ci: repair invalid workflow syntax#339
Conversation
Remove duplicate with blocks, fix invalid job status expressions, normalize the frontend coverage heredoc, and move the Pulumi secret check to step-level env so workflow parsing succeeds. Co-authored-by: Codex <noreply@openai.com>
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
KooshaPari
added
the
layered-pr-exception
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 55 minutes and 56 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
Note
|
| Cohort / File(s) | Summary |
|---|---|
Setup Action YAML Fixes .github/workflows/contracts.yml, .github/workflows/test-validation.yml |
Remove invalid/duplicated with: keys from setup-python and setup-node steps while preserving intended configuration parameters. |
Frontend Coverage & Security Gating .github/workflows/ci.yml |
Refactor frontend coverage extraction script for improved clarity; migrate secret-based gating logic from job-level to step-level if: conditions using env.PULUMI_ACCESS_TOKEN. |
Validation Report Status References .github/workflows/test-validation.yml |
Update consolidated validation report table to reference job results via needs.<suite>.result instead of job.<suite>.status for accuracy across four test suites. |
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐰 Workflows now hop with cleaner ways,
Duplicate keys removed from the maze,
Secrets secured at step-level height,
Status references pointing so right,
CI/CD pipelines running just right! ✨
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title 'ci: repair invalid workflow syntax' directly and clearly summarizes the main change—fixing workflow YAML syntax issues across multiple CI files. |
| Description check | ✅ Passed | The description covers the key changes, validation approach, and includes risk assessment; however, it lacks the formal template structure with defined sections like Testing checklist and Related Issues. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
fix/main-workflow-syntax
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
codeant-ai
Bot
added
the
size:M
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Add path filters so the legacy comprehensive validation, contracts, and broad CI workflows do not execute for workflow-only syntax fixes while preserving their source-code triggers. Co-authored-by: Codex <noreply@openai.com>
|
CodeAnt AI finished reviewing your PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/test-validation.yml (1)
193-222:⚠️ Potential issue | 🟡 MinorQuoted heredoc prevents
$(date ...)from expanding.
cat > VALIDATION_REPORT.md << 'EOF'uses a quoted terminator, so shell command substitution is disabled and line 196 will be written to the report literally as$(date -u +'%Y-%m-%dT%H:%M:%SZ'). GitHub Actions${{ … }}expressions are substituted before the shell runs, so those still work, but the timestamp won't. Pre-compute the date before the heredoc (or switch to unquotedEOFand escape the$s you want literal).🐛 Proposed fix
- name: Generate consolidated report run: | + TIMESTAMP="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" cat > VALIDATION_REPORT.md << 'EOF' # Comprehensive Test Validation Report - - **Timestamp**: $(date -u +'%Y-%m-%dT%H:%M:%SZ') + - **Timestamp**: __TIMESTAMP__ - **Commit**: ${{ github.sha }} - **Branch**: ${{ github.ref_name }} @@ EOF + sed -i "s|__TIMESTAMP__|${TIMESTAMP}|" VALIDATION_REPORT.mdOr simpler: drop the quotes on the terminator (
<< EOF) — the${{ … }}expressions are resolved by GHA before the shell sees the script, so they will still be substituted; just ensure nothing else inside relies on literal$.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/test-validation.yml around lines 193 - 222, The heredoc uses a quoted terminator so command substitution is disabled: change the heredoc invocation that writes to VALIDATION_REPORT.md (currently using `cat > VALIDATION_REPORT.md << 'EOF'`) so the timestamp command expands — either remove the single quotes and use an unquoted terminator (`<< EOF`) or precompute the timestamp into a shell variable (e.g., TIMESTAMP="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" before the heredoc) and reference that variable inside the heredoc; update the heredoc block that contains `$(date -u +'%Y-%m-%dT%H:%M:%SZ')` accordingly so the final file contains a real timestamp.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 1417-1433: The step-level env that re-exports PULUMI_ACCESS_TOKEN
is redundant because the job-level env already exposes it; remove the inner env
block from the "Pulumi up (dev)" step (the step using pulumi/actions@v5) while
keeping the existing step-level if: env.PULUMI_ACCESS_TOKEN != '' gating intact
so the step still only runs when the token is present.
---
Outside diff comments:
In @.github/workflows/test-validation.yml:
- Around line 193-222: The heredoc uses a quoted terminator so command
substitution is disabled: change the heredoc invocation that writes to
VALIDATION_REPORT.md (currently using `cat > VALIDATION_REPORT.md << 'EOF'`) so
the timestamp command expands — either remove the single quotes and use an
unquoted terminator (`<< EOF`) or precompute the timestamp into a shell variable
(e.g., TIMESTAMP="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" before the heredoc) and
reference that variable inside the heredoc; update the heredoc block that
contains `$(date -u +'%Y-%m-%dT%H:%M:%SZ')` accordingly so the final file
contains a real timestamp.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d33ef12c-7c4f-4005-bee1-f82754a53dec
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/contracts.yml.github/workflows/test-validation.yml
💤 Files with no reviewable changes (1)
- .github/workflows/contracts.yml
| env: | ||
| PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Pulumi Node.js dependencies | ||
| if: env.PULUMI_ACCESS_TOKEN != '' | ||
| working-directory: infra | ||
| run: bun install | ||
|
|
||
| - name: Pulumi up (dev) | ||
| if: env.PULUMI_ACCESS_TOKEN != '' | ||
| uses: pulumi/actions@v5 | ||
| env: | ||
| PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} | ||
| PULUMI_ACCESS_TOKEN: ${{ env.PULUMI_ACCESS_TOKEN }} |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Redundant step-level env for PULUMI_ACCESS_TOKEN.
Since PULUMI_ACCESS_TOKEN is already exposed at the job level (lines 1417-1418), steps inherit it automatically. The inner env: on the Pulumi step that re-exports ${{ env.PULUMI_ACCESS_TOKEN }} is redundant and can be removed to reduce surface area. The step-level if: env.PULUMI_ACCESS_TOKEN != '' gating itself is fine (the env context is available in step-level if).
♻️ Proposed simplification
- name: Pulumi up (dev)
if: env.PULUMI_ACCESS_TOKEN != ''
uses: pulumi/actions@v5
- env:
- PULUMI_ACCESS_TOKEN: ${{ env.PULUMI_ACCESS_TOKEN }}
with:
command: up
stack-name: dev
work-dir: infra
comment-on-pr: false🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ci.yml around lines 1417 - 1433, The step-level env that
re-exports PULUMI_ACCESS_TOKEN is redundant because the job-level env already
exposes it; remove the inner env block from the "Pulumi up (dev)" step (the step
using pulumi/actions@v5) while keeping the existing step-level if:
env.PULUMI_ACCESS_TOKEN != '' gating intact so the step still only runs when the
token is present.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge OverviewThis PR fixes GitHub Actions workflow syntax and correctness issues across three workflow files:
Key Changes
Observations
Test Validation
Files Reviewed (3 files)
Reviewed by ling-2.6-1t-20260423:free · 1,680,505 tokens |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:L
|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:L
|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:L
|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
CodeAnt AI is running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
removed
the
size:L
codeant-ai
Bot
added
the
size:L
|
CodeAnt AI finished running the review. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
2 participants
User description
Summary\n- Remove duplicate with blocks in workflow steps\n- Replace invalid job status expressions with needs results\n- Fix frontend coverage heredoc parsing\n- Move Pulumi secret check out of job-level if\n\n## Validation\n- ruby YAML load for affected workflows\n- actionlint fatal workflow validation with shellcheck/deprecated-action style warnings ignored\n- git diff --check\n\nCo-authored-by: Codex noreply@openai.com
Note
Medium Risk
Medium risk because it changes GitHub Actions trigger path filters and step/job conditionals (including Pulumi deploy gating), which could inadvertently skip or run CI/CD jobs unexpectedly.
Overview
Fixes multiple GitHub Actions workflow syntax/logic issues and reduces unnecessary runs by adding
pathsfilters to theCI/CD Pipeline,Contracts & SDKs, andComprehensive Test Validationworkflows.Repairs CI reporting/execution correctness by fixing the frontend coverage heredoc script output, updating the validation report to use
needs.<job>.resultfor suite statuses, and adjusting the Pulumiiac-devjob to always start but skip only the Pulumi steps whenPULUMI_ACCESS_TOKENis not set.Reviewed by Cursor Bugbot for commit d7d6884. Bugbot is set up for automated code reviews on this repo. Configure here.
CodeAnt-AI Description
Fix workflow parsing and avoid unnecessary CI runs
What Changed
Impact
✅ Fewer broken CI runs✅ Clearer test validation results✅ Reliable frontend coverage reports🔄 Retrigger CodeAnt AI Review
Details
💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.