ci(preview): publish installable PR builds - #125
Conversation
📝 WalkthroughWalkthroughAdds an automated pull-request preview pipeline that builds installable plugin packages, publishes them at stable per-PR paths, removes them when pull requests close, and documents installation and preview behavior. ChangesPull-request preview lifecycle
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant BuildCAPRPreview
participant buildprpreview
participant PublishCAPRPreview
participant prpreviews
PullRequest->>BuildCAPRPreview: opened, synchronized, or reopened
BuildCAPRPreview->>buildprpreview: build package with PR number and head SHA
buildprpreview-->>BuildCAPRPreview: preview artifact and preview.json
BuildCAPRPreview->>PublishCAPRPreview: successful workflow completion
PublishCAPRPreview->>prpreviews: validate SHA and replace pr/PR_NUMBER contents
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
scripts/build-pr-preview.sh (1)
53-78: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSpecify UTF-8 encoding for file operations.
While this script primarily runs in GitHub Actions where UTF-8 is the default, relying on the system's locale encoding can cause decoding errors on different platforms (such as Windows). It is a good defensive practice to explicitly declare the encoding.
💡 Proposed refactor
-text = Path(source).read_text() +text = Path(source).read_text(encoding="utf-8") replacements = { "version": version, "md5": md5, "pluginURL": plugin_url, } for entity, value in replacements.items(): text, count = re.subn( rf'(<!ENTITY\s+{entity}\s+")[^"]*(">)', rf'\g<1>{value}\g<2>', text, count=1, ) if count != 1: raise SystemExit(f"could not replace {entity} entity") text, count = re.subn( r'(<FILE Name="/boot/config/plugins/&name;/&name;-&version;-x86_64-1\.txz" Run="upgradepkg --install-new --reinstall">\s*<URL>)[^<]*(</URL>)', rf'\g<1>{package_url}\g<2>', text, count=1, ) if count != 1: raise SystemExit("could not replace package URL") -Path(destination).write_text(text) +Path(destination).write_text(text, encoding="utf-8")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/build-pr-preview.sh` around lines 53 - 78, Specify UTF-8 encoding for both Path.read_text and Path.write_text in the replacement flow, preserving the existing text substitutions and error handling..github/workflows/pr-preview-build.yml (1)
14-14: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueDisable credential persistence in checkout.
Because this job only reads code and builds an artifact without pushing changes back to the repository, you can set
persist-credentials: false. This aligns with the principle of least privilege and prevents theGITHUB_TOKENfrom remaining in the local.git/configfile.💡 Proposed refactor
- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-preview-build.yml at line 14, Update the actions/checkout@v4 step in the workflow to disable credential persistence by setting persist-credentials to false.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-preview-cleanup.yml:
- Around line 28-29: Update the cleanup workflow’s git commit step after staging
pr/$PR_NUMBER to check for staged differences before committing, such as with a
quiet git diff --cached guard. Exit successfully when no changes are present,
while retaining the existing commit behavior when changes are staged.
In @.github/workflows/pr-preview-publish.yml:
- Around line 31-47: Update the publish step around the PR_NUMBER validation to
add a gh pr view check using the workflow’s repository context, and exit without
publishing when the PR is no longer open; also add pull-requests: read to the
workflow permissions. Replace the wildcard cp artifact/* command with cp -a
artifact/. while preserving the existing destination and commit flow.
---
Nitpick comments:
In @.github/workflows/pr-preview-build.yml:
- Line 14: Update the actions/checkout@v4 step in the workflow to disable
credential persistence by setting persist-credentials to false.
In `@scripts/build-pr-preview.sh`:
- Around line 53-78: Specify UTF-8 encoding for both Path.read_text and
Path.write_text in the replacement flow, preserving the existing text
substitutions and error handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b1e61102-a699-4469-b31a-934f7acfd1d2
📒 Files selected for processing (6)
.github/workflows/pr-preview-build.yml.github/workflows/pr-preview-cleanup.yml.github/workflows/pr-preview-publish.ymldocs/PR_PREVIEWS.mdplugins/CHANGES.mdscripts/build-pr-preview.sh
|
Applied the UTF-8 file-I/O nitpick from the CodeRabbit review body. The preview builder now explicitly reads and writes the generated manifest as UTF-8. |
|
Applied the checkout-hardening nitpick from the CodeRabbit review body. The read-only PR build now sets |
1 participant
Outcome
Adds the PR-preview infrastructure as an independent, implementation-only change so it can land before the CA UI fixes. Once merged, every opened or updated pull request can publish an installable Community Applications plugin at a stable per-PR URL and surface that URL in the pull request.
Workflows
pr-previews/pr/<PR>/, and creates or updates one bot comment containing the installer URL.The comment uses a hidden marker so later builds update the existing comment rather than creating duplicates.
Build script
scripts/build-pr-preview.shbuilds root-owned GNU/BSD-tar-compatible packages and generates the.plgmanifest. Published installers use:https://raw.githubusercontent.com/unraid/community.applications/pr-previews/pr/<PR>/community.applications.plgVerification
actionlint .github/workflows/*.ymlshellcheck scripts/build-pr-preview.shbash -n scripts/build-pr-preview.sh