feat(release): add alpha releases from pull request branches - #626
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughAdds a manually triggered GitHub Actions workflow that creates worker alpha releases from non- ChangesWorker alpha release
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant AlphaRelease
participant Git
participant GitHub
Operator->>AlphaRelease: Select source ref, worker, and bump
AlphaRelease->>Git: Checkout and reject main
AlphaRelease->>Git: Calculate version and update manifest
AlphaRelease->>Git: Commit changes and create annotated tag
AlphaRelease->>GitHub: Push only the alpha tag
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
guibeira
added
the
no-ticket
skill-check — worker0 verified, 49 skipped (no docs/).
Four for four. Nicely done. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/alpha-release.yml:
- Around line 97-101: Update the Checkout source ref step to disable persisted
credentials, then explicitly fetch the trusted release tooling and _lib.py from
main before invoking manifest_version.py. Ensure release operations use those
main-sourced scripts rather than files from inputs.source_ref, and configure a
narrowly scoped push token only for the explicit git push of the release tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8fe745ca-5f7f-47cc-b842-dc9852363cf9
📒 Files selected for processing (2)
.github/workflows/alpha-release.ymldocs/sops/release.md
| - name: Checkout source ref | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| fetch-depth: 0 | ||
| ref: ${{ inputs.source_ref }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate workflow files =="
fd -a 'alpha-release\.yml$|.*release.*\.ya?ml$|.*workflow.*\.ya?ml$' .github/workflows | sed 's#^\./##'
echo "== relevant workflow excerpt =="
if [ -f .github/workflows/alpha-release.yml ]; then
nl -ba .github/workflows/alpha-release.yml | sed -n '1,240p'
fi
echo "== search manifest_version.py and _lib.py =="
git ls-files | grep -E '(^|/)manifest_version\.py$|(^|/)_lib\.py$|\.github/scripts/' | sed -n '1,200p'Repository: iii-hq/workers
Length of output: 416
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== alpha-release.yml excerpt with line numbers =="
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/alpha-release.yml')
for i, line in enumerate(p.read_text().splitlines(), 1):
if 1 <= i <= 250:
print(f"{i:4d}\t{line}")
PY
echo "== manifest_version.py candidates =="
git ls-files | grep -E '(^|/)manifest_version\.py$|(^|/)_lib\.py$|(^|/)\.github/scripts/[^/]+$' || true
echo "== all manifest_version.py locations =="
python3 - <<'PY'
from pathlib import Path
import subprocess
files = subprocess.check_output(['git', 'ls-files'], text=True).splitlines()
for f in files:
if f.endswith('manifest_version.py') or f.endswith('_lib.py'):
print(f)
PYRepository: iii-hq/workers
Length of output: 7929
🌐 Web query:
actions/checkout persist-credentials default true README
💡 Result:
The persist-credentials input for the actions/checkout GitHub Action determines whether the authentication token or SSH key used for the checkout is configured in the local git configuration [1][2]. By default, persist-credentials is set to true [1][2]. When enabled, this allows subsequent steps in the same job to execute authenticated git commands using those credentials [3][4]. The action removes these credentials from the local git configuration during the post-job cleanup phase [3][5]. If you wish to prevent these credentials from being stored in the local git configuration, you can set persist-credentials to false [3][6]. This is often recommended for security purposes to ensure that subsequent steps in a workflow cannot access the repository token if they do not require it [7].
Citations:
- 1: https://github.com/actions/checkout/blob/de0fac2e4500dabe0009e67214ff5f5447ce83dd/action.yml
- 2: https://github.com/actions/checkout/blob/main/action.yml
- 3: https://github.com/actions/checkout?tab=readme-ov-file
- 4: https://github.com/actions/checkout/blob/main/README.md
- 5: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 6: https://github.com/actions/checkout
- 7: Remove
persist-credentialsor change the default tofalseactions/checkout#485
Do not execute release tooling from the caller-selected ref.
The workflow checks out inputs.source_ref but later runs .github/scripts/manifest_version.py from actions/checkout’s default persisted GITHUB_TOKEN; after that, Git commands can push arbitrary refs before the explicit git push origin "$TAG". Keep checkout credentials disabled for the selected source, fetch the trusted release tooling/_lib.py from main, and use a scoped push token only where the tag is pushed.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 97-101: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/alpha-release.yml around lines 97 - 101, Update the
Checkout source ref step to disable persisted credentials, then explicitly fetch
the trusted release tooling and _lib.py from main before invoking
manifest_version.py. Ensure release operations use those main-sourced scripts
rather than files from inputs.source_ref, and configure a narrowly scoped push
token only for the explicit git push of the release tag.
Source: Linters/SAST tools
* Revert "fix(release): trigger alpha tag publish (#633)" This reverts commit 45b212f. * Revert "fix(release): trigger alpha publish pipeline (#632)" This reverts commit 4f1b339. * Revert "fix(ci): simplify alpha release inputs (#628)" This reverts commit 72a6595. * Revert "feat(release): add alpha releases from pull request branches (#626)" This reverts commit ac0f750. * Revert "fix(release): isolate alpha releases (#631)" This reverts commit 156f5dd. * Revert "chore(image-resize): bump to v0.1.13-alpha.1" This reverts commit 0cba488. * Revert "feat(release): split version suffix from registry channel (#615)" This reverts commit d0bc06d.
1 participant
What changed
Adds an Alpha Release workflow for publishing a worker from an unmerged pull-request branch.
The workflow checks out an explicit source ref, creates an ephemeral
-alpha.Nversion commit, and pushes only its annotated tag. The existing release pipeline then publishes the artifact as a GitHub prerelease on theexperimentalregistry channel.The release SOP now documents how to run the workflow with a PR branch or
refs/pull/<number>/head.Why
This enables integration testing of a PR's release artifact without modifying the PR branch,
main,latest, ornext.Validation
actionlint .github/workflows/alpha-release.ymlpytest .github/scripts/tests— 158 passed (containerized)Summary by CodeRabbit
New Features
Documentation