Run deployment verification on pull requests#8
Merged
Merged
Conversation
Review Summary by QodoRun deployment verification on pull requests
WalkthroughsDescription• Run deployment verification on pull requests • Move concurrency settings to deploy job only • Prevent deployment on pull request events • Verification runs on both PR and push events Diagramflowchart LR
A["Workflow Trigger"] -->|pull_request| B["Verify Job"]
A -->|push| B
A -->|workflow_dispatch| B
B -->|Success| C["Deploy Job"]
C -->|Conditional| D["Deploy on push/dispatch only"]
E["Concurrency Control"] -->|Moved to| C
File Changes1. .github/workflows/deploy-lightsail.yml
|
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe deploy workflow now accepts pull_request events to trigger verification steps, but gates actual deployment to run only on push or manual workflow_dispatch events. This allows pull request checks without automating deployments from PRs. ChangesWorkflow Trigger and Deployment Gating
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
Code Review by Qodo
1. Deploys unverified main HEAD
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+52
to
+56
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | ||
| environment: production | ||
| concurrency: | ||
| group: lightsail-production | ||
| cancel-in-progress: false |
There was a problem hiding this comment.
1. Deploys unverified main head 🐞 Bug ≡ Correctness
The deploy SSH script resets the server to origin/main rather than deploying the workflow’s triggering commit SHA, so queued/overlapping runs can deploy a different (later) commit than the one verified. This breaks the verify→deploy guarantee and can ship untested code to production.
Agent Prompt
### Issue description
The deploy step deploys `origin/main` (current HEAD) instead of the commit that the workflow verified, so production can receive code that was never linted/tested/built by that run.
### Issue Context
The `deploy` job is serialized via `concurrency`, which means it can run after additional commits land on `main`. The remote script currently does `git reset --hard origin/main`, which deploys the latest main at execution time.
### Fix Focus Areas
- .github/workflows/deploy-lightsail.yml[48-76]
### Suggested fix
- Pass the triggering SHA into the deploy script (e.g., env `COMMIT_SHA: ${{ github.sha }}`), and on the server:
- `git fetch origin $COMMIT_SHA`
- `git reset --hard $COMMIT_SHA`
- Optionally, also consider `cancel-in-progress: true` for the deploy concurrency group if the desired behavior is to only deploy the latest push.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Chores