Expose Workbench functional smoke workflow on default branch - #375
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (9)
🔇 Additional comments (1)
📝 WalkthroughWalkthroughAdds ChangesWorkbench Functional Smoke Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/workbench-functional-smoke.yml:
- Around line 146-151: The issue is that GitHub Actions expressions using ${{ }}
syntax are being directly interpolated inside the shell script body (in the echo
commands), which creates a potential command injection vulnerability if values
contain shell metacharacters. To fix this, move the dynamic values from
inputs.ref and steps.commit.outputs.sha outside of the shell script expansion.
Instead, define these values as environment variables using the env: section
before the run: block, and then reference those environment variables using
standard shell variable syntax (like $VARIABLE_NAME) within the echo commands.
Apply this same approach to both occurrences mentioned in the comment.
- Around line 41-44: The Checkout action in the workbench-functional-smoke
workflow is persisting git credentials by default, creating an unnecessary
security exposure since this workflow never performs git push operations. Add
the persist-credentials parameter set to false in the with section of the
actions/checkout@v6 action to disable credential persistence.
- Line 42: In the workbench-functional-smoke.yml workflow file, all action
references that currently use version tags (such as `@v6`) need to be replaced
with their corresponding full commit SHAs for supply-chain integrity. For each
uses statement that references an action with a version tag (including
actions/checkout and any other actions in the workflow), resolve the full commit
SHA from that action's official repository and update the reference format from
action-name@vX to action-name@full-commit-sha. This applies to all affected
action references throughout the workflow file to ensure immutable pinning of
all external actions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 854f8a31-41fb-4290-a8ed-69c07128a7e7
📒 Files selected for processing (1)
.github/workflows/workbench-functional-smoke.yml
📜 Review details
🧰 Additional context used
🪛 zizmor (1.25.2)
.github/workflows/workbench-functional-smoke.yml
[warning] 41-44: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 149-149: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 150-150: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 169-169: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 170-170: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 42-42: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 56-56: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 61-61: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 66-66: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 71-71: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 83-83: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 175-175: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/workbench-functional-smoke.yml:
- Around line 63-67: The Setup bun step in the workbench-functional-smoke.yml
workflow uses a floating version parameter (bun-version: latest) which causes
non-deterministic builds despite the action itself being SHA-pinned. Replace the
latest version value with a specific Bun version number to ensure reproducible
builds and avoid unexpected breakage from upstream Bun releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5e0b217b-19cc-44fa-bcf8-e113039f7333
📒 Files selected for processing (1)
.github/workflows/workbench-functional-smoke.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (6)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Build Test (windows-x64)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Build Test (macos-x64)
- GitHub Check: Unit Tests (windows-2022)
- GitHub Check: Build Test (linux)
🔇 Additional comments (1)
.github/workflows/workbench-functional-smoke.yml (1)
28-32: LGTM!Also applies to: 42-45, 121-123, 154-158, 175-178, 185-191
1 participant
Summary
mainso GitHub exposesworkflow_dispatchevaos/beta-rc-20260612.appproof lane usable without running public Build and ReleaseWhy
PR #373 added the workflow to
evaos/beta-rc-20260612, but GitHub only lists manual workflows from the default branch. This PR exposes the dispatcher while preserving release-branch checkout through therefinput.Validation
YAML.load_fileFixes #372.
Summary by CodeRabbit
Release Notes