edited preview files - #3571
Conversation
📝 WalkthroughWalkthroughThese GitHub Actions workflows for Azure Container App previews are refactored to standardize branch-name sanitization, replace string-based environment variable passing with bash arrays, and consolidate cleanup logic from multiple conditional jobs into a single removal job. ChangesAzure Preview Deployment Workflows
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related PRs
Suggested Labels
Suggested Reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
.github/workflows/deploy-frontend-azurepreview.yml (1)
1-14:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd least-privilege
permissions:forpull_request_targetThis workflow has no top-level
permissions:block, soGITHUB_TOKENrelies on repo/Actions defaults instead of being explicitly scoped forpull_request_target.Suggested change
+permissions: + contents: read + issues: write + env: RG: airqo-main-rg LOCATION: westeurope PR_PREVIEW_ENV: airqo-pr-preview-env REGISTRY_URL: airqoacr.azurecr.io KEYVAULT: airqo-kv-staging🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-frontend-azurepreview.yml around lines 1 - 14, The workflow declared by name deploy-to-azure-preview-environment triggers on pull_request_target and currently omits a top-level permissions block, so GITHUB_TOKEN inherits default repo-level rights; add an explicit top-level permissions: block scoped minimally for the actions used (for example setting contents: write only if the job needs to write checks or packages, and id-token: write only if OIDC is used, otherwise set write to none and set pull-request, checks, contents, or id-token to read/write as strictly required) to ensure least-privilege for GITHUB_TOKEN when running the pull_request_target event; place this permissions: block at the top level of the workflow (alongside name and on) and reference the pull_request_target-triggered jobs that need those scopes to choose exact permission keys..github/workflows/remove-deploy-azurepreview.yml (2)
15-32:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFix the duplicated branch-name sanitization in
remove-deploy-azurepreview.yml
remove-deploy-azurepreview.ymluses the sameRAW:0:12truncation asdeploy-frontend-azurepreview.yml, and then deletes apps named${BRANCH}-calibrate-app-preview(and others). With the Azure Container App name limit of 32 chars,12 + "-calibrate-app-preview"(22) = 34, so cleanup can compute names that don’t match what Azure accepts/deployed.- The current “sanitizer” only truncates and strips trailing hyphens; it doesn’t enforce Azure Container App naming rules (lowercase letters/numbers/hyphens, no consecutive hyphens, start with a letter, end with alphanumeric).
Apply the same updated sanitizer/truncation logic used in the deploy workflow to this remove workflow so preview deletions target the correct app names.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/remove-deploy-azurepreview.yml around lines 15 - 32, The branch-name sanitization in the remove workflow (job name "branch-name", step "string" using ASzc/change-string-case-action@v5 and the "sanitize" step that sets env RAW and uses CLEAN=$(printf '%s' "${RAW:0:12}" | sed 's/-*$//')) must be replaced with the same sanitizer/truncation logic used in the deploy workflow: compute the branch-segment length as 32 minus the preview suffix length, enforce allowed characters (lowercase letters, digits, hyphens), collapse consecutive hyphens, strip leading non-letters and trailing non-alphanumerics, and trim to the computed length before emitting sanitized via $GITHUB_OUTPUT; update the "sanitize" step to mirror the deploy workflow's implementation so the generated branch names match Azure Container App naming rules and the deployed app names used during cleanup.
1-12:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDrop
GITHUB_TOKENpermissions entirely in this cleanup workflow (permissions: {})This workflow doesn’t call the GitHub API (no checkout/github-script/gh/curl). It authenticates to Azure via
azure/login@v2usingcreds: ${{ secrets.AZURE_CREDENTIALS }}(secret-based auth), so no GitHub OIDC token permissions are needed.Suggested change
+permissions: {} + env: RG: airqo-main-rg🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/remove-deploy-azurepreview.yml around lines 1 - 12, The workflow "name: remove-deploy-previews" currently doesn't need GitHub API tokens; update the workflow to drop GITHUB_TOKEN permissions by adding a top-level permissions: {} stanza (i.e., an empty permissions map) to the workflow root, ensuring no default token scopes are granted; leave the existing azure/login@v2 usage (creds: ${{ secrets.AZURE_CREDENTIALS }}) and env RG intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-frontend-azurepreview.yml:
- Around line 27-30: Replace the mutable tag usage of the action
ASzc/change-string-case-action@v5 with a pinned full commit SHA: locate the step
using "uses: ASzc/change-string-case-action@v5" and update it to the action's
exact commit SHA (e.g., ASzc/change-string-case-action@<full-commit-sha>) so the
workflow is immutable; fetch the canonical commit SHA from the action's GitHub
repository and substitute it in place of `@v5`.
---
Outside diff comments:
In @.github/workflows/deploy-frontend-azurepreview.yml:
- Around line 1-14: The workflow declared by name
deploy-to-azure-preview-environment triggers on pull_request_target and
currently omits a top-level permissions block, so GITHUB_TOKEN inherits default
repo-level rights; add an explicit top-level permissions: block scoped minimally
for the actions used (for example setting contents: write only if the job needs
to write checks or packages, and id-token: write only if OIDC is used, otherwise
set write to none and set pull-request, checks, contents, or id-token to
read/write as strictly required) to ensure least-privilege for GITHUB_TOKEN when
running the pull_request_target event; place this permissions: block at the top
level of the workflow (alongside name and on) and reference the
pull_request_target-triggered jobs that need those scopes to choose exact
permission keys.
In @.github/workflows/remove-deploy-azurepreview.yml:
- Around line 15-32: The branch-name sanitization in the remove workflow (job
name "branch-name", step "string" using ASzc/change-string-case-action@v5 and
the "sanitize" step that sets env RAW and uses CLEAN=$(printf '%s' "${RAW:0:12}"
| sed 's/-*$//')) must be replaced with the same sanitizer/truncation logic used
in the deploy workflow: compute the branch-segment length as 32 minus the
preview suffix length, enforce allowed characters (lowercase letters, digits,
hyphens), collapse consecutive hyphens, strip leading non-letters and trailing
non-alphanumerics, and trim to the computed length before emitting sanitized via
$GITHUB_OUTPUT; update the "sanitize" step to mirror the deploy workflow's
implementation so the generated branch names match Azure Container App naming
rules and the deployed app names used during cleanup.
- Around line 1-12: The workflow "name: remove-deploy-previews" currently
doesn't need GitHub API tokens; update the workflow to drop GITHUB_TOKEN
permissions by adding a top-level permissions: {} stanza (i.e., an empty
permissions map) to the workflow root, ensuring no default token scopes are
granted; leave the existing azure/login@v2 usage (creds: ${{
secrets.AZURE_CREDENTIALS }}) and env RG intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: fb17c242-3132-4c32-9032-801322a0cf16
📒 Files selected for processing (2)
.github/workflows/deploy-frontend-azurepreview.yml.github/workflows/remove-deploy-azurepreview.yml
| - id: string | ||
| uses: ASzc/change-string-case-action@v5 | ||
| with: | ||
| string: ${{ github.head_ref || github.ref_name }} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow around the referenced lines
FILE=".github/workflows/deploy-frontend-azurepreview.yml"
echo "=== File: $FILE ==="
nl -ba "$FILE" | sed -n '1,120p'Repository: airqo-platform/AirQo-frontend
Length of output: 199
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/deploy-frontend-azurepreview.yml"
echo "=== File: $FILE ==="
# Print with line numbers (nl not available)
awk '{printf "%5d\t%s\n", NR, $0}' "$FILE" | sed -n '1,120p'
echo "=== Matches for ASzc/change-string-case-action ==="
rg -n "ASzc/change-string-case-action@v" "$FILE" || trueRepository: airqo-platform/AirQo-frontend
Length of output: 4877
🌐 Web query:
GitHub Actions security secure use pin reusable actions to full commit SHA documentation
💡 Result:
Pinning GitHub Actions to a full-length commit SHA is considered the most secure way to consume an action as an immutable release [1][2]. Unlike version tags (e.g., @v1), which are mutable and can be moved or deleted by an actor who gains access to the action's repository, a full-length commit SHA uniquely identifies the exact code being executed, mitigating the risk of unauthorized malicious changes [1][3][4]. Key Security Considerations and Implementation: 1. Mandatory Pinning: GitHub documentation and security best practices emphasize that pinning to a full-length commit SHA is the only way to ensure immutability [1][2]. When using a SHA, you should verify it originates from the action's official repository rather than a fork, as GitHub resolves the SHA to a valid Git object regardless of the source repository [1][5]. 2. Enforcing Policies: Administrators can enforce SHA pinning at the organization or repository level through GitHub Actions policies [1][6][3]. When enabled, any workflow attempting to use an action not pinned to a full commit SHA will fail [6][3]. 3. Automating Maintenance: Manually updating SHAs is inefficient. Tools such as Dependabot, pinact, or other automation workflows are recommended to manage dependencies and keep pinned actions updated [1][3][4]. 4. Limitation with Reusable Workflows: While GitHub's native SHA-pinning enforcement applies primarily to actions, it is widely recommended to apply similar rigor to reusable workflows where possible [3]. Note that some tooling for SHA pinning may focus specifically on Actions [3]. 5. Additional Defenses: Pinning should be part of a broader security strategy, including: - Setting permissions: {} at the workflow level to follow the principle of least privilege [5][4]. - Auditing the source code of third-party actions [2]. - Using security tools like Scorecards or Zizmor to identify unpinned dependencies or risky supply chain practices [2][5][4]. For official configuration guidance, refer to the GitHub documentation on securing your workflows and the settings for managing allowed actions and reusable workflows [1][6].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md
- 3: https://mikael.barbero.tech/blog/post/2026-03-24-stop-trusting-mutable-references/
- 4: https://www.cncf.io/blog/2026/05/04/securing-github-actions-ci-dependencies-recipe-card/
- 5: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 6: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
Pin ASzc/change-string-case-action to a full commit SHA (not @v5).
.github/workflows/deploy-frontend-azurepreview.yml (lines 27–30) uses ASzc/change-string-case-action@v5, which is mutable at the tag level; pinning to the action’s full commit SHA prevents upstream changes from altering what this privileged workflow runs. See: https://docs.github.com/en/actions/reference/security/secure-use
🧰 Tools
🪛 zizmor (1.25.2)
[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-frontend-azurepreview.yml around lines 27 - 30,
Replace the mutable tag usage of the action ASzc/change-string-case-action@v5
with a pinned full commit SHA: locate the step using "uses:
ASzc/change-string-case-action@v5" and update it to the action's exact commit
SHA (e.g., ASzc/change-string-case-action@<full-commit-sha>) so the workflow is
immutable; fetch the canonical commit SHA from the action's GitHub repository
and substitute it in place of `@v5`.
2 participants
Summary of Changes (What does this PR do?)
Status of maturity (all need to be checked before merging):
How should this be manually tested?
What are the relevant tickets?
Screenshots (optional)
Summary by CodeRabbit