feat: add reusable Go CI workflows and composite actions - #1
feat: add reusable Go CI workflows and composite actions#1sofiasimdianova wants to merge 3 commits into
Conversation
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (5)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Free Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
🛑 Changes requested — automated reviewThis PR introduces reusable Go CI workflows and composite actions but has several functional issues that must be resolved before it is safe to merge for external consumers. The most critical problem is the relative Four major issues also need attention: (1) The |
NumaryBot
left a comment
NumaryBot
left a comment
There was a problem hiding this comment.
NumaryBot posted 2 new inline findings.
Summary: #1 (comment)
NumaryBot
left a comment
NumaryBot
left a comment
There was a problem hiding this comment.
NumaryBot posted 5 new inline findings.
Summary: #1 (comment)
NumaryBot
left a comment
NumaryBot
left a comment
There was a problem hiding this comment.
NumaryBot posted 5 new inline findings.
Summary: #1 (comment)
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Setup Nix and Go caching |
There was a problem hiding this comment.
🔴 [blocker] Relative ./actions/setup-nix path breaks remote consumers
When setup-release is invoked as a remote action (e.g. formancehq/ci/actions/setup-release@main), the relative uses: ./actions/setup-nix is resolved against the caller's checked-out repository, not this action's directory. Any consumer that does not have an actions/setup-nix in their own repo will fail immediately.
Suggestion: Replace uses: ./actions/setup-nix with the fully-qualified remote reference, e.g. uses: formancehq/ci/actions/setup-nix@main, so it resolves correctly regardless of the caller's repository layout.
| GoReleaser: | ||
| name: GoReleaser | ||
| runs-on: ${{ inputs.runner-profile }} | ||
| if: >- |
There was a problem hiding this comment.
🟠 [major] Trailing || (...) clause overrides the build-condition input
The final || (github.ref == 'refs/heads/main' || ...) branch in the job condition makes the job unconditionally run on main, merge_group, or a labeled PR regardless of the build-condition value passed by callers. Setting build-condition: label-only still runs on every main/merge_group push, and main-only still runs on labeled PRs, making the input useless for restricting build mode.
Suggestion: Remove or integrate the unconditional fallback clause so that each branch of the condition is gated behind its corresponding build-condition value, e.g. using nested ternaries or a dedicated expression that respects the selected mode in all paths.
| --command just ${{ inputs.build-target }} | ||
| ${{ inputs.goreleaser-parallelism > 0 && format('--parallelism={0}', inputs.goreleaser-parallelism) || '' }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }} |
There was a problem hiding this comment.
🟠 [major] Reusable workflow does not declare consumed secrets
reported by NumaryBot, codex
The workflow references secrets such as NUMARY_GITHUB_TOKEN, SPEAKEASY_API_KEY, FURY_TOKEN, and GORELEASER_KEY but has no on.workflow_call.secrets block. Callers that do not use secrets: inherit and instead pass secrets explicitly will have those calls rejected or receive empty secret values at runtime. The same issue applies to other reusable workflows in this PR that consume secrets.*.
Suggestion: Add a secrets: block under on.workflow_call declaring each secret the workflow consumes (with required: false where appropriate), and mirror the same pattern in the other reusable workflows.
| if: inputs.enable-pr-check && github.event_name == 'pull_request' | ||
| name: PR | ||
| runs-on: ubuntu-latest | ||
| permissions: |
There was a problem hiding this comment.
🟠 [major] Missing pull-requests: read permission for PR title check
With explicit job-level permissions set, all unspecified scopes default to none. In repositories with restricted token permissions, amannn/action-semantic-pull-request cannot read pull request metadata without pull-requests: read, causing the title validation job to fail before it ever inspects the PR title.
Suggestion: Add pull-requests: read to the job's permissions block alongside any existing permissions such as statuses: write.
| - name: Extract Go environment | ||
| id: go-env | ||
| shell: bash | ||
| run: | |
There was a problem hiding this comment.
🟠 [major] Cache-priming nix develop step ignores nix-extra-flags
reported by NumaryBot, codex
The setup step runs a bare nix develop (with a hardcoded --impure) to seed the cache without applying the same extra flags passed via the nix-extra-flags input. Repositories whose dev shell requires those flags will fail during cache setup, before any build or test step runs.
Suggestion: Thread the nix-extra-flags input (and any hardcoded flags like --impure) into the cache-priming nix develop invocation so it uses the same flags as the actual build/test commands.
2 participants
No description provided.