ci: modernize GoReleaser config and GitHub Actions workflows - #1607
Conversation
- Restructure release model from prod/dev to stable/nightly - Standardize and update existing workflows - Update Dockerfiles - Disable goconst golangi-lint linter - Apply minor code updates with slices.Backward(), secure cookie attributes, and removal of stale lint directives
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR restructures CI/CD: replaces legacy dev/prod release workflows with nightly/stable flows, reorganizes GoReleaser configs, modernizes Docker multi-platform builds, adds linting and supply-chain scans, removes several workflows and Dependabot, and applies small code cleanups and editor/config updates. ChangesRelease Pipeline & Build Orchestration
Docker & Container Build Modernization
Linting, Security & Developer Automation
Code Refactoring & Configuration
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Security | 1 high |
🟢 Metrics 0 duplication
Metric Results Duplication 0
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Codecov Report❌ Patch coverage is
@@ Coverage Diff @@
## main #1607 +/- ##
==========================================
- Coverage 75.13% 75.06% -0.07%
==========================================
Files 58 58
Lines 9763 9795 +32
==========================================
+ Hits 7335 7353 +18
- Misses 2168 2181 +13
- Partials 260 261 +1
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/build.yaml (1)
21-24:⚠️ Potential issue | 🟠 Major | ⚡ Quick winMake Docker Hub secrets optional at the workflow boundary to enable
DRY_RUNin restricted contexts.Lines 21-24 require DockerHub secrets unconditionally at the workflow-call boundary. This prevents callers from invoking this reusable workflow with
DRY_RUN=truewhen secrets are unavailable (e.g., in forks or restricted environments), even though theif: ${{ !inputs.DRY_RUN }}guards on the Docker Hub login steps would skip them. Currently, both production callers (release-stable.yamlandrelease-nightly.yaml) always provide secrets, so this doesn't affect existing workflows, but it unnecessarily restricts flexibility.Solution: Change
required: truetorequired: falsefor both secrets and add a runtime validation step that enforces credential presence only whenDRY_RUN=false, allowing dry-run invocations without secrets.Suggested patch
on: workflow_call: secrets: DOCKERHUB_USERNAME: - required: true + required: false DOCKERHUB_TOKEN: - required: true + required: false steps: - name: Validate BUILD_TYPE input env: BUILD_TYPE: ${{ inputs.BUILD_TYPE }} run: | if [[ "${BUILD_TYPE}" != "stable" && "${BUILD_TYPE}" != "nightly" ]]; then echo "Error: BUILD_TYPE must be 'stable' or 'nightly', got '${BUILD_TYPE}'" exit 1 fi + + - name: Validate Docker Hub credentials for publish mode + if: ${{ !inputs.DRY_RUN }} + env: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + run: | + if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then + echo "Error: DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are required when DRY_RUN=false" + exit 1 + fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yaml around lines 21 - 24, Change the workflow inputs DOCKERHUB_USERNAME and DOCKERHUB_TOKEN from required: true to required: false so callers can invoke with DRY_RUN=true without secrets, and add a runtime validation step that checks inputs.DRY_RUN and only fails if DRY_RUN is false and either DOCKERHUB_USERNAME or DOCKERHUB_TOKEN is missing; reference the input names DOCKERHUB_USERNAME, DOCKERHUB_TOKEN and the DRY_RUN input and ensure the validation runs before any steps that assume the credentials (i.e., before the Docker login step guarded by if: ${{ !inputs.DRY_RUN }}).
🧹 Nitpick comments (1)
internal/actions/update.go (1)
1317-1318: 💤 Low valueConsider eliminating the intermediate variable.
The value variable
vis immediately assigned tocwithout any transformation. You can simplify by usingcdirectly in the range statement.♻️ Proposed simplification
- for i, v := range slices.Backward(containers) { - c := v + for i, c := range slices.Backward(containers) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/actions/update.go` around lines 1317 - 1318, The loop creates an unnecessary intermediate variable `c` by assigning `v` to `c`; change the range to bind `c` directly (e.g., use `for i, c := range slices.Backward(containers) {`) and remove the redundant `c := v` assignment so the loop body uses `c` directly; this touches the loop over `slices.Backward(containers)` and the variables `v` and `c`.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yaml:
- Around line 119-125: The "Upload Binary SBOMs" upload step uses the wrong glob
and silent-ignore behavior: change the artifact path from "dist/*.sbom" to
"dist/*.sbom.json" to match GoReleaser output and remove or change
"if-no-files-found: ignore" so missing SBOMs fail the job (e.g., delete that
line or set it to "error"); update the step that uses actions/upload-artifact
and relies on inputs.DRY_RUN/inputs.BUILD_TYPE accordingly so uploads don't
silently skip when SBOMs are absent.
In @.github/workflows/clean-cache.yaml:
- Around line 18-35: The condition includes workflow_dispatch but the Clean
Cache step always sets branch to refs/pull/${{ github.event.pull_request.number
}}/merge which is undefined for manual triggers; fix by making the branch
parameter conditional or pluggable: add a workflow_dispatch input (e.g.,
inputs.branch) and change the Clean Cache step’s branch to use the input when
present, or alter the if/condition to only allow the step when
github.event.pull_request exists (i.e., remove workflow_dispatch or guard the
branch assignment), updating the Clean Cache usage that references
gh-repo/branch accordingly.
In @.github/workflows/lint-go.yaml:
- Around line 7-13: The PR path filter in .github/workflows/lint-go.yaml
currently only lists source code and go.mod files; update the paths: section to
include lint and workflow configuration files (e.g., add build/**, .github/** or
the specific config directory like build/golangci-lint/** and any top-level CI
config files) so changes to lint/workflow configs will trigger this workflow;
modify the paths array in lint-go.yaml accordingly to include those config
locations.
In @.github/workflows/publish-docs.yaml:
- Around line 14-16: The workflow currently sets the repository contents
permission to read via the permissions: contents: read setting which prevents
the job from pushing commits when running mike deploy --push; update the
workflow permissions so the job can push by changing the contents permission to
write (e.g., permissions: contents: write) or scoping a write permission to the
specific job that runs mike deploy (refer to the step invoking mike deploy
--push) so the push step (lines around the mike deploy --push invocation) has
the必要 write permission.
In @.github/workflows/release-nightly.yaml:
- Around line 27-37: The job currently sets job-level permissions only to
"actions: read" which prevents actions/checkout from accessing repository
contents; update the job permissions to include "contents: read" so the
"Checkout Repository" step (uses: actions/checkout) can succeed (keep the
existing conditional if: ${{ inputs.FORCE_RELEASE != 'true' }} unchanged).
In `@examples/lifecycle-hooks/synology-stop/synology-stop.go`:
- Around line 357-363: The Secure cookie flag is being set unconditionally which
breaks HTTP connections; modify the configuration loader to parse config.SynoURL
(use net/url.Parse) and add a boolean field like Config.IsHTTPS (true when
scheme == "https"), then update all cookie creations in authenticate(),
stopContainer(), and logout() to set Cookie.Secure = cfg.IsHTTPS instead of true
so the session cookie is only marked Secure for HTTPS endpoints.
---
Outside diff comments:
In @.github/workflows/build.yaml:
- Around line 21-24: Change the workflow inputs DOCKERHUB_USERNAME and
DOCKERHUB_TOKEN from required: true to required: false so callers can invoke
with DRY_RUN=true without secrets, and add a runtime validation step that checks
inputs.DRY_RUN and only fails if DRY_RUN is false and either DOCKERHUB_USERNAME
or DOCKERHUB_TOKEN is missing; reference the input names DOCKERHUB_USERNAME,
DOCKERHUB_TOKEN and the DRY_RUN input and ensure the validation runs before any
steps that assume the credentials (i.e., before the Docker login step guarded by
if: ${{ !inputs.DRY_RUN }}).
---
Nitpick comments:
In `@internal/actions/update.go`:
- Around line 1317-1318: The loop creates an unnecessary intermediate variable
`c` by assigning `v` to `c`; change the range to bind `c` directly (e.g., use
`for i, c := range slices.Backward(containers) {`) and remove the redundant `c
:= v` assignment so the loop body uses `c` directly; this touches the loop over
`slices.Backward(containers)` and the variables `v` and `c`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4b1836a7-c9b2-45f0-afc7-e1e505b994b2
📒 Files selected for processing (35)
.editorconfig.github/actions/clean-cache/action.yml.github/dependabot.yml.github/renovate.json.github/workflows/build.yaml.github/workflows/changelog-update.yaml.github/workflows/clean-cache.yaml.github/workflows/create-manifests.yaml.github/workflows/lint-go.yaml.github/workflows/lint.yaml.github/workflows/publish-docs.yaml.github/workflows/pull-request.yaml.github/workflows/release-dev.yaml.github/workflows/release-nightly.yaml.github/workflows/release-prod.yaml.github/workflows/release-stable.yaml.github/workflows/scorecard.yml.github/workflows/security.yaml.github/workflows/test.yaml.github/workflows/update-changelog.yaml.github/workflows/update-go-docs.yamlbuild/docker/Dockerfilebuild/docker/Dockerfile.self-githubbuild/docker/Dockerfile.self-localbuild/golangci-lint/golangci-lint.yamlbuild/goreleaser/dev.ymlbuild/goreleaser/nightly.yamlbuild/goreleaser/prod.ymlbuild/goreleaser/stable.yamlcliff.tomlexamples/lifecycle-hooks/synology-stop/synology-stop.gointernal/actions/update.gopkg/metrics/metrics.gopkg/notifications/shoutrrr.gopkg/registry/auth/auth.go
💤 Files with no reviewable changes (10)
- pkg/registry/auth/auth.go
- .github/workflows/release-dev.yaml
- .github/workflows/lint.yaml
- .github/dependabot.yml
- .github/workflows/pull-request.yaml
- build/goreleaser/prod.yml
- .github/workflows/changelog-update.yaml
- .github/workflows/release-prod.yaml
- .github/workflows/create-manifests.yaml
- build/goreleaser/dev.yml
| - name: Upload Binary SBOMs | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| if: ${{ !inputs.DRY_RUN && inputs.BUILD_TYPE == 'stable' }} | ||
| with: | ||
| name: ${{ inputs.BUILD_TYPE }}-binary-sboms | ||
| path: dist/*.sbom | ||
| if-no-files-found: ignore |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow SBOM upload configuration:"
rg -n 'Upload Binary SBOMs|path:|if-no-files-found' .github/workflows/build.yaml -C2
echo
echo "GoReleaser stable SBOM output configuration:"
rg -n 'sbom|sboms|name_template|format' build/goreleaser/stable.yaml -C3Repository: nicholas-fedor/watchtower
Length of output: 2491
🏁 Script executed:
cat -n build/goreleaser/stable.yaml | sed -n '280,320p'Repository: nicholas-fedor/watchtower
Length of output: 1645
🏁 Script executed:
rg -n 'sbom' build/goreleaser/stable.yaml -A 10 -B 2Repository: nicholas-fedor/watchtower
Length of output: 733
🌐 Web query:
GoReleaser SBOM default output naming format files
💡 Result:
GoReleaser SBOMs default output filename templates (written into dist) are configured via the sboms[].documents option. 1) Default sbom id - The default SBOM config id is “default” when sboms[].id is omitted. [1] 2) Default documents (filenames) depending on sboms[].artifacts - If artifacts: "binary", default documents is: {{.Binary }}{{.Version }}{{.Os }}_{{.Arch }}.sbom.json [2][1] - If artifacts: "any", there are no default documents (empty list), so no SBOM outputs are produced unless you set sboms[].documents yourself. [2][1] - Otherwise (e.g., artifacts: "archive" or “source”), default documents is: {{.ArtifactName }}.sbom.json [2][1] 3) What the generated files look like in dist - A typical generated SBOM file corresponds to each cataloged artifact filename with a “.sbom.json” suffix. For example, an archive named my-cmd_1.2.3_linux_arm64.tar.gz results in my-cmd_1.2.3_linux_arm64.tar.gz.sbom.json. [3] 4) Note about.json - GoReleaser’s SBOM docs/defaults include the “.sbom.json” suffix (not just “.sbom”), reflecting an update that appended the “.json” to the default SBOM output naming. [2][4]
Citations:
- 1: https://github.com/goreleaser/goreleaser/blob/7671dab291483b2733e871abff379d07e74dfc6c/internal/pipe/sbom/sbom.go
- 2: https://goreleaser.com/customization/sbom/
- 3: https://github.com/marketplace/actions/upload-goreleaser-sboms
- 4: goreleaser/goreleaser@780a3a4
🌐 Web query:
GoReleaser sbom artifacts default name_template
💡 Result:
GoReleaser SBOM artifacts: the default SBOM document filename is When binary: {{.Binary }}{{.Version }}{{.Os }}_{{.Arch }}.sbom.json When any: [] Otherwise (e.g., archive/source installers): {{.ArtifactName }}.sbom.json [1] So there is no single “sbom artifacts default name_template” setting; instead GoReleaser uses the SBOM configuration field documents (templates allowed) whose default value depends on whether sbom is run for binaries or for other artifact types [1]. How it works in config - In sboms section, use documents to control SBOM output names/filenames; this is where name templates are applied (e.g. ${artifact}.spdx.json in docs) [1]. - The default documents value is computed as described above, depending on sbom config (binary vs any vs other) [1]. Example override You can override document templates by setting sboms[].documents in.goreleaser.yaml (templates allowed) [1]. For example, the docs show documents: ["${artifact}.spdx.json"] [1].
Citations:
Fix SBOM upload pattern to match GoReleaser's default output format.
Line 125 uses if-no-files-found: ignore, which allows releases to proceed without SBOM artifacts. Additionally, the glob pattern dist/*.sbom will not match any files—GoReleaser generates SBOMs with .sbom.json suffix by default (e.g., watchtower_1.2.3_linux_amd64.tar.gz.sbom.json), so the upload silently fails.
Suggested patch
- name: Upload Binary SBOMs
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: ${{ !inputs.DRY_RUN && inputs.BUILD_TYPE == 'stable' }}
with:
name: ${{ inputs.BUILD_TYPE }}-binary-sboms
- path: dist/*.sbom
- if-no-files-found: ignore
+ path: dist/*.sbom*
+ if-no-files-found: error📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Upload Binary SBOMs | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: ${{ !inputs.DRY_RUN && inputs.BUILD_TYPE == 'stable' }} | |
| with: | |
| name: ${{ inputs.BUILD_TYPE }}-binary-sboms | |
| path: dist/*.sbom | |
| if-no-files-found: ignore | |
| - name: Upload Binary SBOMs | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: ${{ !inputs.DRY_RUN && inputs.BUILD_TYPE == 'stable' }} | |
| with: | |
| name: ${{ inputs.BUILD_TYPE }}-binary-sboms | |
| path: dist/*.sbom* | |
| if-no-files-found: error |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yaml around lines 119 - 125, The "Upload Binary
SBOMs" upload step uses the wrong glob and silent-ignore behavior: change the
artifact path from "dist/*.sbom" to "dist/*.sbom.json" to match GoReleaser
output and remove or change "if-no-files-found: ignore" so missing SBOMs fail
the job (e.g., delete that line or set it to "error"); update the step that uses
actions/upload-artifact and relies on inputs.DRY_RUN/inputs.BUILD_TYPE
accordingly so uploads don't silently skip when SBOMs are absent.
| if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged | ||
| steps: | ||
| - name: Harden the runner (Audit all outbound calls) | ||
| - name: Harden the Runner (Step Security) | ||
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | ||
| with: | ||
| egress-policy: audit | ||
|
|
||
| - name: Cleanup | ||
| run: | | ||
| echo "Fetching list of cache key" | ||
| cacheKeysForPR=$(gh cache list --ref "$BRANCH" --limit 100 --json id --jq '.[].id') | ||
| - name: Checkout Repo | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| ## Setting this to not fail the workflow while deleting cache keys. | ||
| set +e | ||
| echo "Deleting caches..." | ||
| for cacheKey in $cacheKeysForPR | ||
| do | ||
| gh cache delete "$cacheKey" | ||
| done | ||
| echo "Done" | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GH_REPO: ${{ github.repository }} | ||
| BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge | ||
| - name: Clean Cache | ||
| uses: ./.github/actions/clean-cache | ||
| with: | ||
| gh-token: ${{ secrets.GITHUB_TOKEN }} | ||
| gh-repo: ${{ github.repository }} | ||
| branch: refs/pull/${{ github.event.pull_request.number }}/merge |
There was a problem hiding this comment.
Critical: workflow_dispatch trigger will fail due to undefined PR number.
The workflow allows manual triggering via workflow_dispatch (line 18 condition), but the branch parameter on line 35 always references github.event.pull_request.number, which is undefined when triggered manually. This will produce an invalid branch reference like refs/pull//merge, causing the cleanup action to fail.
🔧 Proposed fix: Add workflow_dispatch input or restrict the condition
Option 1 (Recommended): Add a branch input for workflow_dispatch
on:
- workflow_dispatch: {}
+ workflow_dispatch:
+ inputs:
+ branch:
+ description: 'Branch reference to clean (e.g., refs/pull/123/merge or refs/heads/feature-branch)'
+ required: true
+ type: string
pull_request:
types:
- closedThen update the branch parameter to use the input when available:
- name: Clean Cache
uses: ./.github/actions/clean-cache
with:
gh-token: ${{ secrets.GITHUB_TOKEN }}
gh-repo: ${{ github.repository }}
- branch: refs/pull/${{ github.event.pull_request.number }}/merge
+ branch: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || format('refs/pull/{0}/merge', github.event.pull_request.number) }}Option 2: Remove workflow_dispatch from the condition if manual triggering isn't needed
- if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged
+ if: github.event.pull_request.merged📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| - name: Harden the Runner (Step Security) | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | |
| with: | |
| egress-policy: audit | |
| - name: Cleanup | |
| run: | | |
| echo "Fetching list of cache key" | |
| cacheKeysForPR=$(gh cache list --ref "$BRANCH" --limit 100 --json id --jq '.[].id') | |
| - name: Checkout Repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| ## Setting this to not fail the workflow while deleting cache keys. | |
| set +e | |
| echo "Deleting caches..." | |
| for cacheKey in $cacheKeysForPR | |
| do | |
| gh cache delete "$cacheKey" | |
| done | |
| echo "Done" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge | |
| - name: Clean Cache | |
| uses: ./.github/actions/clean-cache | |
| with: | |
| gh-token: ${{ secrets.GITHUB_TOKEN }} | |
| gh-repo: ${{ github.repository }} | |
| branch: refs/pull/${{ github.event.pull_request.number }}/merge | |
| if: github.event.pull_request.merged | |
| steps: | |
| - name: Harden the Runner (Step Security) | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout Repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Clean Cache | |
| uses: ./.github/actions/clean-cache | |
| with: | |
| gh-token: ${{ secrets.GITHUB_TOKEN }} | |
| gh-repo: ${{ github.repository }} | |
| branch: refs/pull/${{ github.event.pull_request.number }}/merge |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/clean-cache.yaml around lines 18 - 35, The condition
includes workflow_dispatch but the Clean Cache step always sets branch to
refs/pull/${{ github.event.pull_request.number }}/merge which is undefined for
manual triggers; fix by making the branch parameter conditional or pluggable:
add a workflow_dispatch input (e.g., inputs.branch) and change the Clean Cache
step’s branch to use the input when present, or alter the if/condition to only
allow the step when github.event.pull_request exists (i.e., remove
workflow_dispatch or guard the branch assignment), updating the Clean Cache
usage that references gh-repo/branch accordingly.
| paths: | ||
| - cmd/** | ||
| - internal/** | ||
| - pkg/** | ||
| - go.mod | ||
| - go.sum | ||
| - main.go |
There was a problem hiding this comment.
Include lint/workflow config files in PR path filters.
Currently, a PR that changes only lint config (for example build/golangci-lint/golangci-lint.yaml) won’t run this workflow, even though Line 46 depends on it. Add those paths so CI validates config-only changes too.
Suggested patch
pull_request:
paths:
- cmd/**
- internal/**
- pkg/**
- go.mod
- go.sum
- main.go
+ - build/golangci-lint/**
+ - .github/workflows/lint-go.yaml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint-go.yaml around lines 7 - 13, The PR path filter in
.github/workflows/lint-go.yaml currently only lists source code and go.mod
files; update the paths: section to include lint and workflow configuration
files (e.g., add build/**, .github/** or the specific config directory like
build/golangci-lint/** and any top-level CI config files) so changes to
lint/workflow configs will trigger this workflow; modify the paths array in
lint-go.yaml accordingly to include those config locations.
- add ErrInvalidSynoURL for malformed SYNO_URL validation - introduce IsHTTPS field to detect secure endpoint scheme - create buildCookie helper for dynamic Secure flag based on protocol - refactor HTTP request calls to pass config context
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/lifecycle-hooks/synology-stop/synology-stop.go`:
- Around line 205-211: The URL validation in loadConfig currently allows any
non-empty scheme; update the parsedURL check to accept only "http" or "https":
after parsing config.SynoURL, verify parsedURL.Scheme is either "http" or
"https" and return ErrInvalidSynoURL otherwise, then set config.IsHTTPS =
(parsedURL.Scheme == "https"); reference parsedURL, config.SynoURL,
config.IsHTTPS and ErrInvalidSynoURL when making the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d3e063c0-79dd-4891-aab1-b822e843b4e3
📒 Files selected for processing (2)
.github/workflows/release-nightly.yamlexamples/lifecycle-hooks/synology-stop/synology-stop.go
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/release-nightly.yaml
…tion - validate URL parsing errors separately from scheme validation - normalize scheme to lowercase before http/https comparison - ensure robust handling of mixed-case URL schemes
1 participant
This PR modernizes the CI/CD pipeline by migrating GoReleaser to the
dockers_v2format, restructuring GitHub Actions workflows for better maintainability, and implementing supply-chain security best practices including Cosign signing and OSSF Scorecard analysis.Problem
Both GoReleaser and GitHub updates were resulting in builds no longer functioning. In addition, there were a number of miscellaneous issues that needed to be resolved.
Solution
dockerstodockers_v2with native multi-platform manifest support, eliminating the need for a separate manifest workflowrelease-dev.yaml→release-nightly.yamlandrelease-prod.yaml→release-stable.yamlwith clearer terminologyGITHUB_TOKENwithcreate-pull-requestaction instead of GPG keys/PATclean-cachefor cache cleanup operationsChanges
build/goreleaser/: Replacedprod.ymlwithstable.yamlusingdockers_v2formatwatchtower-manifestentrygomod.proxyconfiguration.github/workflows/:build.yaml: Restructured withBUILD_TYPEandDRY_RUNinputs, added Cosign and SBOM upload stepsrelease-stable.yaml: New production release workflow (tag-triggered)release-nightly.yaml: New nightly release workflow with change detectionupdate-changelog.yaml: Restructured to useGITHUB_TOKENwith auto-merge PRlint-go.yaml: New dedicated Go linting workflowclean-cache.yaml: Refactored to use composite actionscorecard.yml: New OSSF Scorecard supply-chain security analysissecurity.yaml: Added daily scheduled scans, SARIF categories, updated action versionstest.yaml: Added direct triggers, updated to windows-2025, improved test commandpublish-docs.yaml: Updated dependencies, fixed cache key, removed deprecated mike deletecreate-manifests.yaml,release-prod.yaml,release-dev.yaml,pull-request.yaml,lint.yaml.github/actions/clean-cache/: New composite action for cache cleanup.github/renovate.json: Enabled vulnerability alerts.github/dependabot.yml: Removed (consolidated into renovate).editorconfig: Updated formatting rules (toml indent size 2, space-based indentation)Summary by CodeRabbit
New Features
Bug Fixes
Chores