deployment contract. No actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
Full details: Linked Issues checkExplanation The changes address the linked issue through pinned Action upgrades, container and Paketo digest updates, Maven Wrapper 3.3.4 migration, dependency updates, and obsolete bootstrap removal. Full compliance cannot be verified because pnpm-lock.yaml and maven-wrapper.jar were excluded from review, so dependency-lock consistency and wrapper artifact integrity are not observable. Full details: Out of Scope Changes checkExplanation The reviewed changes are related to the linked supply-chain hardening objective. The documentation, changeset, workflow, image, dependency, and Maven Wrapper updates support the stated scope, and no unrelated code changes are evident. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (23 skipped: 23 unsupported.)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📚 Documentation Preview
|
🧩 Storybook Preview
|
823a315 to
1950435
Compare
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A digest on the parameterized FROM made Docker resolve the PostgreSQL 18 index regardless of PG_MAJOR, so the upgrade drill's 17 source container booted an 18 server and never became ready. Digest-pinning this base needs drill-aware plumbing and belongs to the database stream. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1950435 to
5e52836
Compare
1 participant
Description
Brings the 1.0 build and release pipeline onto a coherent, immutable supply-chain baseline. This is not a mechanical Renovate roll-up: GitHub Action majors, Node runtime changes, workflow permissions, changed inputs, container manifests, buildpack order, Maven bootstrap integrity, release inventories, and the affected build paths were reviewed together.
Every third-party Action remains pinned to a complete executable commit SHA with an exact upstream version annotation. Container inputs are digest-pinned wherever the upstream supports immutable references. No compatibility branch, mutable fallback, warning suppression, or custom bootstrap implementation is retained.
The operator-facing application and deployment contract are unchanged. PostgreSQL server remains on 17; PostgreSQL 18 is intentionally excluded because it requires separate compatibility and migration work.
Fixes #1582
Outcome at a glance
docker/dockerfile:1.4/1.71.26at an OCI digestpostgres:17-bookwormnats:alpine2.14.6-alpineat an OCI digestGitHub Action inventory
All SHAs below were verified against upstream Git refs. Annotated tags use the peeled executable commit rather than the tag-object SHA.
marocchino/sticky-pull-request-commentactions/upload-pages-artifactactions/deploy-pagesgithub/codeql-action/upload-sariftrufflesecurity/trufflehogchromaui/actionKesin11/actions-timelineactions/labeleractions/github-scriptactions/attestactions/attest-build-provenancechangesets/actionCompatibility and permission review
version-script,pr-title,commit-message, and explicitgithub-token. The workflow only maintains the version PR;release.ymlremains the single owner of tags, publication, and deployment.contents: writeandpull-requests: writeremain job-scoped; no repository-wide permission expansion was introduced.v9.0.0commit (3a2844…), not the annotated tag object. Existing scripts use supported APIs and outputs.pnpm run commitlintreferenced a script that does not exist. This PR fixes the root cause by invoking the installed CLI withpnpm exec commitlint; the exact PR title passes locally.Immutable container and release inputs
docker/dockerfile:1.26@sha256:ecfaec…postgres:17-bookworm@sha256:051f7b…nats:2.14.6-alpine@sha256:ad7a43…traefik:v3.7.11@sha256:5203c3…builder-noble-java-tiny@sha256:3a9f6e…ubuntu-noble-run-tiny@sha256:c32333…health-checker@sha256:7ef317…/workspace/health-checkremains availableEach named container tag was resolved independently and its configured digest was confirmed to be the matching multi-platform OCI index rather than an accidental architecture-specific manifest.
Maven Wrapper migration
The obsolete Takari 0.5.6 bootstrap and checked-in
MavenWrapperDownloader.javaare removed. The repository now uses the upstream Apache Maven Wrapper 3.3.4 scripts and JAR with its native integrity controls:wrapperSha256Summatches the checked-in JARdistributionSha256Summatches the upstream ZIPThis removes custom download code rather than carrying it beside the wrapper's supported checksum mechanism.
Remaining dependency cleanup
@changesets/clifast-xml-parser^5.11.0@gitlab/svgs^3.160.0The remaining ranges in the web runtime belong to peer-sensitive UI packages such as dnd-kit, Monaco, and XYFlow. They are not mass-pinned here without concrete dashboard evidence; doing so would broaden this supply-chain PR into application dependency resolution work already owned by the web modernization stream.
Deliberate exclusions
Honest gaps and limitations
mvnw.cmdis checksum-backed but was not executed locally; hosted Windows CI is the authoritative environment.main. This PR neither introduces nor claims to close that separate alert.Verification
Local evidence
pnpm run formatpnpm run checkpnpm run verifypnpm exec commitlintThe complete local verification emits existing React Compiler and test-environment warnings from unrelated webapp code, plus Git's expected CRLF normalization notice for the upstream-generated
mvnw.cmd; none is hidden or caused by this supply-chain migration.GitHub evidence
The initial hosted run immediately validated Changesets, Compose rendering, the docs preview build, Action CodeQL analysis, and repository automation. It also exposed the broken pnpm-era title command described above, which is now fixed at the root and pushed. The full hosted matrix is rerunning for the corrected head; this section will only claim a complete pass after GitHub reports it.
How to test manually
There is no UI behavior to exercise. Reviewer smoke tests should target the changed trust boundaries:
cd server && ./mvnw --version; confirm Apache Maven 3.9.16 starts through Maven Wrapper 3.3.4 on JDK 21.printf '%s\n' 'chore(ci): harden the build and release supply chain' | pnpm exec commitlint; confirm the title passes.server/compose.yamland the release Compose files; confirm every updated image resolves by digest and PostgreSQL remains on 17.Checklist
Summary by CodeRabbit
Documentation
Bug Fixes
Chores